Tunnel endpoint discovery
Tom Lancaster
Occasionally, you may experience a scenario where two networks need to be able to communicate securely with one another, but the path between them is somewhat volatile. For example, one or more of your routers may be acquiring a dynamic address, perhaps via DHCP, but it is always advertising the same networks.
The problem configuring a typical IPSec VPN in this situation is that you don't know what peer IP addresses to use, because they keep changing. Several vendors have solutions known as "dynamic IPSec" which allow one router with a variable IP address to initiate an IPSec tunnel with a hub router. This works great as long as the hub router's address doesn't change.
However, if both routers have addresses that change, consider using a novel solution by Cisco called Tunnel Endpoint Discovery (TED). Basically, the only static configuration on the router is the pre-shared key and an access-list that tells the router what traffic should be encrypted.
It works like this: When the router needs to send encrypted traffic from one network to another, it will send a packet from itself to the remote network, unencrypted. As it passes a router configured for Tunnel Endpoint Discovery, that router will drop the packet, and respond to the other router with a TED probe packet, which contains its own IP address. The first router will then reply to the TED probe. Now that both routers know each other's IP addresses, they can use IKE to swap keys and setup encryption.
Like many dynamic solutions, TED takes a little longer to setup, but has a simpler configuration.
Thomas Alexander Lancaster IV is a consultant and author with over ten years experience in the networking industry, focused on Internet infrastructure.
