asa site to site

[ATechman]

Hi,
is it possible to set up site to site vpn with dynamic ip on both sides? im using asa 5505 and latest firmware.

//:Erik

 

[robertwork]

You can built an Ipsec VPN tunnel between Cisco routers, both on Dynamic IP addresses


In order to configure a LAN-to-LAN Virtual Private Network (VPN) tunnel between two routers with dynamic IP addresses, complete these steps apart from the basic configuration:


Configure the set peer dynamic command on one side of the tunnel with the use of the static crypto map.
On the remote router, configure the dynamic crypto map without the use of the peer statement.

With the use of the set peer dynamic command, the host name of the IP Security (IPsec) peer is resolved through a domain name server (DNS) lookup before the router establishes the IPsec tunnel.

 

[ATechman]

thanks, do you have mabye a config i can look at?

//:Erik

 

[burtsbees]

You also have to have ip domain lookup configured on the ASA, and an ACL on the outside, I believe...not always a good idea.

ip access-list extended IP-Options-and-Powerball
deny ip any any winning-powerball-ticket
permit ip any any option any-options
!
class-map ACL-Options-and-Powerball
match access-group name IP-Options-and-Powerball
!
policy-map CoPP-POLICY
class ACL-Options-and-Powerball
drop
!
control-plane
service-policy input CoPP-POLICY