Question

A network engineer is bringing up a Cisco Catalyst SD-WAN secure internet gateway (SIG) tunnel to Zscaler using IPsec. The tunnel repeatedly fails during IKEv2 authentication. The Zscaler location was provisioned with a pre-shared key and expects the tunnel to be identified by an email-style location ID (e.g., branch1@company.com) rather than by the WAN edge's public IP address, which is dynamically assigned behind a NAT device. Which configuration change on the WAN edge router will allow the IKEv2 session to authenticate successfully?

Accepted Answer

Configure the IKEv2 local identity as an FQDN/email-id matching the Zscaler location ID and use pre-shared-key authentication

Answer

Change the IKEv2 authentication method to RSA certificates and disable pre-shared keys on both endpoints

Answer

Set the IKEv2 local identity to the router's WAN interface IP address and enable IP-based peer matching

Answer

Disable NAT traversal (UDP 4500) so that the router's real public IP is presented to Zscaler for identity matching