VPN Site-to-Site and Global Protect - DynDNS IP WAN DHCP

[Metgatz]

Hello, good afternoon everyone, I hope you are very well.

I have a couple of questions, I hope you can clarify and help me.

1.- Is it feasible to create a Site-to-Site tunnel between two sites with DYNAMIC IP ? Example using DYNDNS, in both sites, is it feasible to set up a tunnel between these two sites, both with Dynamical IP ?

2.- Is it possible to configure Global Protect on a site with DynDNS? Is DynDNS compatible with the configuration of global protect.

Thank you very much, I remain attentive, greetings.

[BPry]

@Metgatz,

1.- Is it feasible to create a Site-to-Site tunnel between two sites with DYNAMIC IP ? Example using DYNDNS, in both sites, is it feasible to set up a tunnel between these two sites, both with Dynamical IP ?

Yup, as long as you configure everything correctly this would work perfectly fine. You would use FQDN on the initiator for the Peer IP Address Type so that it can keep the IP updated and the rest of the setup would be completed as normal.

2.- Is it possible to configure Global Protect on a site with DynDNS? Is DynDNS compatible with the configuration of global protect.

Yup, this would work perfectly fine as well.

[Metgatz]

@BPry 

Thank you very much for your response.

One doubt, in the IKE configuration, when you have to specify the local IP, how would you apply this configuration ? As None, no IP is entered on both sites, on both Palo Alto ?

It would be like this the following Link: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIGCA0 but both with IP WAN DHCP ?

I remain attentive, thank you very much

[BPry]

@Metgatz,

You're using an older release, so you'll want to upgrade. I can't recall if it was added in PAN-OS 9 or 9.1, but newer releases have FQDN as a Peer IP Type when they officially added support for DDNS on the firewall. 

[Metgatz]

@BPry 

And on the Local IP side in the IKE configuration, do you still leave it as None, as it appears there ? Since the IP of that interface is Dynamic, is it configured as None in the same way in the recent versions ?