topic Re: IPSEC with dynamic ip in General Topics

IPSEC with dynamic ip

Bar_G — Sun, 02 Dec 2018 09:09:11 GMT

hello,

I got this scenario,

In my compay (HQ) we've a cp 5000 appliance, in our branches we have a cp 1430 or 1100 and we create a IPsec between the HQ (5000) to our brances through the internet. both sides configure with ip static from ISP.

now I got a new branche that it is difficult to get from the isp a ip static.

now I want to know if there is any option to do IPSEC when one side (our HQ) is configure with ip static , and the other side is configure with a dynamic ip and how ?

we're working with version r80.10

thanks guy's.

Re: IPSEC with dynamic ip

Wille010 — Sun, 02 Dec 2018 10:33:48 GMT

Generate a certificate to use with the daip gateway. Either use 3rd Party Trusted CA to generate Certificates for Gateways or you can use the ICA to generate a Cert to use with the DAIP gateway.

Maybe sk94028 will help.

Cheerz,

Lesley

Re: IPSEC with dynamic ip

Bar_G — Sun, 02 Dec 2018 11:35:53 GMT

I just forgot to mention we're working with NAT on both sides,this is effect on the configuration ?

Re: IPSEC with dynamic ip

Maarten_Sjouw — Sun, 02 Dec 2018 15:18:44 GMT

Is your center gateway behind a NAT device? As long as this is a static NAT that forwards all traffic to the Static NAT IP to your gateway, this should not be a problem.

Just define the 1100/1400 gateway in central management with Dynamic IP and in the center gateway you define the External NAT IP in the link selection page of the gateway object. Now just add both gateways to a star community (center gw as center and 1100/1400 as satellite) and set the configuration as you want, do not set a pre-shared key when gateways are managed by the same management server.