topic Re: VPN Site-to-Site and Global Protect - DynDNS IP WAN DHCP in General Topics

VPN Site-to-Site and Global Protect - DynDNS IP WAN DHCP

Metgatz — Thu, 08 Jul 2021 17:59:23 GMT

Hello, good afternoon everyone, I hope you are very well.

I have a couple of questions, I hope you can clarify and help me.

1.- Is it feasible to create a Site-to-Site tunnel between two sites with DYNAMIC IP ? Example using DYNDNS, in both sites, is it feasible to set up a tunnel between these two sites, both with Dynamical IP ?

2.- Is it possible to configure Global Protect on a site with DynDNS? Is DynDNS compatible with the configuration of global protect.

Thank you very much, I remain attentive, greetings.

Re: VPN Site-to-Site and Global Protect - DynDNS IP WAN DHCP

BPry — Thu, 08 Jul 2021 18:28:55 GMT

@Metgatz,

Yup, as long as you configure everything correctly this would work perfectly fine. You would use FQDN on the initiator for the Peer IP Address Type so that it can keep the IP updated and the rest of the setup would be completed as normal.

2.- Is it possible to configure Global Protect on a site with DynDNS? Is DynDNS compatible with the configuration of global protect.

Yup, this would work perfectly fine as well.

Re: VPN Site-to-Site and Global Protect - DynDNS IP WAN DHCP

Metgatz — Thu, 08 Jul 2021 18:40:36 GMT

@BPry

Thank you very much for your response.

One doubt, in the IKE configuration, when you have to specify the local IP, how would you apply this configuration ? As None, no IP is entered on both sites, on both Palo Alto ?

It would be like this the following Link: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIGCA0 but both with IP WAN DHCP ?

I remain attentive, thank you very much

Re: VPN Site-to-Site and Global Protect - DynDNS IP WAN DHCP

BPry — Thu, 08 Jul 2021 18:58:28 GMT

@Metgatz,

You're using an older release, so you'll want to upgrade. I can't recall if it was added in PAN-OS 9 or 9.1, but newer releases have FQDN as a Peer IP Type when they officially added support for DDNS on the firewall.

Re: VPN Site-to-Site and Global Protect - DynDNS IP WAN DHCP

Metgatz — Thu, 08 Jul 2021 19:38:16 GMT

@BPry

And on the Local IP side in the IKE configuration, do you still leave it as None, as it appears there ? Since the IP of that interface is Dynamic, is it configured as None in the same way in the recent versions ?