Hello Sergio,
You are right, in order to fulfill your requirements you could either use a Dynamic-to-Static tunnel or go with the EzVPN NEM option.
Here is an EzVPN in NEM example, the headend here is a PIX 515E but it will be practically the exact same thing:
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00808a61f4.shtml
In your case both solutions work fine so I'll let you make the decision but you are going to have more arguments with the answer to your next question.
Probably you need to keep the tunnel always UP because you don’t have someone behind the 5505 to bring up the tunnel in case it goes down or simply because you want users behind the headend to be able to initiate connections without asking the branch users to start sending traffic first; well if you set the "idle-timeout" to none this will not address the issue, I mean if a rekey occurs and there is not traffic passing at that moment the only way to bring up the tunnel is by sending traffic again from the device with the dynamic IP (5505) same thing if the tunnel goes down for an unexpected reason…DPDs, etc…
If you want to keep the tunnel up you need to keep sending traffic across the tunnel...there are different ways to acomplish...
You could setup a script on a computer behind the 5505 that sends traffic all the time towards the headend but the downside of this is that you may want to turn that computer off at nights for example.
If your were using a Router instead of a 5505 you could do an IP SLA as a workaround in order to keep SA up all the time, however with the ASAs we cannot do it as we cannot specify the source of those pings but we can use the call-home feature instead…
http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCtn29607
The SCH feature is not designed for this but we could use it as a workaround on the 5505...the 5505 will generate a ping at a regular interval so this will mantain the SA up.
service call-home
call-home
no alert-group inventory
alert-group-config snapshot
add-command "ping inside 192.168.50.1" (here you will put an IP address that is behind the headend)
contact-email-addr crtac@cisco.com
mail-server 1.1.1.1 priority 1
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
profile TAVO
destination address email crvpn@cisco.com
destination transport-method email
subscribe-to-alert-group snapshot periodic interval 1
Now...with EzVPN in NEM you can configure the 5505 with auto-connect so the client will be always trying to connect even if the tunnel goes down the client will try to re-connect so this could accomplish what you want too.
For the World Cup!!Im going to start saving money so I can make it there that's the plan!! and I hope Brazil wins too! I always root for Brazil in World Cups. Actually last october Brazil came here to CR and played at our new National Stadium...the players shared with the fans and were VERY humble DINHO specially....but two months ago Argentina came down to play at the Stadium inaguration....the Star Players didn't even play...Messi didn't even say Hello to the fans...no interviews no nothing! I went to the stadium and what a waste of money I also rooted for Argentina in WorldCups but since that day I said I won't anymore hehe
Regards,
