FortiGate IPSec VPN User Guide - FirewallShop.com

Dynamic DNS configurations
Configuration overview
Dynamic DNS configurations
This section describes how to configure a site-to-site VPN, in which one FortiGate
unit has a static IP address and the other FortiGate unit has a static domain name
and a dynamic IP address.
The following topics are included in this section:
• Configuration overview
• General configuration steps
• Configure the dynamically-addressed VPN peer
• Configure the fixed-address VPN peer
Configuration overview
In this type of scenario, one of the FortiGate units in a gateway-to-gateway
configuration has a static domain name (for example, example.com) and a
dynamic IP address. See FortiGate_2 in Figure 9. Whenever that FortiGate unit
connects to the Internet (and possibly also at predefined intervals set by the ISP),
the ISP may assign a different IP address to the FortiGate unit. Therefore, remote
peers have to locate the FortiGate unit through DNS lookup.
Figure 9:
Example dynamic DNS configuration
Site_1
Site_2
FortiGate_1
FortiGate_2
Internet
172.16.20.1
example.com
DNS Server
Dynamic DNS
server
When a remote peer (such as FortiGate_1 in Figure 9) initiates a connection to
the domain name, a DNS server looks up and returns the IP address that matches
the domain name. The remote peer uses the retrieved IP address to establish a
connection with the FortiGate unit.
To ensure that DNS servers are able to discover the current IP address
associated with a FortiGate domain name, the FortiGate unit with the domain
name subscribes to a dynamic DNS service. A dynamic DNS service ensures that
any changes to IP addresses are propagated to all Internet DNS servers.
FortiGate IPSec VPN Version 3.0 User Guide
01-30005-0065-20070716 49