Site-to-Site VPN with DynDns

[prabhatrahul]

Hi,

I am planning to implement Site to Site VPN  with two ASA 5505.

But before purchasing i just want to know that, whether it is possible to configure site to site vpn  with two dyndns address one on each location.

Thanks & Regards,

Prabhat

[Dinesh Moudgil]

Hi ,

ASA supports only RFC compliant method for updates used with dynamic DNS , not HTTP updates , like dyndns.org and others use.
i.e. https://tools.cisco.com/bugsearch/bug/CSCsk25102/?reffering_site=dumpcr

On ASA , it is not possible to configure tunnel between two dynamic peers.
You will need to have one static end to configure static to dynamic IP.

For routers , you can follow this link.
Hope this helps.
 

Regards,
Dinesh Moudgil

P.S. Please rate helpful posts.

[rizwanr74]

Hi prabhatrahul,

Yes you can use dyndns FQDN names in the tunnel, as your tunnel peer address.

object network obj-hr88.cisco.com 
 fqdn hr88.cisco.com

dns domain-lookup inside 
dns server-group DefaultDNS
 name-server 192.168.1.200 
 domain-name cisco.com 

https://supportforums.cisco.com/document/66011/using-hostnames-dns-access-lists-configuration-steps-caveats-and-troubleshooting

Make sure to point your ASA to internal DNS server.

thanks.

[prabhatrahul]

Hi rizwan,

I am using ASDM to configure site to site VPN wizard, under Peer IP Address i am using abc.dyndns.org than click next i am getting error message as: Cannot interpret the IP Address:abc.dyndns.org.

Any solution ?

Thanks 

[rizwanr74]

Have you created the FQDN object before use it?

[prabhatrahul]

Yes, i created FQDN and it is resolving successfully:

ciscoasa(config)# show dns
Name: abc.dyndns.org
  Address: 123.123.123.123                                     TTL 00:01:50

but still from ASDM, peer IP Address: abc.dyndns.org and  VPN Access Interface: outside

getting same error "cannot interpret the ip address:abc.dyndns.org".

[rizwanr74]

Hi Prabhatrahul,

It is a bug on ASA, there is no fix aviable yet, you might want to read below.

https://tools.cisco.com/bugsearch/bug/CSCus37350

Thanks