This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Feature requests: Dynamic Gateways and Subnets

Hi,

on testing the configuration feature in the ACC, I was amazed of the ease of use to create a vpn compared at doing it by hand on two ASGs.

But until now, it's only for basic vpn-setups.

1. The remote gateway is only created static with the ip-address currently valid at the time of creation. If the HQ has static ip you can work with 'respond only', but if both sides are dynamic, I see no solution.

2. It is only possible to choose a nics main net, but no additional subnet on either side. Since 7.402 the vpn should also work with 'Any'. I haven't tried yet, but it's not possible with ACC.

I hope to see this features in future releases.

This thread was automatically locked due to age.

0 BAlfson over 15 years ago

Walter,

1. If neither person has a phone number, how can either one call the other? It seems like the only solution is at least one fixed IP or DynDNS.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 wk_03 over 15 years ago in reply to BAlfson

Right Bob,

the solution is DynDNS, but this is not possible to configure with ACC.
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 15 years ago in reply to wk_03

You mean it works only with numeric IPs instead of FQDNs? That's not good!

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 wk_03 over 15 years ago in reply to BAlfson

Yes. It generates a host in 'Definition/Network' with the ip, that is valid at the time of generation.
Cancel
Vote Up 0 Vote Down

Cancel
0 megaposer over 15 years ago in reply to wk_03

Hi,

thanks for your excellent feedback on the current state of affairs.

Regarding 1)

You can define fully-dynamic IPSec VPNs via ACC without FQHNs and/or DynDNS. ACC is able to tell the devices in a managed VPN that the tunnel interface IP of the respective peer has changed. So, if you receive a new IP address on either end, ACC will care to rectify the definitions and the VPN will come back online in no time. This of course implies, that the managed devices in the VPN both still have a working connection to the ACC.

Of course, it would be even better to configure the devices to use FQHNs, but for now the IP in the host definition will be adjusted automatically every time it changes. Please give it a try ;-)

Regarding 2)

The Any subnet functionality was not yet available when we released ACC 2.000 (synchronized with 7.400). We have already considered that we need to beef up the choice of local networks for the devices in a VPN and it is good to have it confirmed by our users, that this functionality is really needed.

Will keep you posted about any decisions.

Thanks for using ACC!

Cheers,
Henning
Cancel
Vote Up 0 Vote Down

Cancel
0 wk_03 over 15 years ago in reply to megaposer

Thanks Henning for clearing the ip issue. I will give it a try soon.

It is not only the Any-subnet that's needed. It would be great to have accces to all nets which exist in Definition/Networks.
Cancel
Vote Up 0 Vote Down

Cancel
0 kbooooa132 over 15 years ago

[font=Times New Roman][size=3]your [font=Times New Roman][size=3]ccrr [font=Times New Roman][size=3]your [font=Times New Roman][size=3]iiop [font=Times New Roman][size=3]reewq
Cancel
Vote Up 0 Vote Down

Cancel