fortigate-ipsec-40-mr3

FortiOS Handbook
Dynamic DNS configuration
This section describes how to configure a site-to-site VPN, in which one FortiGate unit
has a static IP address and the other FortiGate unit has a domain name and a dynamic IP
address.
The following topics are included in this section:
Dynamic DNS over VPN concepts
Dynamic DNS topology
General configuration steps
Configure the dynamically-addressed VPN peer
Configure the fixed-address VPN peer
Testing
Dynamic DNS over VPN concepts
Dynamic DNS (DDNS)
A typical computer has a static IP address and one or more DNS servers to resolve fully
qualified domain names (FQDN) into IP addresses. A domain name assigned to this
computer is resolved by any DNS server having an entry for the domain name and its
static IP address. The IP address never changes or changes only rarely so the DNS
server can reliably say it has the correct address for that domain all the time.
It is different when a computer has a dynamic IP address, such as an IP address
assigned dynamically by a DHCP server, and a domain name. Computers that want to
contact this computer do not know what its current IP address is. To solve this problem
there are dynamic DNS servers. These are public servers that store a DNS entry for your
computer that includes its current IP address and associated domain name. These
entries are kept up to date by your computer sending its current IP address to the
dynamic DNS (DDNS) server to ensure its entry is always up to date. When other
computers want to contact your domain, their DNS gets your IP address from your DDNS
server. To use DDNS servers, you must subscribe to them and usually pay for their
services.
When configuring DDNS on your FortiGate unit, go to System > Network > DNS and
enable Use DDNS. Then select the interface with the dynamic connection, which DDNS
server you have an account with, your domain name, and account information. If your
DDNS server is not on the list, there is a generic option where you can provide your
DDNS server information.
Routing
When an interface has some form of changing IP address (DDNS, PPPoE, or DHCP
assigned address), routing needs special attention. The standard static route cannot
handle the changing IP address. The solution is to use the dynamic-gateway command in
the CLI. Say for example you already have four static routes, and you have a PPPoE
connection over the wan2 interface and you want to use that as your default route.
FortiOS Handbook v3: IPsec VPNs
01-434-112804-20120111 101
http://docs.fortinet.com/