Hi,

on testing the configuration feature in the ACC, I was amazed of the ease of use to create a vpn compared at doing it by hand on two ASGs.

But until now, it's only for basic vpn-setups.

1. The remote gateway is only created static with the ip-address currently valid at the time of creation. If the HQ has static ip you can work with 'respond only', but if both sides are dynamic, I see no solution.

2. It is only possible to choose a nics main net, but no additional subnet on either side. Since 7.402 the vpn should also work with 'Any'. I haven't tried yet, but it's not possible with ACC.

I hope to see this features in future releases.

__________________
cu
Walter

Walter,

1. If neither person has a phone number, how can either one call the other? It seems like the only solution is at least one fixed IP or DynDNS.

Cheers - Bob

__________________
ACE V7 - Astaro Preferred Partner since V3
Addicted to my iPhone!

Right Bob,

the solution is DynDNS, but this is not possible to configure with ACC.

__________________
cu
Walter

You mean it works only with numeric IPs instead of FQDNs? That's not good!

__________________
ACE V7 - Astaro Preferred Partner since V3
Addicted to my iPhone!

Yes. It generates a host in 'Definition/Network' with the ip, that is valid at the time of generation.

__________________
cu
Walter

Hi,

thanks for your excellent feedback on the current state of affairs.

Regarding 1)

You can define fully-dynamic IPSec VPNs via ACC without FQHNs and/or DynDNS. ACC is able to tell the devices in a managed VPN that the tunnel interface IP of the respective peer has changed. So, if you receive a new IP address on either end, ACC will care to rectify the definitions and the VPN will come back online in no time. This of course implies, that the managed devices in the VPN both still have a working connection to the ACC.

Of course, it would be even better to configure the devices to use FQHNs, but for now the IP in the host definition will be adjusted automatically every time it changes. Please give it a try ;-)

Regarding 2)

The Any subnet functionality was not yet available when we released ACC 2.000 (synchronized with 7.400). We have already considered that we need to beef up the choice of local networks for the devices in a VPN and it is good to have it confirmed by our users, that this functionality is really needed.

Will keep you posted about any decisions.

Thanks for using ACC!

Cheers,
Henning

Thanks Henning for clearing the ip issue. I will give it a try soon.

It is not only the Any-subnet that's needed. It would be great to have accces to all nets which exist in Definition/Networks.

__________________
cu
Walter