Establish VPN from Static IP to Dynamic IP

[natesin]

I am not sure if this is possible, but if any one knows of a way to accomplish the following, please share.

I want to initiate a connection from an ASA that has a static public address to an ASA that has a dynamic address. I am not sure how this would be possible, but if so, please explain.

TIA

Natesin...

I am Nate, for I have sinned.

 

[garnetbobcat]

You could use a service like DynDNS to provide a domain name for the dynamic ASA. The ASA doesn't have a DynDNS client, though, so you would need a PC or something behind the ASA to update the service when the dynamic IP changes.

Matt

http://www.wr-mem.com

 

[natesin]

I was thinking DYNDNS, but I thought there may be another otpion.

Thanks!!

Natesin...

I am Nate, for I have sinned.

 

[Tekmazter]

There's a CISCO whitepaper on this. Go to CISCO.com. It's right on the ASA config docs page.

And DYNDNS isn't going to allow you to setup an IPsec tunnelf rom an ASA to ASA. You need to configure your ASA to accept a default pre-shared key from any IP address.

DYDNS is something else entirely.

 

[garnetbobcat]

Why would DYNDNS not work here?

Natesin wants to initiate a connection from an ASA with a static IP address to an ASA with a dynamic IP address. This could work at least two ways.

1. If the static ASA is configured as an EZVPN client it can be configured to connect to a hostname:

ASA(config)# vpnclient server ?

configure mode commands/options:
  Hostname or A.B.C.D  The IP address or name of the primary server
  WORD < 129 char      The DNS host name of the primary server
ASA(config)#
ASA(config)# vpnclient server whatever.dyndns.org

Thus, a DYNDNS address is used as the target. This requires that the dynamic ASA be set up as an EZVPN server, which does accept connections from all comers, but with XAUTH you don't have to rely solely on a default preshared key.

http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/ezvpn505.html

http://www.cisco.com/en/US/products...s_configuration_example09186a00808a61f4.shtml

2. A LAN to LAN tunnel could also be used here with DYNDNS and without the need to accept a default preshared key from any IP address, though it gets more complicated.

You can use the FQDN of each peer in your tunnel group configuration instead of an IP address. The static ASA is configured with the peer whatever.dyndns.org and the dynamic ASA is configured with the peer whatever.natesin.net.

I don't recall specifically what the caveats are for this, but I'm pretty sure certificates, rather than PSKs, are required to do this. There might be something else, too.

http://www.cisco.com/en/US/docs/security/asa/asa81/config/guide/ike.html#wp1052788

Matt

http://www.wr-mem.com

 

[Tekmazter]

garnetbobcat

I stand corrected. After looking at your response I believe this is possible. I completely forgot about the EZVPN client!

Since the early days of PIX, I've been primarily following CISCO's example here (though this has been updated to the ASA it now appears)

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00805733df.shtml

 

[garnetbobcat]

And that's a great example! It's just the other way around!

Matt

http://www.wr-mem.com