topic Re: dynamic ip vpn in Network Security

dynamic ip vpn

zeuscyril — Fri, 21 Feb 2020 10:57:47 GMT

hai friends,

i want to create site to site vpn between two sites but both the sites having dynamic ip.my question is ,is it possible to create site to site otherwise any other way is there ..if site to site is possible send any documentation

thanks

Re: dynamic ip vpn

Farrukh Haroon — Wed, 13 Aug 2008 11:08:00 GMT

No you cannot make a site-2-site vpn with dynamic IPs on both sides. Dynamic crypto maps don't allow you to initiate connections, if both sides have dynamic crypto maps, who will initiate the connection?

You can setup a remote-access VPN. Preferably register the VPN server IP with dyn-dns. Then just enter the dyn-dns hostname of the VPN server in the Cisco VPN Client. Just make sure you are running a newer version of the Cisco VPN Client.

Regards

Farrukh

Re: dynamic ip vpn

zeuscyril — Mon, 25 Aug 2008 05:37:02 GMT

by register with ip dyn-dns we cant create site to site vpn .using hostname we can communicate ?...otherwise tell me possible way.

Re: dynamic ip vpn

Farrukh Haroon — Mon, 25 Aug 2008 11:32:59 GMT

Yes it should work. Just make sure you use the latest version of the Cisco VPN Client.

Regards

Farrukh

Re: dynamic ip vpn

zeuscyril — Mon, 25 Aug 2008 13:08:24 GMT

thankyou for ur reply

i am not asking about remote vpn client...

it is possible to create site to site vpn using these dynamic dns hostname..

because i am having both sides dynamic ip.

if it is possible give me some example

thanks..

Re: dynamic ip vpn

Farrukh Haroon — Mon, 25 Aug 2008 13:20:24 GMT

I already told you that you cannot. From my original response:

"No you cannot make a site-2-site vpn with dynamic IPs on both sides. Dynamic crypto maps don't allow you to initiate connections, if both sides have dynamic crypto maps, who will initiate the connection? "

Please rate if helpful.

Regards

Farrukh

Re: dynamic ip vpn

zeuscyril — Mon, 25 Aug 2008 13:54:22 GMT

thanks for ur reply..

so there is no solution...so only possibility is remote client

Re: dynamic ip vpn

Farrukh Haroon — Mon, 25 Aug 2008 14:00:23 GMT

To my knowledge, YES.

Regards

Farrukh

Re: dynamic ip vpn

zeuscyril — Tue, 26 Aug 2008 05:37:13 GMT

hai

i configured remote client in asa 5505 and everything working fine.remotely connecting but the ip address and gateway is same..

for example i assign a pool 192.168.1.10-192.168.1.20

the ipconfig remotely

ip addrss 192.168.1.10

subnet 255.255.255.0

gateway 192.168.1.10...

so i am not able to access anything.

Re: dynamic ip vpn

Farrukh Haroon — Tue, 26 Aug 2008 06:33:19 GMT

That default gateway is normal. Don't worry about that.

'acesss anything' what do you mean? Did you check the encr/decr on the ASA and the VPN client?

Regards

Farrukh

Re: dynamic ip vpn

zeuscyril — Tue, 26 Aug 2008 06:40:50 GMT

not able to access means

i am trying to access that asa but itis not communicating and i tried to ping the asa also...request timed out is coming ..i tried telnet also..nothing is happening..i am attaching my config in this...

Re: dynamic ip vpn

Farrukh Haroon — Tue, 26 Aug 2008 11:10:15 GMT

What is the point of defining a 'permit any' ACL and then doing a 'tunnelspecified'? Just do a "tunnelall".

Is phase 1 and 2 UP after the client connects? Do you see encap/decap?

show crypto ipsec sa

Regards

Farrukh

Re: dynamic ip vpn

zeuscyril — Tue, 26 Aug 2008 12:36:08 GMT

thanks

ok i ll do it

Re: dynamic ip vpn

gsobeski — Wed, 27 Aug 2008 16:25:23 GMT

setup a DMVPN using NHRP at the hub site, which will keep track of the current global IP address at the two spokes, and they will be able to dynamically form tunnels between them, and even if the address changes, those updates will re-register with the NHRP server. That's assuming this is IOS-IOS VPN.

Re: dynamicer ip vpn

rm760 — Tue, 14 Dec 2010 19:39:24 GMT

Have you tried using a dynamic update client on a computer inside each firewall and then building the VPN using FQDNs instead of the IP address.

Re: dynamic ip vpn

Bastien Migette — Thu, 23 Dec 2010 14:02:58 GMT

What devices are you using ?

You can have One device with dynamic IP using easyVPN Server/client feature for sure, and I think you can have both with dynamic IP by using a DNS name instead of IP to define ezVPN server on client.

Re: dynamic ip vpn

rm760 — Thu, 23 Dec 2010 20:12:18 GMT

Thank you for your input but both end points devices are ASA5505 firewalls and I need site to site connectivity.

Re: dynamic ip vpn

Bastien Migette — Fri, 24 Dec 2010 07:39:10 GMT

So you can configure one asa with remote vpn as described here:

http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a0080809222.shtml

and enable network extension mode:

group-policy VPNGP attributes
nem enable

and on the other side, confiugre your asa as a easy vpn client. Asa server should have a DNS pointing to its IP, you can use dynamic DNS features:

http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/dhcp.html#wp1091527

      vpnclient mode network-extension-mode
      vpnclient nem-st-autoconnect
      vpnclient vpngroup VPN_Tunnel password VPNPSK
      vpnclient username xauthuser password xauthpwd
      vpnclient server asaserver.mycompany.com
      vpnclient enable

Network extension mode permit that user behind the asa acting as client access and be accessed through the VPN Tunnel. Default mode (client mode) will make the client asa NAT/PAT the inside hosts so they appear as being the asa.

If that solves your pb, please mark thread as resolved and/or rate it.