Windows Forum

Ask something
Discussion Locked

VPN Server – PCD BDC or dedicated

0 helpful
18 replies

by maxwell edison 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I’m starting the process of setting up a VPN into our office. I want to provide remote access to certain (but not all) employees regardless of where they are - home or on the road - simply by using the existing Internet backbone as the gatewayinto the office. We have a broadband connection at the office end, and some employees have DSL, satellite or broadband at their end, but some still have only 56k dial-up. I have an initial question that I haven’t seen addressed in the documentation I’ve read thus far. Perhaps picking the brains of my distinguished peers will help me decide the best direction to pursue.

I realize that a VPN server with RRAS installed is required at my office, but what are the pros and cons of using my existing PCD (which is also the primary office file server) or BDC (which is also the backup file server) as that VPN server versus using a dedicated machine? I’d like to use my existing PDC or BDC to avoid the need of buying more server software, but if there are compelling arguments against it, then that’s what I’d do. (By the way, Windows 2000 Server is the flavor of OS.) Also, if it makes any difference, I do not currently have a Web site, but would possibly like to integrate one into the process. If I do, should I host it myself, or could/should I let my ISP host it? (Or is that a different issue entirely?)

This initial question/discussion may lead to further questions, but for now I’ll just leave it asstated. If there are any differing opinions to my stated plans and assumptions, feel free to share. If you have anything to add that is outside the scope of the initial question (but concerning VPN), please do so. What are some other questions I should ask or other issues I should consider?

(continued...)

18 replies

by maxwell edison

For those who have seen my questions in the past, they tend to become more of a discussion that may go off into different tangents, and that’s what I hope happens here. So, if you feel so inclined, return to this question from time to time to review the additional comments that are sure to appear, and continue to comment as you deem appropriate.

Thanks a bunch,

Maxwell

by cg it

Maxwell! Finally someone asks a question of some worth and merit!

How many clients are going to access the network via dialup or VPN? How many clients [in house] are there on that network? Is traffic low or high? Will Remote Access occur during peak or off peak hours? Will those RAS clients have a relatively long session time?

I think that if the # of clients who will access the network via RAS is small, you could safely run the RAS from your PDC [also add the PDC in RAS on your BDC] without much performance degradation [noticeable performance hits].

Hosting vs. 3rd party hosting is more of cost factor than anything else. TCO is the buzzword of the year and well, if ya want the freedom of messing around with the site, access policies, etc go your own. If it's just an all purpose site that is infrequently updated [and you don't want to mess with it] go with a hosting service.

by cg it

by the way, I'm not a Tech net point participant so points don't matter to me.

by cg it

I came back to this question a few hours later to see what everyone else suggested. Synergy and Joseph Moore have exceptional comments taking in consideration security,[most important issue now adays] user load, etc. I can not add anything else as their answers pretty much cover all the bases.

I run SBS Server with AD and a BDC running standard W2K server. With SBS, we run Exchange server, ISA, and one relatively simple Web site [read only information], We service about 30 clients all from one one box [sans the BDC which is a second box] and have only 3 remote uses using terminal services application mode[very minimal traffic and logon time]. It works well with little external attempts at meddling [we have a router in between the internet and the ISA server. The ISA server is between the LAN and the router]. We have two computers OFF the primary network that use the router to directly connect to the internet [quirk of the owners]. Those that use Terminal Services are home workers and download files on projects they colaborate on or to get their mail. Even the owners don't use this feature though its available to them.

Very minimal problems on this setup. Runs smoothly and I have a hard time justifing my salary sometimes. [Exchange seems to be the biggest headache in maintenance].

by cg it

Dial up Terminal Services is more costly than VPN [home users are outside the area code] so instead of reimbursing for long distance phone calls we use VPN [home users have DSL or Cable connections with their respective ISP's] and we reimburse theirDSL/cable costs on a flat rate of $15.00 each per month per user. Seemed fair to the owners as their logon time to the network was about 45 minutes per day every workday[5 days a week and their average DSL/Cable bill was $50.00. so they figured about 33% or so was not bad considering the 45 minutes of peak hour long distance phone calls for dial up was reaching about a 4 digit # every month.]

by cg it

ooops damnit I forgot to add in Marty's answer to Synergy and Joe's as having pretty much answered everything. Sorry Marty!

by maxwell edison

The answer to my question is, use a dedicated VPN server.

Thanks to all who helped with their comments and suggestions. Normally I'd leave a question like this open for a while to discuss some of the other issues you’ve raised (and answer the questions you've asked). But instead, I'll just extend my thanks for your time and for sharing your knowledge in the most gracious way.

