Scott's suggestion is definitely the preferred method. An alternative is to configure the site with a fixed IP to be "Respond only" so that it doesn't need to know the IP on the dynamic site beforehand. I wouldn't do this with a PSK - better to use certificates or at least RSA keys.
Cheers - Bob
Sophos UTM Community Moderator Sophos Certified Architect - UTM Sophos Certified Engineer - XG Gold Solution Partner since 2005