Routing between dial-up IPsec tunnels

[londonnet]

I have a central site (A) with a static IP and many other sites (B, C and D) that create dialup IPsec tunnels back to site (A)

Subnets at site (A) can reach subnets at sites (B, C and D) and sites (B, C and D) can reach subnets at site (A)

But I have not seen a config or a topic which would allow sites (B, C and D) to learn they can reach each other via site (A)

Static routes and policies would be a good start. Does anyone have a recipe to allow traffic to to route from Site (B) to Site (C) via Site (A)?

In an ideal world it would be great to have a vpn direct  between site (B) and Site (C) but as both are on dynamic addresses this would introduce the use of a dynamic DNS service which I would like to avoid

It would be a great feature if site (A) would be able to act as a dynamic DNS

[Toshi_Esumi]

Of course, you need to have tunnel-B int <-> tunnel-C int policy set in addition to tunnel-B int <-> LAN, tunnel-C int <-> LAN at Site A.
That's the condition No.2 I listed at Site A.

You could make a zone including both tunnels then "set intrazone allow" to allow between tunnel traffic though. Then you don't need to set the policies specifically. But you have to reconstruct all policies NOT to use individual tunnel interfaces in the policies.

Toshi