At the moment we have a situation whereby one of our home workers (contractor) has a Draytek Vigor 2800VG as supplied by us. This is used to connect his home to our office firewall by means of a VPN. His side of the VPN had originally been set with a static IP address and was working correctly. Due to an upgrade of his broadband service, that has now been changed to a dynamic IP address. My question is what changes do I need to make to the Draytek in order to get the VPN working once more? Also will any VPN configuration changes be required at the corporate firewall end?

TIA.

I don't think you need to make any changes at his end - it does not matter what the IP address is. He make an Internet Connection and then makes a VPN connection that sits on the top.

However, I assume that this is causing an issue at the corporate end? As in, now he had a dynamic IP address how do you know its him knocking on your door as it changes each time you log on.

Is that correct or am I missing the point?

No you are correct. We previously operated a full site-to-site VPN. Now with the change to Dynamic IP at his side, I need to find a way of trying to get him to establish a VPN through our corporate firewall.

Primarily the VPN was/is used to allow an IP phone to be part of our internal PABX. I'll lock down which ports are not needed at the corporate end, but first I still need to establish a connection for the VPN.

TIA.

Is there no chance of assigning a static IP address for this clients connection?

It does add a very explicit control to access and most ISP's will do this.

Unfortunately dynamic is the only option. The person in question upgraded his broadband and part of that was changing from static to dynamic. He feels he can't justify the increase cost of a static, particularly when he can subscribe to one of the free DNS services available.

Static would have solved all the issues (as this is what he had originally when I setup the VPN to the corporate firewall).

OK, I still think I am getting slightly confused here. Please forgive me.

Why do you feel you need to change something on the Draytek on the Contractor's site to get VPN working?

In my mind, you just need a VPN Client (you have a few built into Windows) on a PC that just uses the contractors Draytek (Broadband connection) to reach your firewall. This is exactly what I am doing now on a dynamic IP address given to me by '3 Internet'. My VPN server the other side is listening for connections and authenticates me with a VPN username and password to be allowed onto the Network. The only issue is that you cannot bolt the VPN down as much.

What am I missing?