fortigate-ipsec-40-mr3

Dynamic DNS configuration Dynamic DNS topology
The default configuration is to accept all local IDs (peer IDs). If you have the Local ID set,
the remote end of the tunnel must be configured to accept your Local ID.
To accept a specific Peer ID
1 Go to VPN > IPsec > Auto Key (IKE).
2 Select Create New Phase 1.
3 Select Aggressive mode.
4 For Peer Options, select Accept this peer ID. This option becomes visible only when
Aggressive mode is selected.
5 Enter the string the other end of the tunnel used for its Local ID.
6 Configure the rest of the Phase 1 entry as required.
7 Select OK.
Route-based or policy-based VPN
Dynamic DNS topology
VPN over dynamic DNS can be configured with either route-based or policy-based VPN
settings. Both are valid, but have differences in configuration. Choose the best method
based on your requirements. For more information on route-based and policy-based, see
“Types of VPNs” on page 21.
Route-based VPN configuration requires two security policies to be configured (one for
each direction of traffic) to permit traffic over the VPN virtual interface, and you must also
add a static route entry for that VPN interface or the VPN traffic will not reach its
destination. See “Creating branch_2 route-based security policies” on page 107 and
“Creating branch_1 route-based security policies” on page 112.
Policy-based VPN configuration uses more complex and often more IPsec security
policies, but does not require a static route entry. It has the benefit of being able to
configure multiple policies for handling multiple protocols in different ways, such as more
scanning of less secure protocols or guaranteeing a minimum bandwidth for protocols
such as VoIP. See “Creating branch_2 policy-based security policies” on page 109 and
“Creating branch_1 policy-based security policies” on page 113
In this scenario, two branch offices each have a FortiGate unit and are connected in a
gateway-to-gateway VPN configuration. One FortiGate unit has a domain name
(example.com) with a dynamic IP address. See branch_2 in Figure 13.
Whenever the branch_2 unit connects to the Internet (and possibly also at predefined
intervals set by the ISP), the ISP may assign a different IP address to the FortiGate unit.
The unit has its domain name registered with a dynamic DNS service. The branch_2 unit
checks in with the DDNS server on a regular basis, and that server provides the DNS
information for the domain name, updating the IP address from time to time. Remote
peers have to locate the branch_2 FortiGate unit through a DNS lookup each time to
ensure the address they get is current and correct.
FortiOS Handbook v3: IPsec VPNs
01-434-112804-20120111 103
http://docs.fortinet.com/