How do I set up a Pix to endpoint with changing IP address

[cchipman]

I have a configuration issue I've not dealt with before. We are wanting to set up one of our new offices to use a tunnel to our Pix box at the main offices.

Her DSL account is one of those DHCP ones where the IP address will change every great once in a while. How do we set it up?

I've set up several tunnels between static end-points, but have no idea on how to set one up to when an endpoint my change.

It would be ok to start the conversation from a Pix-to-Pix perspective, and I'll extra the principle from there.

I looked at the document "Cisco - Configuring a LAN-to-LAN IPSec Between a Router and a PIX Using Digital Certificates"

but I got a bit confused about the certificates. Do we have to pay the CA? or how does that work exactly?

I'm confused and could use some assistance.

 

[routerman]

There is an IPSec enhancement called Tunnel Endpoint Discovery (TED) which I've read about but not used.

According to the info I have (from Cisco secure VPN by Mason), the remote router initiates a connection, the central one identifies it and starts the IKE exchange.

the restrictions are:

IKE cannot start until the peer is identified,

Its only available on dynamic crypto maps.

Hope that point you in the right direction.

 

[themut]

If you want to keep it simple you may want to use the link below as a guideline:

http://www.cisco.com/en/US/products...s_configuration_example09186a0080094680.shtml

Regarding your CA question... you don't have to pay the CA, you could use the Windows CA server which is free. You have to set it up and administer it but it works fine. Certs can be quite cumbersome sometimes.

 

[cchipman]

Cisco called me back after I called them, and said that If I set the target peer address to 0.0.0.0 it would work for any ip address that had the correct preshared key or certificate.

 

[themut]

That's correct! And all the information on how to configure it is on the link provided earlier.

 

[cynertex]

You could also use this command
ip nat-traversal

 

[dopehead]

But then you can only have one such connection. If you need more than one of this type of connection Easy VPN Server in network extension mode is your solution, preferably with nat -traversal enabled.

Jan

Network Systems Engineer
CCNA/CQS/CCSP