Site-to-Site VPNs

Question

I'm having some problems with our networks and I'm wondering if anyone has some ideas.

We have recently moved to a cloud server (we went with UKFast) to host our network - it's main use is for the staff to remote in to the server to use select older software. We also want to use the server to control a domain of users across all of our 8 sites (stores). We have been mildly successful in this - we have managed to set up VPN's on all the sites and attach to our domain. Some have stayed but some drop out because the public ip (wan ip) changes. This of course changes the settings for the VPN. If we change the settings on the server side again it works fine, but again only for a while.

I am wondering if anyone would know what the best solution would be - I have briefly read around stuff like DynDns but I am unsure what would work best.

Answer 1

It is often possible to setup VPNs with dynamic IPs, so long as the central hub has a fixed IP. This usually involves setting things up so that the VPN Concentrator uses some other criteria in the ISAKMP config to differentiate between incoming VPN establishment requests, like an FQDN for example. This does not require the use of DynDNS.

I personally prefer this approach as it does not introduce an outside dependency on a third-party service like DynDNS. See one example for a Cisco approach here : http://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/46242-lan-to-lan-vpn-client.html

But many other brands also support similar configs.