topic Remote VPN Peer Dynamic IP in Network Security

Remote VPN Peer Dynamic IP

danielsormsby — Fri, 21 Feb 2020 11:10:04 GMT

I'm transitioning from a Netscreen 50 to an ASA 5510. Trying to re-establish the few VPN tunnels that I have. On the old Netscreen, rather then using a IP address for the far end of the tunnel, it uses a "PeerID" (the other end of the tunnel gets it's IP address DHCP from comcast). Is this functionality available in ASDM? When I run the VPN Wizard, I don't see an option for it, only for IP address. Don't want to use an IP, because it can and does change often.

Thanks!

Re: Remote VPN Peer Dynamic IP

Jon Marshall — Mon, 15 Dec 2008 20:11:20 GMT

Daniel

Yes this functionality is available with the ASA, it is called dynamic crypto maps. Have a look at the following configuration guide and if you still have questions don't hesitate to come back -

http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/ike.html#wp1042880

Jon

Re: Remote VPN Peer Dynamic IP

danielsormsby — Mon, 15 Dec 2008 21:56:37 GMT

Jon,

I think I understand what's going on here, except for one thing:

The crypto map (not dynamic) uses the peer ip address and pre-shared key to authenticate the peer. I have this for the peer:

(123 is my example peer IP Address)

crypto map Outside_map 20 set peer 123.123.123.123

what other identifier would I use with the dynamic crypto map to identify the peer (since I'm not going to use the IP)?

Thanks for your patience 🙂

Re: Remote VPN Peer Dynamic IP

Jon Marshall — Mon, 15 Dec 2008 22:31:48 GMT

Daniel

With a dynamic crypto map the only "identifier" as such is the pre-shared key. With a dynamic crypto map any IP address can attempt a connection to the VPN device but obviously without the pre-shared key it will not authenticate and set up a tunnel.

Hence the security of the tunnel is even more reliant on the pre-shared key.

Jon

Re: Remote VPN Peer Dynamic IP

danielsormsby — Tue, 16 Dec 2008 00:35:52 GMT

Jon,

Well, I suppose that would make sense! As always, thanks for helping the newbie 🙂

--Dan