Solved

VPN's and 2-way satellite connections

Posted on 2001-08-03
3
439 Views
Last Modified: 2010-04-12
Can someone explain to me the implications of static v. dynamic IP addresses on broadband satellite solutions?  Also, I know there is an issue with running a "tunnel within a tunnel" but don't fully comprehend the reasons behind it.  Are these two issues interrelated?  The land-based transmitter/receiver in a satellite connection actually uses a VPN to tunnel into the internet?  And because of this one cannot run a VPN across a two-way satellite connection ie.., a tunnel within a tunnel?
0
Comment
Question by:KlarkKent
  • 2
3 Comments
 
LVL 14

Expert Comment

by:chris_calabrese
ID: 6350436
Static vs. dynamic
o You can't setup an IPsec association if you don't know the IP address on the other side to set it up to.
o  You can't host (web,ftp,email,whatever) services if you don't have a nailed down IP to talk to (well, OK, you could solve this with DDNS, but it's easier to get a nailed IP).

Tunnel within a tunel:
IPsec fully encapsulates whatever it sees, including more IPsec, so there's no particular reason this shoulnd't work as long as...
o You're actually using encapsulation mode (as opposed to Authentication Header mode, since then you don't get encapsulation)
o Your applications can deal properly with the packet length overhead of the extra tunnel.
o Your applications can deal with the performance overhead of double encryption.
o The tunnel doesn't also NAT (IPsec doesn't like NAT).
0
 

Author Comment

by:KlarkKent
ID: 6355990
Ok, so let me see if I understand.  

Static v. Dynamic:  If a network uses DHCP it makes it tougher to set up IPsec within a broadband connection, or any connection really.

Tunnel within a tunnel:  Would both tunnels need to use encapsulation mode or just the "outer" tunnel?  Same question for NAT, would it need to be avoided simply on the broadband provider's end or on both.  
0
 
LVL 14

Accepted Solution

by:
chris_calabrese earned 50 total points
ID: 6356184
Static v. Dynamic: Yes, that's the idea.

Tunnel wihin a tunnel: Yes, just the outer tunnel.

NAT: Both ends.
0

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

When you connect to your workplace's VPN, you may not notice that you are using your workplace's servers to serve up webpages.  This might be undesirable since the workplace can log all the places you've been.  It also might be very slow to load pag…
How to set-up an On Demand, IPSec, Site to SIte, VPN from a Draytek Vigor Router to a Cyberoam UTM Appliance. A concise guide to the settings required on both devices
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

821 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question