How does the SonicWall handle IKE Identities?

03/26/2020 18 16365

DESCRIPTION:
How does the SonicWall handle IKE Identities?

RESOLUTION:

Note the following:

Firmware 6.6.x using PSK
   In Aggressive Mode the security appliance sends ID_USER_FQDN as its Phase 1 ID, and accepts ID_USER_FQDN or ID_FQDN from the remote peer gateway.
    In  Main  Mode  the  security  appliance  sends  ID_IPv4_ADDR  as  its  Phase  1  ID,  and  accepts ID_IPv4_ADDR from the remote peer gateway.

SonicOS 2.x/3.x Standard using PSK
   In Aggressive Mode the security appliance sends ID_USER_FQDN as its Phase 1 ID, and accepts ID_USER_FQDN or ID_FQDN from the remote peer gateway.
   In  Main  Mode  the  security  appliance  sends  ID_IPv4_ADDR  as  its  Phase  1  ID,  and  accepts ID_IPv4_ADDR from the remote peer gateway.

SonicOS 2.x/3.x Enhanced using PSK
    In Aggressive Mode with a site-to-site tunnel to another SonicWall security appliance  not running Enhanced firmware, The Local IKE ID must be set to type SonicWall Identifier (which is ID_USER_FQDN) and its value must be same as the policy “Name” field on the SonicWall security appliance not running enhanced firmware. The Remote IKE ID must be set to type SonicWall Identifier and its value needs to be the same as the “Unique Firewall Identifier” of the SonicWall security appliance not running Enhanced.
  In Aggressive Mode with a site-to-site tunnel to another SonicWall security appliance running Enhanced firmware, the user must configure the Local IKE ID and the Remote IKE ID. The user can pick from the following: Domain Name, Email Address, and SonicWall Identifier. Please note that while there is an existing bug in all versions of SonicOS Enhanced 3.5.0.2 and older that will let you select IP Address as the IKE ID type, it will not work (IKE negotiations will fail). The Local IKE ID on system one must be the same type and have the same value as the Remote IKE ID on system two and vice-versa.
   In Main Mode, if the user has not set Local IKE ID or Remote IKE ID, which should be the case unless this is a site-to-site setup with another security appliance running Enhanced firmware, the security appliance sends ID_IPv4_ADDR as its Phase 1 ID, and expects ID_IPv4_ADDR from the remote peer gateway.

Using Certificates
  The IKE ID is chosen from the Certificate contents as follows: If there is a subjectAltName of type ID_FQDN or ID_USER_FQDN, that type is selected and the value of the subjectAltName is sent (as a string, non-NULL terminated).  If multiple subjectAltName's are present, the first ID_FQDN or ID_USER_FQDN is sent. If no subjectAltName is present, the subjectName is sent as a binary DER encoding of the ASN.1 X.500 Distinguished Name with type ID_DER_ASN1_DN.