> Source: [sk182890](https://support.checkpoint.com/results/sk/sk182890) # sk182890 - How to configure Check Point Gateway to use "RFC822_ADDR" (Email Address) as IKE ID | Property | Value | |----------|-------| | Solution ID | sk182890 | | Date Created | 2024-12-08 | | Last Modified | 2024-12-11 | | Technical Level | General | | Products | Security Gateway | | Versions | R81.20, R81.10 (EOS) | | OS | Gaia | ## Symptoms - Check Point Gateway use "IPV4_ADDR" as IKE ID By default ## Cause The issue described here pertains to Check Point Security Gateways using "IPV4_ADDR" (IP address) as the default IKE ID type in Site-to-Site VPN configurations. However, certain third-party devices, such as Cisco devices, require the IKE ID to be an "Email Address" (in RFC822 format) or an FQDN instead of the default IP address. Breakdown of the issue: * **Default Behavior:** Check Point Security Gateways use an IP address ("IPV4_ADDR") as the IKE ID when establishing Site-to-Site VPN connections. * **Requirement:** Some third-party vendors (as in, Cisco) require an email address (RFC822 format) or FQDN as the IKE ID, instead of the default IP address. * **Impact:** This mismatch can lead to VPN negotiation failures or connectivity issues with third-party devices.
## Solution 1. This problem has been fixed. The fix is included in the following: * **[Check Point R81.20](https://support.checkpoint.com/results/sk/sk173903)**and higher * [**Jumbo Hotfix Accumulator for R81.10**](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk170114) **starting from Take 61** Check Point recommends upgrading to the most recent version. 2. Only IKEv2 supports using RFC822_ADDR (Email Address) as the IKE ID. 3. Certificate authentication is required between VPN Gateways. Pre-shared Key authentication is not supported. For detailed instructions on using Certificates for authentication between Gateways, refer to the Site to Site VPN Administration Guide, such as: * R81.10 Site to Site VPN Administration Guide - Configuring a VPN with External Security Gateways Using Certificate. **To renew an IPSEC certificate and verify its configuration on a Check Point Security Gateway, follow these steps:** **Important:**Before you begin, backup the current configuration on the Security Gateway. Take a system snapshot and collect the backup file. 1. **Renew the IPSEC Certificate.** Edit the "Subject Alternate Name" and use Email. 1. Double-click the Gateway/Cluster Object. 2. Navigate to **IPsec VPN**. 3. Access **Repository of Certificates Available to the Gateway** , select the current certificate, and click **Renew**. 4. Select **Define Alternate Name** " and choose "**E-mail** " as the Type. Enter the email address. For example : ![Renew the IPSEC Certificate, How to configure Check Point Gateway to use "RFC822_ADDR" (Email Address) as IKE ID](https://sc1.checkpoint.com/sc/SolutionsStatics/sk182890/Screenshot_2202412040141571.png) 4. Reboot the Security Gateway. 5. Kill all traffic over the VPN with the third-party VPN Gateway. This action stops all continuous traffic across the VPN tunnel. 1. Run the command: `[Expert@HostName]# vpn tu` 2. Select the option "Delete all IPsec+IKE SAs for a given peer (GW)". 3. Enter the IP address of the 3rd party VPN Gateway. 4. Exit the `vpn tu` tool. 5. Run the command to check that there is no tunnel: `[Expert@HostName]# vpn tu tlist -p ` 6. If the tunnel still exists, repeat steps A-D and wait for a while. 6. Start the VPN debug on the Check Point Security Gateway. Use the "vpn debug" command, following the instructions in sk180488. 7. Initiate a VPN tunnel from the Check Point Gateway to the 3rd party VPN Gateway. Wait for the VPN tunnel to be established, then stop the VPN debug on the Check Point Gateway, following the instructions in sk180488. 8. Check the IKE Log. For R81.10 IKEv2, check the following log files: * `/var/log/opt/CPsuite-R81.10/fw1/log/ikev2.xmll.*` * `/var/log/opt/CPsuite-R81.10/fw1/log/legacy_ikev2.xmll.*`
Check the Authentication Message 1 -\> IDi. The IKE ID used in the negotiation should be of Type "RFC822_ADDR". Example: ``` IDi Payload Critical: No Data: vpn@haonan.ca Length: 21 Next payload: Cert Type: RFC822_ADDR ``` 9. If the IKE ID is not of type RFC822_ADDR**,** check the `vpnd.elg` log and search for "getIDfromCert". Example log: ``` [vpnd 12685 4071496320]@Gateway_A[3 Dec 1:48:56][ikev2] ikeAuthExchange::getIDfromCert: Entering [vpnd 12685 4071496320]@Gateway_A[3 Dec 1:48:56] Email: vpn@haonan.ca [vpnd 12685 4071496320]@Gateway_A[3 Dec 1:48:56][ikev2] ikeAuthExchange::getIDfromCert: found alternative name of type: 1. [vpnd 12685 4071496320]@Gateway_A[3 Dec 1:48:56][ikev2] ikeAuthExchange::getIDfromCert: using RFC 822 alt name: vpn@haonan.ca (vpn@haonan.ca) as ID data [vpnd 12685 4071496320]@Gateway_A[3 Dec 1:48:56][ikev2] Message::addPayload: Added payload 1 (IDi) ``` --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content