• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 445
  • Last Modified:

VPN's and 2-way satellite connections

Can someone explain to me the implications of static v. dynamic IP addresses on broadband satellite solutions?  Also, I know there is an issue with running a "tunnel within a tunnel" but don't fully comprehend the reasons behind it.  Are these two issues interrelated?  The land-based transmitter/receiver in a satellite connection actually uses a VPN to tunnel into the internet?  And because of this one cannot run a VPN across a two-way satellite connection ie.., a tunnel within a tunnel?
0
KlarkKent
Asked:
KlarkKent
  • 2
1 Solution
 
chris_calabreseCommented:
Static vs. dynamic
o You can't setup an IPsec association if you don't know the IP address on the other side to set it up to.
o  You can't host (web,ftp,email,whatever) services if you don't have a nailed down IP to talk to (well, OK, you could solve this with DDNS, but it's easier to get a nailed IP).

Tunnel within a tunel:
IPsec fully encapsulates whatever it sees, including more IPsec, so there's no particular reason this shoulnd't work as long as...
o You're actually using encapsulation mode (as opposed to Authentication Header mode, since then you don't get encapsulation)
o Your applications can deal properly with the packet length overhead of the extra tunnel.
o Your applications can deal with the performance overhead of double encryption.
o The tunnel doesn't also NAT (IPsec doesn't like NAT).
0
 
KlarkKentAuthor Commented:
Ok, so let me see if I understand.  

Static v. Dynamic:  If a network uses DHCP it makes it tougher to set up IPsec within a broadband connection, or any connection really.

Tunnel within a tunnel:  Would both tunnels need to use encapsulation mode or just the "outer" tunnel?  Same question for NAT, would it need to be avoided simply on the broadband provider's end or on both.  
0
 
chris_calabreseCommented:
Static v. Dynamic: Yes, that's the idea.

Tunnel wihin a tunnel: Yes, just the outer tunnel.

NAT: Both ends.
0

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now