Solved

How to have Site to site VPn on Dynamic Ip address

Posted on 2004-08-30
3
843 Views
Last Modified: 2008-03-06
Hi All

I am using PIX 515 E at one end and PIX 506 at another end.At bothe ends i dont have static Ip address hence i am using DDNS (dynamic DNS) to resolve the current IP address on teh firewall for enabling the Remote dialin VPN.its working fine as well.

Now if i want have a SITe-SITe Vpn working between these two sites how can i do it with this dynamic IP address?  I tried using Host name which configuring the Peer host name in the VPn policies but it goes to "Resolving domain name" and terminates saying that hostname cannot be resolved while that domain name is running at another site..

Is i am missing something in the configuration?
Regards and thanks

Samir.
0
Comment
Question by:samprav
3 Comments
 
LVL 3

Accepted Solution

by:
frieked earned 150 total points
ID: 12000190
Sorry to break it to you but the pix currently can not do name resolution although dns requests can be configured to pass through the pix...so dynamic dns is not an option...I pulled this answer straight off cisco's site: Q. Can the PIX do name resolution?
A. While a properly configured PIX does permit Domain Name System (DNS) traffic through to allow for inside and outside devices to do DNS, the PIX itself does not resolve names.

As far as I know it is not possible to set up a site to site vpn between 2 dynamic hosts...because what happens in the case where both hosts get new IP addresses at the same time, neither one knows how to contact the other and the VPN is dropped.

You need one pix to act as the static and set it up to accept dynamic connections like so:
!--- ISAKMP Policy for accepting dynamic connections from remote PIX
isakmp key ******** address 0.0.0.0 netmask 0.0.0.0

See this page for full instructions on setting up a static to dynamic vpn between 2 pix's:
http://www.cisco.com/en/US/products/sw/secursw/ps2308/products_configuration_example09186a0080094680.shtml

I am going to assume you are aware of the security risk of allowing dynamic vpn connections so I won't get into that.

One other note...depending on how often your IP changes you can pretend one or both of your pix's has a static IP address.  I have optimum online and my IPs are dynamic but change very infrequently so I just update my VPNs whenever they change.
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Suggested Solutions

Many people tend to confuse the function of a virus with the one of adware, this misunderstanding of the basic of what each software is and how it operates causes users and organizations to take the wrong security measures that would protect them ag…
I use more than 1 computer in my office for various reasons. Multiple keyboards and mice take up more than just extra space, they make working a little more complicated. Using one mouse and keyboard for all of my computers makes life easier. This co…
Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now