# FlexVPN Site-to-Site Smart Defaults

**URL:** https://forum.networklessons.com/t/flexvpn-site-to-site-smart-defaults/13149
**Category:** Lessons Discussion
**Created:** [December 22, 2020, 3:23pm UTC](https://forum.networklessons.com/t/flexvpn-site-to-site-smart-defaults/13149 "2020-12-22T15:23:34Z")
**Posts on this page:** 1
**Showing post:** 5

<div class="post-metadata">

### Author: ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)
#### Post date: [June 10, 2025, 7:15am UTC](https://forum.networklessons.com/t/flexvpn-site-to-site-smart-defaults/13149/5 "2025-06-10T07:15:36Z")

</div>

Hello William

You’re right, it is confusing! I believe the source of the confusion comes from the use of the `fqdn` keyword.

The use of FQDNs in IKEv2 profiles doesn’t require DNS resolution because these FQDN values simply serve as static identifiers rather than actual DNS queries.

The `match identity remote fqdn` command compares the peer’s declared identity against a preconfigured string. Peers exchange identities during IKEv2 negotiation as raw strings, not IP addresses. This FQDN value simply acts as an authentication fingerprint. Both devices must have matching configurations for local identity (e.g., `identity local fqdn R1.NWL.LAB`) and remote identity (e.g., `match identity remote fqdn R2.NWL.LAB`).

The approach is analogous to using pre-shared keys (PSKs) - both ends need identical configurations, but no underlying DNS infrastructure is required. This makes it suitable for static site-to-site VPNs where IP addresses might change but organizational naming remains consistent.

For the command, you can actually input whatever you want! For example you can issue the following command:

`match identity remote fqdn helloworld`

If the string matches, it will work. There are other options to use such as email, domain, or key ID. See this [command reference](https://www.cisco.com/c/en/us/td/docs/routers/sdwan/command/iosxe/qualified-cli-command-reference-guide/m-crypto-commands.html#Cisco_Command_Page.dita_33cd5e04-1f52-436a-9660-099c9734b64a) for more details.

So these values simply serve as labels, but it is useful to have them use meaningful values rather than some dummy value like helloworld that I mentioned before. Does that make sense?

I hope this has been helpful!

Laz

---

_[View the full topic](https://forum.networklessons.com/t/flexvpn-site-to-site-smart-defaults/13149)._