Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Community Member

IPSEC VPN with dynamic to dynamic IP

Hi,

I have been trying out IPSEC VPN with dynamic to dynamic IP (router to router) for quite some time. But still cannot auto-establish the tunnel.

Can someone please tell me if it is possible to do it?

If yes, please share with me the secret to make it work.

Thank you!

Best Regards

1 ACCEPTED SOLUTION

Accepted Solutions
Community Member

Re: IPSEC VPN with dynamic to dynamic IP

Rather than Crypto map, I would use Crypto Profile.  Then you establish an IPSEC tunnel.  The beauty of Profile is that you can run Routing Protocols through it and you don't have to constantly change the maps everytime you change network topology.  The "* * * * *" in the event timer is "minute hour day month weekday" so "* * * * *" is every minute update it.  In Tunnel destination, it is an IP address, not a HOSTNAME that gets stored, but when you configure it, you can put in a HOSTNAME and it will convert it at the time you are configuring it to an IP.

So if you type:

config t

interface tunnel100
tunnel destination remote.dyndns.com

exit

show run int tunnel100

It shows:

interface Tunnel100
tunnel destination 75.67.43.79

That is why the event manager goes and changes the tunnel destination every minute to what ever the DDNS says the new IP is.

I didn't see that both of your routers were running DDNS.  They will need to for this to work.

Local Router:

crypto isakmp policy 1
encr aes 256
authentication pre-share
group 2
crypto isakmp key XXXXXXX address 0.0.0.0 0.0.0.0 no-xauth
!
!
crypto ipsec transform-set ESP-AES-SHA esp-aes 256 esp-sha-hmac
!
crypto ipsec profile CRYPTOPROFILE
set transform-set ESP-AES-SHA
!
interface Tunnel100
description to remote.dyndns.org
ip address 10.254.220.10 255.255.255.252
ip virtual-reassembly
ip tcp adjust-mss 1400
tunnel source Dialer0
tunnel destination 75.67.43.79
tunnel mode ipsec ipv4
tunnel protection ipsec profile CRYPTOPROFILE

ip route 192.168.2.0 255.255.255.0 10.254.220.9

event manager applet change-tunnel-dest
event timer cron name "CHRON" cron-entry "* * * * *"
action 1.0 cli command "enable"
action 1.1 cli command "configure terminal"
action 1.2 cli command "interface tunnel100"
action 1.3 cli command "tunnel destination remote.dyndns.org"
!

--------

Remote Router:


crypto isakmp policy 1
encr aes 256
authentication pre-share
group 2
crypto isakmp key XXXXXXX address 0.0.0.0 0.0.0.0 no-xauth
!
!
crypto ipsec transform-set ESP-AES-SHA esp-aes 256 esp-sha-hmac
!
crypto ipsec profile CRYPTOPROFILE
set transform-set ESP-AES-SHA
!
interface Tunnel100
description to local.dyndns.org
ip address 10.254.220.9 255.255.255.252
ip virtual-reassembly
ip tcp adjust-mss 1400
tunnel source Dialer0
tunnel destination 93.219.58.191
tunnel mode ipsec ipv4
tunnel protection ipsec profile CRYPTOPROFILE

ip route 192.168.1.0 255.255.255.0 10.254.220.10

event manager applet change-tunnel-dest
event timer cron name "CHRON" cron-entry "* * * * *"
action 1.0 cli command "enable"
action 1.1 cli command "configure terminal"
action 1.2 cli command "interface tunnel100"
action 1.3 cli command "tunnel destination local.dyndns.org"

Thanks,

Bert

12 REPLIES
Cisco Employee

Re: IPSEC VPN with dynamic to dynamic IP

that will not be possible because the guy who initiates the tunnel atleast needs to know with whom is he trying to establish the tunnel.

Community Member

Re: IPSEC VPN with dynamic to dynamic IP

Hi,

But I using DDNS, so the local can intiate the tunnel based on that address. I assume DDNS will resolve the problem you mentioned.

So what oher factors will cause the failure?

Community Member

Re: IPSEC VPN with dynamic to dynamic IP

Hi,

You will not be able to use DDNS in a Lan to Lan setup. That will work in the remote vpn setup.

Regards,

Nitin Agarwal.

Community Member

Re: IPSEC VPN with dynamic to dynamic IP

Hi,

We are not usingf DDNS in LAN. We have local & remote sites. For your advise pls.

Thank you

Community Member

Re: IPSEC VPN with dynamic to dynamic IP

This should work:

event manager applet change-tunnel-dest
event timer cron name "CHRON" cron-entry "* * * * *"
action 1.0 cli command "enable"
action 1.1 cli command "configure terminal"
action 1.2 cli command "interface tunnel199"
action 1.3 cli command "tunnel destination remotevpn.gotdns.com"
!

Have both routers running DDNS then every minute it will change the tunnel destination to what ever the DDNS is for the remote site.

Bert

Community Member

Re: IPSEC VPN with dynamic to dynamic IP

Wow.....This event manager is very new to me.

Sorry I don t quite understand the command, is  the purpose  to  detect changes on DDNS address and automatic re-establish the tunnel?

Could you be kind to explain the command line by line to me? there's alot of command I dont understand or use. (should i copy the exact command you wrote? and what is ****?)

