Short answers: yes, no, yes.
(dynamic on both ends is fine. versions are compatible, you missed something. I've lost a LOT of hair setting up these things, it's easy to miss something!!)
I have a few (10?) of the RV042's set up at various locations, most without static IP's. [delete]I'm really surprised at the stability of these devices.[/delete] VPN's are a bit tricky-- so much so that I made a script that sets up the tunnels for me. If you miss just ONE setting it can make the tunnel not work, and you can stare at it for days and not see the tiny missing character or box that wasn't checked right.
The trick for dynamic-to-dynamic:
First set up dynamic dns and make sure it works. I'm using DynDNS. (go to Setup - DDNS in firmware 1.3.x, Setup - Dynamic DNS in 4.x)
Here are the important parts:
Click VPN.
Click Gateway to Gateway.
Give the tunnel any name- don't use spaces (earlier versions would fail with a space, I don't know if 4 does or not)
Make sure the interface is a working WAN interface.
In Remote gateway Security Type select Dynamic IP+Domain Name (FQDN) Authentication, the page will refresh.
Enter the DNS name you configured for this end into Domain Name
The IP Address and Subnet Mask are automatically filled in from your running configuration. Don't change them
Under Remote Group Setup, select "IP Only" (it should be selected already based on your dynamic selection above) and then the next drop down from "IP Address" to "IP by DNS Resolved"
Enter the remote dynamic dns name in the box to the right of "IP by DNS Resolved"
Now for the settings. I don't know if all of the options available actually work, but I do know that you'd better have them exactly the same at both ends. These are the settings I've found to work:
Keying Mode [IKE with Preshared key]
Phase1 DH Group [Group1]
Phase1 Encryption [DES]
Phase1 Authentication [MD5]
Phase1 SA Life Time [28800]
Prefect Forward Secrecy [ ] -- I can't get PFS to work between two rv042's
Phase1 Encryption [Phase3DES]
Phase1 Authentication [MD5]
Phase2 SA Life Time [3600] seconds
Preshared Key: [yourSecretKeyGoesHere]
Advanced:
[X] Aggressive Mode
[ ] Compress
[X] Keep-Alive
[ ] AH Hash Algorithm [any]
[ ] NetBIOS broadcast
[ ] NAT Traversal
[X] Dead Peer Detection (DPD) Interval [10] seconds
As soon as you try to send a packet between locations the tunnels should build. Good luck!
Jeremy
THE SCRIPT
You'll probably have to modify this to suit your needs. It expects 192.168.x.x subnets, and you'll need to be on windows, with IE working, and cscript operating normally. Script assumes < 4.x firmware-- not tested on 4.x at all.
' I never bothered to make this script take parameters. Just edit the values below.
' before this will work, you need to set up DDNS on both routers (and test it) and
' you need to enable remote administration via port SSL on port 8080. Turn that
' back off if you aren't going to need it (and you shouldn't, because after the
' tunnel is set up you can access the administration interface using the LAN IP.
End_A_DNS = "one-end-of-tunnel.selfip.com"
End_A_Subnet = "16" ' this is the third octet- 192.168.X.0
End_B_DNS = "the-other-end-of-tunnel.selfip.com"
End_B_Subnet = "24"
Secret = "putyoursecretkeyhere"
' where_am_i is the subnet you're sitting at. You usually can't access the
' WAN ip address of the router you're behind, so the script just uses this
' in case you are creating a tunnel to the network you're on. This script
' will create tunnels between two rv042's out there on the internet if both
' of them are properly set up with DDNS and remote access via port 8080.
Where_am_i = "24"
if end_a_subnet = where_am_i then
router_address = "http://192.168." & where_am_i & ".1" ' ASSUMES .1 IS THE ROUTER.
else
router_address = "https://" & End_a_dns & ":8080"
end if
' set up the first half of the tunnel
SetTunnelEnd router_address, end_a_dns, end_b_dns, end_a_subnet, end_b_subnet, secret
if end_b_subnet = where_am_i then
router_address = "http://192.168." & where_am_i & ".1" ' ASSUMES .1 IS THE ROUTER.
else
router_address = "https://" & End_b_dns & ":8080"
end if
' set up the second half of the tunnel
SetTunnelEnd router_address, end_b_dns, end_a_dns, end_b_subnet, end_a_subnet, secret
sub SetTunnelEnd(routerhttps, a_dns, b_dns, a_net, b_net, secret)
Set IE = CreateObject("InternetExplorer.Application")
IE.navigate routerhttps & "/gateway_to_gateway.htm"
IE.Visible = True
Do Until IE.readyState = 4
Loop
tunnelName = a_net & "-" & left(a_dns,6) & " to " & b_net & "-" & left(b_dns,6)
IE.document.forms("formgtg").tunnelName.value = tunnelName
IE.document.forms("formgtg").typeLSW(1).value = 4
IE.Navigate("javascript:falseSubmit(document.formgtg,'11');")
Do Until IE.readyState = 4
Loop
IE.document.forms("formgtg").L_textFQDN(1).value= a_dns
IE.document.forms("formgtg").typeRSW(1).value = 2
IE.Navigate("javascript:falseSubmit(document.formgtg,'12');")
Do Until IE.readyState = 4
Loop
IE.document.forms("formgtg").radioDnsResolve(1).value = 1
IE.Navigate("javascript:showDnsResolve();")
IE.document.forms("formgtg").ipRSW1(1).value= b_dns
wscript.sleep(500)
IE.Navigate("javascript:IPDNSCheck(document.formgtg.ipRSW1[1]);")
wscript.sleep(1000)
IE.document.forms("formgtg").textFQDN(1).value = b_dns
IE.document.forms("formgtg").ipRSG1(1).value="192"
IE.document.forms("formgtg").ipRSG2(1).value="168"
IE.document.forms("formgtg").ipRSG3(1).value=b_net
IE.document.forms("formgtg").ipRSG4(1).value="0"
IE.document.forms("formgtg").PFSp(1).checked = 0
IE.Navigate("javascript:falseSubmit(document.formgtg,'13');")
Do Until IE.readyState = 4
Loop
IE.document.forms("formgtg").select5(1).value = 2
IE.document.forms("formgtg").keyPreshared2(1).value = secret
IE.Navigate("javascript:opAdvanced(document.formgtg.advancedStatus,document.formgtg);")
Do Until IE.readyState = 4
Loop
IE.document.forms("formgtg").aggressiveMode.checked = 1
IE.document.forms("formgtg").keepAlive.checked = 1
IE.document.forms("formgtg").biosBC.checked = 0
IE.document.forms("formgtg").DPD.checked = 1
IE.document.forms("formgtg").DPDInterval.value = 10
wscript.sleep(500)
IE.document.forms("formgtg").submit()
wscript.sleep(500)
Do Until IE.readyState = 4
Loop
IE.quit
set IE = nothing
wscript.echo "tunnel created from " & tunnelName
end sub
Footnote, 8-10-2012: "I'm really surprised at the stability of these devices."
As I said, I had 10 of these in operation. After about 4 years, some will start to have "issues". So much so that I am not deploying them any longer. I need devices that last, reliably, for more than 4 years. 3 of the ten are absolutely unusable, and I expect the other 7 to start failing in time.