[FAQ] 'Dial a dynamic tunnel has failed for Crypto map.'

Attempting to establish a VPN connection yields the following error message:

This message means there is no Secure Gateway to dial to.  In order for the appliance to dial a VPN tunnel it needs a destination, whether Public IP address or DDNS hostname.  The rule in question in this example is VPN rule #2 below.

If the Secure Gateway field is left empty (0.0.0.0), there is no destination to connect to.  In this type of configuration the VPN rule can only listen for VPN traffic coming from remote host to establish VPN, it cannot dial a connection.  This field is, in most cases, left alone/empty when the remote site has a dynamic IP address.

To establish the VPN connection a Secure Gateway entry must be specified.  If the remote location has a dynamic IP, use DDNS hostname.

If the remote site has a destination address specified on the VPN rule, use the remote site to establish the VPN connection.