IPSEC VPN support for both side as Dynamic, Supported on Juniper but not on PA

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

IPSEC VPN support for both side as Dynamic, Supported on Juniper but not on PA

L3 Networker

Hi There,


I was migrating configuration from Juniper to PA, everything worked as expected except IPSEC VPN.


Customer has two sites and both sites have ADSL connection with Dynamic IP address, however on one end Dyn DNS is used. In the below example Site-A has Dyn DNS and www.vpn.com gets updated as soon as IP gets changed on Site-A. But on PA there is no option to configure FQDN for static peer only IP address. However on Juniper you can select peer as Static and you can configured IP/FQDN, even though peer is dynamic you can select it as static and configure the FQDN "www.vpn.com" and Site-B fires IPSEC VPN traffic and works like a charm.




Below is the example, where you can configure FQDN on Juniper, I was wondering that does PA has any plan to allow both IP and FQDN if you select peer type as Static like Juniper.




Yes, you are correct. It's jsut a peer identification. As both peer is dynamic and hence does not know IP address of peer. So tunnel can't be initiated by any peer.


If we have one one end as static and other as dynamic, who has dynamic can always initiate the tunnel as it's local IP is dynamic but it knows peer IP.

Unfortunately, the feature to use a FQDN instead of an IP address for a remote VPN gateway is a rare one in the site-to-site VPN world. As you picture, SceeenOS had this feature and Sonicwall was the only other one I've worked with that allowed this configuration option.  This is very convenient but rare.


Even Juniper only semi migrated this to Junos.  They allow you to enter an FQDN gateway when you do a VPN configuration but Junos simply uses this to resove the CURRENT address for the FQDN then stores and uses the actual IP address in the configuration.


So the bottom line here is one side will need to have an IP address gateway entered to get a configuration to initiate and come up.

Steve Puluka BSEET - IP Architect - DQE Communications (Metro Ethernet/ISP)
ACE PanOS 6; ACE PanOS 7; ASE 3.0; PSE 7.0 Foundations & Associate in Platform; Cyber Security; Data Center

Hi, Yes, you are correct. One end should have static IP address to establish the IPSEC VPN.
  • 17 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!