topic Re: Site-to-Site IP Sec - PAN 220 [Static IP] to CradlePoint [Dynamic IP] in General Topics

Site-to-Site IP Sec - PAN 220 [Static IP] to CradlePoint [Dynamic IP]

acrxsupport-old — Tue, 18 Aug 2020 03:00:39 GMT

Does anyone have experience setting up an site-to-site IP Sec tunnel between a PAN firewall with a static IP address and a CradlePoint with a dynamic IP address? I am trying to determine if there's a way to setup the IP Sec tunnel between the 2 endpoints without having to pay a 3rd party for DDNS service.

I tried setting the firewall peering to Dynamic, and the IKE Phase 1 exchange modes to Aggressive, but no luck.

Any help is appreciated.

Re: Site-to-Site IP Sec - PAN 220 [Static IP] to CradlePoint [Dynamic IP]

SutareMayur — Tue, 18 Aug 2020 05:58:35 GMT

@acrxsupport-old What option have you selected under local/peer identification type? You need to select proper settings here. Also what do you see under system logs?

Mayur

Re: Site-to-Site IP Sec - PAN 220 [Static IP] to CradlePoint [Dynamic IP]

reaper — Tue, 18 Aug 2020 09:41:58 GMT

as long as one side is static, this shouldn't be too difficult

the PA will need to be set as 'passive' as it won't be able to connect out to the dynamic peer (without ddns) and you'll need to use set peer identification to some fictitious FQDN or email (or the local IP of the remote peer, if said peer lives behind a NAT device)

Re: Site-to-Site IP Sec - PAN 220 [Static IP] to CradlePoint [Dynamic IP]

acrxsupport-old — Tue, 18 Aug 2020 11:00:04 GMT

Thanks for the responses @reaper and @SutareMayur.

I've got Local and Remote Identities set on both, and it isn't coming up.

If I enable Passive Mode on the PAN, it hasn't actually responding to the IKE Phase 1 - even if I use a Static peer address instead of Dynamic. The system logs unfortunately also don't have anything showing up.

Re: Site-to-Site IP Sec - PAN 220 [Static IP] to CradlePoint [Dynamic IP]

acrxsupport-old — Tue, 18 Aug 2020 11:07:13 GMT

I realized that I flipped the peering in the PAN IKE screenshot, this is corrected, but the results are the same.

Re: Site-to-Site IP Sec - PAN 220 [Static IP] to CradlePoint [Dynamic IP]

reaper — Tue, 18 Aug 2020 14:31:04 GMT

try these for more detailed debug logs:

> debug ike gateway <gw> on debug

> tail follow yes mp-log ikemgr.log

I noticed your local ip is 172.16x.x but you did not enable NAT-T, could you try turning that on?

Re: Site-to-Site IP Sec - PAN 220 [Static IP] to CradlePoint [Dynamic IP]

acrxsupport-old — Thu, 20 Aug 2020 20:54:05 GMT

@reaper thanks for your patience. This was very helpful for troubleshooting. It is working now with Responder Mode and NAT-T enabled, and using the matching identities.

Re: Site-to-Site IP Sec - PAN 220 [Static IP] to CradlePoint [Dynamic IP]

reaper — Thu, 20 Aug 2020 20:59:44 GMT

@acrxsupport-old that's great!

Re: Site-to-Site IP Sec - PAN 220 [Static IP] to CradlePoint [Dynamic IP]

JimMcGrady — Mon, 13 Feb 2023 05:30:07 GMT

When using 'user FQDN (email address)' identity, is it a real email that the system checks? Or is it just a text string?

Re: Site-to-Site IP Sec - PAN 220 [Static IP] to CradlePoint [Dynamic IP]

JosipMartinic — Tue, 27 May 2025 14:21:49 GMT

Hi, Have you tried with ikev2?