VPN Question

D

dwk

Gawd
Joined
Jan 18, 2006
Messages
761
To do a VPN connection do both sides of the connection have to be static or can you get away with one being static and the other being dynamic? If you can do it with one being dynamic would it effect security in any way?
 
it can be done with a dynamic IP, but then every time the IP changes, you will need to reconfigure the endpoint with the static IP (enter in new IP for opposite endpoint) to reestablish the tunnel
 
Yes it can be done. Look at a Cisco EZVPN configuration. The VPN server has a static IP and the clients can be static or dynamic. The client initiates the VPN, so it doesn't need a static IP. I'm currently running this setup in a "site to site" config between my work's UC520 phone system and my PIX501 at home. It works great and hasn't gone down once in the last 3 months since I've configured it.
 
It can be done with dynamic...many VPN setups will support building tunnels via dynamic dns aliases. Whatever brand hardware/software you use for this obviously has to support setting up your VPN config using dns aliases. Some may not support this. I know quite a few do, as I've done them.

You can have static on one end, and dynamic on the other. Or both dynamic.

Obviously, the tunnel will drop when one of the ends does it's monthly or <whatever time period> IP change...you'll have to wait for the period of time (usually less than 15 minutes) for the dynamic dns service to update with the new IP and the VPN tunnel will establish.

If this occasional drop isn't a big concern..so be it. If you want maximum uptime...seek static on all ends. For most of my business client networks..I have them on static business grade accounts anyways..so they're always static.

However, for 2 of us at our office...since we have dynamic accounts at our homes...we've done our full time router to router VPN tunnels from our homes to the office (static at office) and it's worked fine.
 
You must log in or register to reply here.
Back
Top