> Source: [sk38943](https://support.checkpoint.com/results/sk/sk38943)

# sk38943 - Issues to consider when using Dynamically Assigned IP (DAIP) Gateways

| Property | Value |
|----------|-------|
| Solution ID | sk38943 |
| Date Created | 2009-04-14 |
| Last Modified | 2015-08-10 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Solution

**Overview**

Link Selection may be used in different infrastructures. When using Dynamically Assigned IP (DAIP) Gateways there are some issues to consider.

A Dynamically Assigned IP (DAIP) gateway is a gateway where the external interface's IP address is assigned dynamically by the ISP.

* Creating VPN tunnels with DAIP gateways are only supported by using certificate authentication.
* Peer gateways identify internally managed DAIP gateways using the DN of the certificate.
* Peer gateways identify externally managed DAIP gateways and 3rd party DAIP gateways using the Matching Criteria configuration

DAIP gateways may initiate a VPN tunnel with non-DAIP gateways. However, since a DAIP gateway�s external IP address is always changing, peer gateways cannot know in advance which IP address to use to connect to the DAIP gateway.

If the IP on the DAIP gateway changes during a session, it will renegotiate IKE using the newly assigned IP address. Without DNS resolving configured on the peer gateway, a DAIP gateway can only initiate the first connection between two peers. The second connection can be initiated by the peer gateway as long as the IP address of the DAIP gateway has not changed. As a result, a peer gateway cannot initiate a VPN tunnel with a DAIP gateway unless DNS Resolving is configured on both the DAIP gateway and peer gateway.

A VPN tunnel negotiation with a DAIP gateway can only be initiated using DNS resolving since the IP address of the DAIP gateway cannot be known in advance.

The peer gateway can then resolve the DAIP gateways IP address by using its hostname. The hostname can be entered on the Link Selection page or can be derived from the global properties page.

**To resolve addresses using DNS lookup**

If remote VPN peers should resolve the local gateway�s IP address through DNS lookup, then do the following:

On the VPN \> Link Selection page of the gateway object, select Use DNS resolving:

The fully qualified domain name (FQDN) queried can be set on this page or derived from the Global Properties.

* Full hostname - Enter the FQDN of the gateway, e.g. *www.checkpoint.com*.

  Note: This does not mean the DNS server that should be queried - *www* is the host, *checkpoint* is the second-level domain, and *.com* is the top-level domain.

* Derived from Global Properties - By selecting this method, the host name is derived from the General Properties page in the gateway and the domain name is derived from the Global Properties \> VPN page. In the Global Properties \> VPN page, enter the domain name that will be used for gateways DNS lookup. The DNS host name that is used is "gateway_name.domain_name".

  The gateway name is taken from the object's General Properties page and the domain name is taken from here, the Global Properties - VPN Advanced page. For example, if the object name is "john" and the domain name is "smith.com" then the FQDN (Fully Qualified Domain Name) will be "john.smith.com".

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content