Solved

VPN's and 2-way satellite connections

Posted on 2001-08-03
3
435 Views
Last Modified: 2010-04-12
Can someone explain to me the implications of static v. dynamic IP addresses on broadband satellite solutions?  Also, I know there is an issue with running a "tunnel within a tunnel" but don't fully comprehend the reasons behind it.  Are these two issues interrelated?  The land-based transmitter/receiver in a satellite connection actually uses a VPN to tunnel into the internet?  And because of this one cannot run a VPN across a two-way satellite connection ie.., a tunnel within a tunnel?
0
Comment
Question by:KlarkKent
  • 2
3 Comments
 
LVL 14

Expert Comment

by:chris_calabrese
ID: 6350436
Static vs. dynamic
o You can't setup an IPsec association if you don't know the IP address on the other side to set it up to.
o  You can't host (web,ftp,email,whatever) services if you don't have a nailed down IP to talk to (well, OK, you could solve this with DDNS, but it's easier to get a nailed IP).

Tunnel within a tunel:
IPsec fully encapsulates whatever it sees, including more IPsec, so there's no particular reason this shoulnd't work as long as...
o You're actually using encapsulation mode (as opposed to Authentication Header mode, since then you don't get encapsulation)
o Your applications can deal properly with the packet length overhead of the extra tunnel.
o Your applications can deal with the performance overhead of double encryption.
o The tunnel doesn't also NAT (IPsec doesn't like NAT).
0
 

Author Comment

by:KlarkKent
ID: 6355990
Ok, so let me see if I understand.  

Static v. Dynamic:  If a network uses DHCP it makes it tougher to set up IPsec within a broadband connection, or any connection really.

Tunnel within a tunnel:  Would both tunnels need to use encapsulation mode or just the "outer" tunnel?  Same question for NAT, would it need to be avoided simply on the broadband provider's end or on both.  
0
 
LVL 14

Accepted Solution

by:
chris_calabrese earned 50 total points
ID: 6356184
Static v. Dynamic: Yes, that's the idea.

Tunnel wihin a tunnel: Yes, just the outer tunnel.

NAT: Both ends.
0

Featured Post

Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

Join & Write a Comment

Suggested Solutions

One of the Top 10  common Cisco VPN problems are not-matching shared keys. This is an easy one to fix, but not always easy to notice, see the case below. A simple IPsec tunnel between fast Ethernet interfaces of routers SW1 (f1/1) and R1(f0/0). …
I've had to do a bit of research to setup my VPN connection so that Clients can access Windows Server 2008 network shares.  I have a Cisco ASA 5510 firewall.  I found an article which was extremely useful: It had a solution if you use ASDM to config…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now