FTD DDNS for VPN

[pannkakan_1]

Hi!

I have a question regarding DDNS and FTD. We get a DHCP address from our ISP on our outside interface which we're using for our VPN clients. We want to bind this address to a more convient name for example: vpn.example.com. I've read about DynDNS and No-IP but it seems you need a software on your computer. I've also found that you can configure this on routers with the CLI but im not sure if its possible on the FTD? I'm managing our FTD with our FMC.

[alex.baldwin]

I found a way to do this on the FirePower module of the ASA with firepower services (though it is totally unsupported and performed in expert mode)  However the Firepower module is not supported in later versions of the 5506 with the REST agent enabled and so I am now trying to find a way to do this with FTD so that I can move to FTD.

[darknight]

How did you do this?

[Mohammed al Baqari]

This is how to configure FTD DDNS from FMC.

https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/dhcp_and_ddns_services_for_firepower_threat_defense.html

[Mohammed al Baqari]

Remember to rate useful posts

[alex.baldwin]

Mohammed is correct but in that document Cisco is referring to DDNS for clients behind an ASA that are using the ASA for DHCPD.  I was referring to DDNS of the ASA public IP (acquired from the ISP via DHCP) to a service like DynDNS etc.  Which is not a feature Cisco provides, and I don't know why.  so I installed the DynDNS client on the Linux FirePower instance (SFR).  I'm sure if there was a support issue, the TAC engineer's head would spin around, but it was required in this instance as there was no client on the inside that could be used to register DynDNS.

[alex.baldwin]

I found a way to do this on the FirePower module of the ASA with firepower services (though it is totally unsupported and performed in expert mode)  However the Firepower module is not supported in later versions of the 5506 with the REST agent enabled and so I am now trying to find a way to do this with FTD so that I can move to FTD.

[darknight]

I was able to do this with an ASA years ago with CradlePoint devices. It's hard to believe Firepower would offer less functionality than ASA, but I'm finding this more and more to be the case.

[alex.baldwin]

How did you do it with ASA, because I don't think I see a DynDNS integration with ASA either.

[darknight]

I created a dynamic map then referenced it in the crypto map. 

This was years ago, but I think this was the Cisco document I used to get started - https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/118652-configure-asa-00.html

[IvanAlvarenga25979]

Is it possible to configure it using FDM ( no FMC ) ?

[Mohammed al Baqari]

AFAIK it can be done from FMC only.