topic Re: VPN tunnel with Dynamic IP address. in General Topics https://community.checkpoint.com/t5/General-Topics/VPN-tunnel-with-Dynamic-IP-address/m-p/15118#M2568 <HTML><HEAD></HEAD><BODY><P>Thank you Andreas, are you aware about any SK or documents ?</P></BODY></HTML> Wed, 12 Dec 2018 09:38:14 GMT Sunil_Mishra 2018-12-12T09:38:14Z VPN tunnel with Dynamic IP address. https://community.checkpoint.com/t5/General-Topics/VPN-tunnel-with-Dynamic-IP-address/m-p/15116#M2566 <HTML><HEAD></HEAD><BODY><P>Hi,</P><P>Can we create a VPN tunnel between HO and Branch where HO is having static IP address and branch location is having dynamic IP address (Broadband Connection)?</P><P></P><P>Thanks.</P></BODY></HTML> Wed, 12 Dec 2018 09:14:39 GMT https://community.checkpoint.com/t5/General-Topics/VPN-tunnel-with-Dynamic-IP-address/m-p/15116#M2566 Sunil_Mishra 2018-12-12T09:14:39Z Re: VPN tunnel with Dynamic IP address. https://community.checkpoint.com/t5/General-Topics/VPN-tunnel-with-Dynamic-IP-address/m-p/15117#M2567 <HTML><HEAD></HEAD><BODY><P>Yes, you can.</P></BODY></HTML> Wed, 12 Dec 2018 09:29:13 GMT https://community.checkpoint.com/t5/General-Topics/VPN-tunnel-with-Dynamic-IP-address/m-p/15117#M2567 Andreas_Aust 2018-12-12T09:29:13Z Re: VPN tunnel with Dynamic IP address. https://community.checkpoint.com/t5/General-Topics/VPN-tunnel-with-Dynamic-IP-address/m-p/15118#M2568 <HTML><HEAD></HEAD><BODY><P>Thank you Andreas, are you aware about any SK or documents ?</P></BODY></HTML> Wed, 12 Dec 2018 09:38:14 GMT https://community.checkpoint.com/t5/General-Topics/VPN-tunnel-with-Dynamic-IP-address/m-p/15118#M2568 Sunil_Mishra 2018-12-12T09:38:14Z Re: VPN tunnel with Dynamic IP address. https://community.checkpoint.com/t5/General-Topics/VPN-tunnel-with-Dynamic-IP-address/m-p/15119#M2569 <HTML><HEAD></HEAD><BODY><P><A href="https://community.checkpoint.com/docs/DOC-2175">HowTo Set Up Certificate Based VPNs with Check Point Appliances</A></P></BODY></HTML> Wed, 12 Dec 2018 09:50:23 GMT https://community.checkpoint.com/t5/General-Topics/VPN-tunnel-with-Dynamic-IP-address/m-p/15119#M2569 Danny 2018-12-12T09:50:23Z Re: VPN tunnel with Dynamic IP address. https://community.checkpoint.com/t5/General-Topics/VPN-tunnel-with-Dynamic-IP-address/m-p/15120#M2570 <HTML><HEAD></HEAD><BODY><DIV style="font-size: 23.4px;">Dynamically Assigned IP Security Gateways</DIV><DIV style="font-size: 16.8px;">A Dynamically Assigned IP (DAIP) Security Gateway is a Security Gateway where the external interface's IP</DIV><DIV style="font-size: 16.8px;">address is assigned dynamic</DIV><DIV style="font-size: 16.8px;">ally by the ISP. Creating VPN tunnels with DAIP Security Gateways are only</DIV><DIV style="font-size: 16.8px;">supported by using certificate authentication. Peer Security Gateways identify internally managed DAIP</DIV><DIV style="font-size: 16.8px;">Security Gateways using the DN of the certificate. Peer Security Gateways iden</DIV><DIV style="font-size: 16.8px;">tify externally managed</DIV><DIV style="font-size: 16.8px;">DAIP Security Gateways and 3rd party DAIP Security Gateways using the</DIV><DIV style="font-size: 16.8px;">Matching Criteria</DIV><DIV style="font-size: 16.8px;">configuration</DIV><DIV style="font-size: 16.8px;">DAIP Security Gateways may initiate a VPN tunnel with non</DIV><DIV style="font-size: 16.8px;">-DAIP Security Gateways. However, since a</DIV><DIV style="font-size: 16.8px;">DAIP Security Gateway's external IP address is always changing, peer Security Gateways cannot know in</DIV><DIV style="font-size: 16.8px;">advance which IP address to use to connect to the DAIP Security Gateway. As a result, a peer Security</DIV><DIV style="font-size: 16.8px;">Gateway cannot initiate a VPN tunnel with a DAIP Security Gateway unless DNS Resolv</DIV><DIV style="font-size: 16.8px;">ing is configured on</DIV><DIV style="font-size: 16.8px;">the DAIP Security Gateway. For more information, see Link Selection</DIV><DIV style="font-size: 16.8px;">(on page 96).</DIV><DIV style="font-size: 16.8px;">If the IP on the DAIP Security Gateway changes during a session, it will renegotiate IKE using the newly</DIV><DIV style="font-size: 16.8px;">assigned IP address.</DIV><DIV style="font-size: 16.8px;">In a star community when VPN routing is configured, DAIP Security Gateways cannot initiate connections</DIV><DIV style="font-size: 16.8px;">from their external IP through the center Security Gateway(s) to other DAIP Security Gateways or through</DIV><DIV style="font-size: 16.8px;">the center to the Internet. In this configuration, connections from the encryption domain of the DAIP are</DIV><DIV style="font-size: 16.8px;">supported.</DIV></BODY></HTML> Wed, 12 Dec 2018 09:52:56 GMT https://community.checkpoint.com/t5/General-Topics/VPN-tunnel-with-Dynamic-IP-address/m-p/15120#M2570 Andreas_Aust 2018-12-12T09:52:56Z