VPN Site to Site with Third Party Gateway and using DynDNS

[Smorales]

Hello, everyone.

Due to a requirement, I have been investigating how to generate a Site-to-Site VPN to a third-party gateway, but unlike other VPNs, the peer for this new VPN does not have a static public IP address. It uses DynDNS, which means it uses a domain for a public IP address that changes constantly.

Honestly, I don't see how this could work, since regardless of the type of VPN I use, whether it's domain/route-based or if I use Pre-Shared Keys or Certificates, they need a fixed public IP from the peer to establish IKE.

I was thinking of using the “Resolve from name” option in the interoperable object, but after doing some more research, I read that when it resolves and the domain changes IP, you need to manually change the object so that it resolves with the new IP, and this is not very efficient.

My question is: have you had any similar activity? Do you know of any documentation that relates to something like this?

Best regards!

[CaseyB]

I have plenty of these working with Check Point devices, but I would imagine it would be similar for a third-party gateway if it was to work.

• DAIP Gateway
• Certificate authentication

The DAIP gateway will always be the one initiating the IPsec tunnel since the DAIP gateway is dynamic.

sk36968 

sk167473 

[emmap]

When you create your Interop Device, tick the Dynamic Address box next to the Resolve from Name button. Then in IPSec VPN / Link Selection, select the Use DNS resolving radio button and put the FQDN in the Full hostname box. You will need to use Cert based auth for this to work. 

[the_rock]

I actually saved the doc someone here in community made while back. Let mr see if I can find the post about it, but if not, will look for a document.

[the_rock]

@Smorales 

I believe this is it.

https://community.checkpoint.com/t5/Security-Gateways/VPN-site-to-site-with-Remote-Peer-Dynamic-IP/m...

[Smorales · Accepted solution]

Hello team.

Sorry for the very late reply.

Yesterday, I was able to successfully set up the tunnel thanks to your comments and documentation.

Here is a summary of what I did:

1. I used a client CA instead of the Security Management CheckPoint and imported the certificate signed by that same CA on both sides of the VPN (Check Point and third-party peer).

2. The interoperable object was configured as mentioned by “emmap”: check the Dynamic Address checkbox. In the topology section, manually enter a “WAN” interface and select that it has a dynamic IP. In Ipsec VPN, enter the trusted CA certificate in the matching criteria and enter the DN that the other gateway entered in the DN section (following the steps in the document mentioned by the_rock).

3. Generate the VPN community with the corresponding encryption settings, permanent tunnels, VPN routing, advanced settings, or whatever else is considered necessary.

With these settings, the tunnel was set up without any problems.

I would like to point out that the part that was a little complicated at first was the interoperable object, which I consider to be the main thing for the VPN to work properly.

Once again, thank you very much for your comments and support, team.

Best regards.

[the_rock]

Great news!