I have attached my configuration. Can you advise whats mistake I had made?

Your help is greatly appreciated! Thank you so much in advance : )

Community Member

Re: IPSEC VPN with dynamic to dynamic IP

Rather than Crypto map, I would use Crypto Profile.  Then you establish an IPSEC tunnel.  The beauty of Profile is that you can run Routing Protocols through it and you don't have to constantly change the maps everytime you change network topology.  The "* * * * *" in the event timer is "minute hour day month weekday" so "* * * * *" is every minute update it.  In Tunnel destination, it is an IP address, not a HOSTNAME that gets stored, but when you configure it, you can put in a HOSTNAME and it will convert it at the time you are configuring it to an IP.

So if you type:

config t

interface tunnel100
tunnel destination remote.dyndns.com

exit

show run int tunnel100

It shows:

interface Tunnel100
tunnel destination 75.67.43.79

That is why the event manager goes and changes the tunnel destination every minute to what ever the DDNS says the new IP is.

I didn't see that both of your routers were running DDNS.  They will need to for this to work.

Local Router:

crypto isakmp policy 1
encr aes 256
authentication pre-share
group 2
crypto isakmp key XXXXXXX address 0.0.0.0 0.0.0.0 no-xauth
!
!
crypto ipsec transform-set ESP-AES-SHA esp-aes 256 esp-sha-hmac
!
crypto ipsec profile CRYPTOPROFILE
set transform-set ESP-AES-SHA
!
interface Tunnel100
description to remote.dyndns.org
ip address 10.254.220.10 255.255.255.252
ip virtual-reassembly
ip tcp adjust-mss 1400
tunnel source Dialer0
tunnel destination 75.67.43.79
tunnel mode ipsec ipv4
tunnel protection ipsec profile CRYPTOPROFILE

ip route 192.168.2.0 255.255.255.0 10.254.220.9

event manager applet change-tunnel-dest
event timer cron name "CHRON" cron-entry "* * * * *"
action 1.0 cli command "enable"
action 1.1 cli command "configure terminal"
action 1.2 cli command "interface tunnel100"
action 1.3 cli command "tunnel destination remote.dyndns.org"
!

--------

Remote Router:


crypto isakmp policy 1
encr aes 256
authentication pre-share
group 2
crypto isakmp key XXXXXXX address 0.0.0.0 0.0.0.0 no-xauth
!
!
crypto ipsec transform-set ESP-AES-SHA esp-aes 256 esp-sha-hmac
!
crypto ipsec profile CRYPTOPROFILE
set transform-set ESP-AES-SHA
!
interface Tunnel100
description to local.dyndns.org
ip address 10.254.220.9 255.255.255.252
ip virtual-reassembly
ip tcp adjust-mss 1400
tunnel source Dialer0
tunnel destination 93.219.58.191
tunnel mode ipsec ipv4
tunnel protection ipsec profile CRYPTOPROFILE

ip route 192.168.1.0 255.255.255.0 10.254.220.10

event manager applet change-tunnel-dest
event timer cron name "CHRON" cron-entry "* * * * *"
action 1.0 cli command "enable"
action 1.1 cli command "configure terminal"
action 1.2 cli command "interface tunnel100"
action 1.3 cli command "tunnel destination local.dyndns.org"

Thanks,

Bert

Community Member

Re: IPSEC VPN with dynamic to dynamic IP

Hi,

I trying to input these command but faced some problem. Can you advise the following:

Local Router configuration:

Interface Tunnel100
description to remote.dyndns.org
ip address 10.254.220.10 255.255.255.252          << Is this the WLAN Ip or router Ip address? My Wlan is dynamic
ip virtual-reassembly
ip tcp adjust-mss 1400
tunnel source Dialer0
tunnel destination 75.67.43.79
tunnel mode ipsec ipv4
tunnel protection ipsec profile CRYPTOPROFILE

ip route 192.168.2.0 255.255.255.0 10.254.220.9     <<<<192.168.2.0 is my remote router IP, so what is 10.254.220.9?

By ipsec profile, do I still need to match address? if yes, where should i key?

Thank you.

Community Member

Re: IPSEC VPN with dynamic to dynamic IP

No it is the IP address of the newly created Tunnel interface.  It could be anything.  If you don't understand tunnels, time to read up on them.

Community Member

Re: IPSEC VPN with dynamic to dynamic IP

Hi,

thank you so much for the advise to use VTI. I had done some reading on it and applied the method to my router.

Now the VPN can auto-restablish with the event manager command ( even after router reset).

Could you please advise me, why i cannot ping my router?

and when I look at SDM monitor -->IPsec Tunnel, it displayed there nothing. I only can see IKE SA. Why is it so?

I had attached my config for your viewing pls. Thank you

Community Member

Re: IPSEC VPN with dynamic to dynamic IP

Hi Kim Lin

Me to facing same problem i have done tunnels is up i cant ping each other will you send me your config if its working

Regards

Taher

Community Member

Re: IPSEC VPN with dynamic to dynamic IP

Hi Bert

I have follow as your config its tunnels are up but i cant ping each other will help me please

Regards

Taher

1144
Views
0
Helpful
12
Replies
CreatePlease to create content