It will work eventually but if the IP changes then it will have a problem on the tunnel established

you can establish a tunnel between your 2 sangfor NGFW sites even if you are using dynamic public IP addresses. Both Sangfor VPN and IPSec offers solutions like the below:

1. Sangfor VPN
   - WebAgent Service
   - DDNS
2. IPSec
   - NAT Traversal Techniques
   - Port Forwarding

Hi, certainly you can configure both vpn modes. Remember that you can use ipsec as fallback only if you have mpls. You can't use ipsec as fallback to Sangfor VPN.

Yes, it is possible to establish a tunnel between your two Sangfor NGFW sites even though they use dynamic public IP addresses. Both Sangfor VPN and IPSec can work with dynamic IPs, but with specific approaches:

1. Sangfor VPN:

    DDNS (Dynamic DNS): Utilize a Dynamic DNS service like No-IP or Dyn to automatically update a hostname with your current public IP address. Configure both Sangfor NGFWs to connect to the hostname instead of a static IP.
    WebAgent: Enable Sangfor WebAgent on both devices. It periodically communicates with a centralized server, updating its location information. Each NGFW can locate the other through the WebAgent server.

2. IPSec:

    NAT Traversal Techniques: Both NGFWs should employ NAT traversal techniques like NAT-T (encapsulation within UDP) or UDP Encapsulation to pass through Network Address Translation (NAT) devices.
    STUN (Session Traversal Utilities for NAT): Utilize STUN servers to help each NGFW discover its public IP address and establish the connection.

Considerations:

    Dynamic IP Updates: Ensure your chosen method promptly reflects dynamic IP changes. Delays can disrupt the tunnel.
    Security: Carefully configure security settings within the chosen method to maintain secure communication.
    Sangfor Documentation: Refer to Sangfor's official documentation for detailed configuration instructions specific to your model and version.

Yes, but if you don't have an static public ip address you should use somekinf of Dynamic DNS service so you can keep the same name as your ip can change.

Yes, you can create a tunnel between two sites by IPSec or by Sangfor VPN

if the ip is dynamics another time it will change to another ip, i recommend to just use static IP for configuration like this.

Both Sangfor VPN and IPSec VPN can be utilized to establish a tunnel between two Sangfor NGFW sites with dynamic public IP addresses. However, the specific feasibility and configuration process may vary depending on the capabilities and configurations supported by the Sangfor NGFW devices and the requirements of the network. It's recommended to consult the documentation provided by Sangfor or seek assistance from their technical support to ensure proper implementation and compatibility with dynamic IP addresses.

Yes follow these configuration
a.Sangfor VPN Configuration
http://community.sangfor.com/plu ... tabase&tid=1004

b.NGAF IPSec VPN with CISCO Configuration Guide
http://community.sangfor.com/plu ... tabase&tid=2211

Hi FahmiAzlanMY,

Yes, it is possible to establish a tunnel using either a Sangfor VPN or IPSec.
Should you encounter any configuration, please feel free to reach out to us at tech.support@sangfor.com, and our support team will be more than happy to assist you.