VPN Site to Site with Third Party Gateway and using DynDNS

[Smorales]

Hello, everyone.

Due to a requirement, I have been investigating how to generate a Site-to-Site VPN to a third-party gateway, but unlike other VPNs, the peer for this new VPN does not have a static public IP address. It uses DynDNS, which means it uses a domain for a public IP address that changes constantly.

Honestly, I don't see how this could work, since regardless of the type of VPN I use, whether it's domain/route-based or if I use Pre-Shared Keys or Certificates, they need a fixed public IP from the peer to establish IKE.

I was thinking of using the “Resolve from name” option in the interoperable object, but after doing some more research, I read that when it resolves and the domain changes IP, you need to manually change the object so that it resolves with the new IP, and this is not very efficient.

My question is: have you had any similar activity? Do you know of any documentation that relates to something like this?

Best regards!

[CaseyB]

I have plenty of these working with Check Point devices, but I would imagine it would be similar for a third-party gateway if it was to work.

• DAIP Gateway
• Certificate authentication

The DAIP gateway will always be the one initiating the IPsec tunnel since the DAIP gateway is dynamic.

sk36968 

sk167473 

[emmap]

When you create your Interop Device, tick the Dynamic Address box next to the Resolve from Name button. Then in IPSec VPN / Link Selection, select the Use DNS resolving radio button and put the FQDN in the Full hostname box. You will need to use Cert based auth for this to work.