VPN Advice...do I need a purchased static ip address on the external interface?

You can away without a fixed address if you use a vpn router that supports dynamic dns, then users connect to the dynamic dns name and should the IP address change the router updates the dynamic dns server of this fact. If you go down the windows route can can use a single nic in the server, keep it on the lan and direct the inbound vpn connections to it using port mapping on the router. simon

Simon is correct. However, if your router does not do this you can still use a dynamic domain name by installing a DDNS client. Suggest that you have a look at the following:

Note: the last recommends software clients, and I agree. But I've been updating my multiple DynDNS domains with hardware for quite some time (BEFVP41's) and seldom have a problem. The disadvantage (for me) in using hardware clients is that I typically don't know that the DDNS has gone down or not been updated until I check the VPN links and find that they've been disconnected (like this morning :-). I would have noticed the problem immediately had I been running the software client instead. That said, I can probably count on 1 hand the times that the VPN's have disconnected due to failure of the router to update the DDNS over the past 12 months. I've tried both, and settled on hardware because: 1) I use an old computer with limited CPU & memory resources, and 2) I'm lazy... I tend to prefer the set & forget unless it becomes an operational or security problem.

Added note: The only other problem that I've had using hardware is that sometimes the dynamic IP that one of the servers sits on doesn't change for 28 days or more, so I then have to go and force a lease update. However, DynDNS are kind enough to send me a 5 day notice alerting me of this each time that it happens.

Cheers for that, one I put in recently was on cable, and that around here if you don't turn off the modem can give you a 6 month lease. simon

Let me give a generic answer. The ends of a vpn need to be able to find each other. One way to do this is to use static IPs, another is to use dynamic DNS. If you use dynamic DNS you need to (a) keep it updated and (b) have the client and/or server vpn software know how to use it.

If you control your firewall you can add some port knocking and improve your security. Note that these measures make it harder to connect from behind a firewall, such as a laptop being used on customer premises. I'll stop, this is really not directly related to vpn, it can be used to pre-validate any access.