12-04-2016 01:40 AM - edited 12-04-2016 01:46 AM
Hi There,
I was migrating configuration from Juniper to PA, everything worked as expected except IPSEC VPN.
Customer has two sites and both sites have ADSL connection with Dynamic IP address, however on one end Dyn DNS is used. In the below example Site-A has Dyn DNS and www.vpn.com gets updated as soon as IP gets changed on Site-A. But on PA there is no option to configure FQDN for static peer only IP address. However on Juniper you can select peer as Static and you can configured IP/FQDN, even though peer is dynamic you can select it as static and configure the FQDN "www.vpn.com" and Site-B fires IPSEC VPN traffic and works like a charm.
Below is the example, where you can configure FQDN on Juniper, I was wondering that does PA has any plan to allow both IP and FQDN if you select peer type as Static like Juniper.
12-07-2016 05:31 AM
Yes, you are correct. It's jsut a peer identification. As both peer is dynamic and hence does not know IP address of peer. So tunnel can't be initiated by any peer.
If we have one one end as static and other as dynamic, who has dynamic can always initiate the tunnel as it's local IP is dynamic but it knows peer IP.
12-08-2016 03:07 AM - edited 12-08-2016 03:13 AM
Unfortunately, the feature to use a FQDN instead of an IP address for a remote VPN gateway is a rare one in the site-to-site VPN world. As you picture, SceeenOS had this feature and Sonicwall was the only other one I've worked with that allowed this configuration option. This is very convenient but rare.
Even Juniper only semi migrated this to Junos. They allow you to enter an FQDN gateway when you do a VPN configuration but Junos simply uses this to resove the CURRENT address for the FQDN then stores and uses the actual IP address in the configuration.
So the bottom line here is one side will need to have an IP address gateway entered to get a configuration to initiate and come up.
12-09-2016 06:44 AM
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
