Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
Solved

How to have Site to site VPn on Dynamic Ip address

Posted on 2004-08-30
3
846 Views
Last Modified: 2008-03-06
Hi All

I am using PIX 515 E at one end and PIX 506 at another end.At bothe ends i dont have static Ip address hence i am using DDNS (dynamic DNS) to resolve the current IP address on teh firewall for enabling the Remote dialin VPN.its working fine as well.

Now if i want have a SITe-SITe Vpn working between these two sites how can i do it with this dynamic IP address?  I tried using Host name which configuring the Peer host name in the VPn policies but it goes to "Resolving domain name" and terminates saying that hostname cannot be resolved while that domain name is running at another site..

Is i am missing something in the configuration?
Regards and thanks

Samir.
0
Comment
Question by:samprav
3 Comments
 
LVL 3

Accepted Solution

by:
frieked earned 150 total points
ID: 12000190
Sorry to break it to you but the pix currently can not do name resolution although dns requests can be configured to pass through the pix...so dynamic dns is not an option...I pulled this answer straight off cisco's site: Q. Can the PIX do name resolution?
A. While a properly configured PIX does permit Domain Name System (DNS) traffic through to allow for inside and outside devices to do DNS, the PIX itself does not resolve names.

As far as I know it is not possible to set up a site to site vpn between 2 dynamic hosts...because what happens in the case where both hosts get new IP addresses at the same time, neither one knows how to contact the other and the VPN is dropped.

You need one pix to act as the static and set it up to accept dynamic connections like so:
!--- ISAKMP Policy for accepting dynamic connections from remote PIX
isakmp key ******** address 0.0.0.0 netmask 0.0.0.0

See this page for full instructions on setting up a static to dynamic vpn between 2 pix's:
http://www.cisco.com/en/US/products/sw/secursw/ps2308/products_configuration_example09186a0080094680.shtml

I am going to assume you are aware of the security risk of allowing dynamic vpn connections so I won't get into that.

One other note...depending on how often your IP changes you can pretend one or both of your pix's has a static IP address.  I have optimum online and my IPs are dynamic but change very infrequently so I just update my VPNs whenever they change.
0

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Introduction Often we come across situations wherein our batch files would be needing to reboot Windows for a variety of reasons. A few of them would be like: (1) Setup files have been updated whose changes can take effect only after a reboot …
In a recent article here at Experts Exchange (http://www.experts-exchange.com/articles/18880/PaperPort-14-in-Windows-10-A-First-Look.html), I discussed my nine-month sandbox testing of the Windows 10 Technical Preview, specifically with respect to r…
This is used to tweak the memory usage for your computer, it is used for servers more so than workstations but just be careful editing registry settings as it may cause irreversible results. I hold no responsibility for anything you do to the regist…
Hi friends,  in this video  I'll show you how new windows 10 user can learn the using of windows 10. Thank you.

838 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question