2

I want to establish a VPN tunnel with AWS using IPSec (Vyatta).

There is something that I was not able to figure out: How do I make it work without having to configure a static IP for the customer gateway?

I want the client to establish the connection because the public IP of the client could change due to using ADSL/VDSL access.

When I try to configure the VPN, I get the following warning regarding the fact that the local address was not configured:

Warning: Local address MY_PUBLIC_IP specified for peer "AWS_PUBLIC_IP" is not configured on any of the ipsec-interfaces and is not the clustering address. IPsec must be re-started after address has been configured.

1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 15 '17 at 4:53
1

If the client's gatewayd evice has the option for DDNS, you can assign a DDNS domain name to it. That way, you don't have to worry about IP changing because the domain name is constant.

0

It sounds like you're using a Gateway-to-Gateway tunnel. Having dabbled with IPSec somewhat lately, I too have come across this same problem. Unfortunately I was not able to overcome this problem without using STATIC IPs on both ends of the tunnel.

I found that I could get it to work behind a NAT as long I forwarded UDP 500 and UDP 4500 through the NAT to the internal IP. But as soon as your public IP changes then the tunnel will drop and you'll need to reconfigure everything.

In my particular case, the devices did not seem to support using DNS to resolve to an IP. Both ends supported IP addresses only.

0

If you can't get the Static IP at your end then why don't you try for the IPSEC+NAT-T? If the AWS also support NAT-T then that would be the best solution to establish the tunnel.

As Dave pointed out,You may have to think about the issue when WAN IP is changed at your gateway.From my experience with IPSEC,We used StrongSwan IPsec with NAT-T and it worked flawlessly.

I would also suggest you to load an Open WRT based distribution in your gateway to have more flexibility with IPSec

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.