Dynamic IP at Spoke site in PAN-OS SD-WAN Hub/Spoke topology

ahwang2929 — Fri, 05 Sep 2025 07:36:32 GMT

I am new to PAN-OS SD-WAN and need to clarify Internet service requirement at new spoke site.

My client has PAN-OS SD-WAN hub-and-spoke topology, the hub PA firewall has a static public IP for its internet service.

All spoke PA firewalls also use static public IPs, but we now will have a new spoke with a dynamic public IP.

I am hoping to confirm my understanding is correct -

In a hub/spoke topology, spoke firewalls always initiate the IPsec tunnel to the hub. (Hub never initiate tunnels to spoke)
Therefore, new spoke with a dynamic IP should be able to connect to the hub and join the SD-WAN cluster without requiring DDNS on its interface.
Based on the admin guide below, it states "Using DHCP on a hub requires the Palo Alto Networks DDNS service". so I assume DHCP on a branch doesn't require DDNS service.

From Admin guide -

Although DHCP Client is supported for a hub or branch interface, on a hub interface it’s preferable for you to assign a Static address instead of DHCP Client. Using DHCP on a hub requires the Palo Alto Networks DDNS service. Using a Static address at the hub site creates a more stable environment because DDNS isn’t involved when resolving the DHCP IP address changes, and because the DDNS service can take a few minutes to register the new IP address when it changes. If you have multiple branch sites connecting to a hub site, having stability is critical to keeping the network up and running.

Re: Dynamic IP at Spoke site in PAN-OS SD-WAN Hub/Spoke topology

BPry — Fri, 05 Sep 2025 19:54:30 GMT

@ahwang2929,

That is correct, using a dynamic IP on a spoke isn't any concern in a hub-spoke topology. It would create an issue if you were using a mesh deployment, but outside of that it won't matter.

Re: Dynamic IP at Spoke site in PAN-OS SD-WAN Hub/Spoke topology

ahwang2929 — Fri, 05 Sep 2025 23:42:46 GMT

Thanks, could you please also confirm if DHCP on a branch doesn't require DDNS service in hub/spoke topology?

topic Dynamic IP at Spoke site in PAN-OS SD-WAN Hub/Spoke topology in Next-Generation Firewall Discussions

Dynamic IP at Spoke site in PAN-OS SD-WAN Hub/Spoke topology

Re: Dynamic IP at Spoke site in PAN-OS SD-WAN Hub/Spoke topology

Re: Dynamic IP at Spoke site in PAN-OS SD-WAN Hub/Spoke topology