ipsec with dynamic ip addresses

[s m]

hello guys

i wanna have ipsec with dynamic ip address. i searched a lot and just
little unclear answers found. one post mentions to use
"dhclient-exit-hooks" script to update ipsec configuration file when an ip
address is assigned. another old post says to use certificate.  are these
solution correct and useable???
can't ipsec-tool manage it yourself (by some command in config files)???

linux has a "hacking_vpn_tools" in net-firewall. it has a variable
"set_racoon_ip" to handle dynamic ip addresses. is there such thing in
freebsd or not?

thanks in advance
SAM