For now I just need to focus on getting this thing done. I’ll use a dedicated Windows 2000 Server, separate from my PDC and BDC, and I’ll require all my remote users to have Windows 2000 Professional with some sort of high speed Internet account (broadband, satellite, etc.). And I’ll certainly make no performance guarantees if dial-up isneeded from an “out-of-town” hotel or something similar. And actually, even though I initially stated that I have a Windows 2000 PDC and BDC, those are still on the shelf, not yet on-line, and I first need to replace my NT 4.0 servers with those before I start on this remote access challenge.

I want to get this all done in 2-4 weeks, which will be a real challenge considering all the other things that will undoubtedly occupy my time. In addition, I have a lot of other unanswered questions in many areas of this transition. Which leads me to an offer I’d like to extend to the four of you.

I’m willing to offer bonus points (10,000 to 20,000) to any or all of you who are willing to communicate with me, either by email or phone (I’d pay the phone charges), to help me get over some of the humps I’m almost certainly going to run into. (I know points are worthless, except, of course, the value they carry by getting a question a lot of attention and to the top of the list, which does indeed have some value.)

If any of you are interested, email me – maxwell_t_edison@yahoo.com – and I’ll reply with a more det

by marty2001

PDC/BDC pros - No more hardware means less hardware to secure.
PDC/BDC cons - Depends on type of remote desktop required
Website: I would get it hosted as it is cheaper to maintain security wise. Just make sure that you have a copy of the site incase the host gos bust.
Questions: 1.What are you going to use as the remote desktop - Terminal server/PC anywhere/vnc/Citrix or just map drives with no visible access?
2. What is your firewall? Are you going to use pptp to get in or will you use a Cisco router for firewall protection. Or will you use a software firewall?
Opinion: I would buy a Cisco router and use the Cisco vpn client to allow secure access to the server. All PCs would need to be running the same operating system to preventCisco client software problems.
Now is the important part - if you just map drives for remote desktop then solution over.
If you want a remote desktop, then you need a dedicated Termional server option using Citrix or MS Terminal Server or something similar.
It will be interesting to see where the topic goes from here.

by maxwell edison

The answer to my question is, use a dedicated VPN server.

Thanks to all who helped with their comments and suggestions. Normally I'd leave a question like this open for a while to discuss some of the other issues you’ve raised (and answer the questions you've asked). But instead, I'll just extend my thanks for your time and for sharing your knowledge in the most gracious way.

For now I just need to focus on getting this thing done. I’ll use a dedicated Windows 2000 Server, separate from my PDC and BDC, and I’ll require all my remote users to have Windows 2000 Professional with some sort of high speed Internet account (broadband, satellite, etc.). And I’ll certainly make no performance guarantees if dial-up isneeded from an “out-of-town” hotel or something similar. And actually, even though I initially stated that I have a Windows 2000 PDC and BDC, those are still on the shelf, not yet on-line, and I first need to replace my NT 4.0 servers with those before I start on this remote access challenge.

I want to get this all done in 2-4 weeks, which will be a real challenge considering all the other things that will undoubtedly occupy my time. In addition, I have a lot of other unanswered questions in many areas of this transition. Which leads me to an offer I’d like to extend to the four of you.

I’m willing to offer bonus points (10,000 to 20,000) to any or all of you who are willing to communicate with me, either by email or phone (I’d pay the phone charges), to help me get over some of the humps I’m almost certainly going to run into. (I know points are worthless, except, of course, the value they carry by getting a question a lot of attention and to the top of the list, which does indeed have some value.)

If any of you are interested, email me – maxwell_t_edison@yahoo.com – and I’ll reply with a more det

by curlergirl

Anyone who has the class to call me (not to mention all the other faceless masses out here) a "distinguished peer" rates a thoughtful answer. To me, the pros and cons of dedicated server or not come down to three things - load, security, and manageability.

Load: If you're only going to have a small number of casual users (10 or so) who will be connecting for a few minutes to hours and then disconnecting, then you could probably get away with using one of the existing servers. If you are going to have a heavier load, say 10-20 users or more who will be constantly accessing the network over the VPN, then you will definitely need a dedicated server. Also, if there's any thought of using a Citrix or Terminal Server/Client setup, you would definitely need a dedicated server.

Security: Using one of your existing servers is a less secure way to go, since they are both domain controllers. Using a member server rather than a DC for RAS connections is inherently more secure becauseActive Directory is not resident on the member server. Also, having a dedicated server allows you to build a DMZ easily if an even higher level of security is required.

Manageability: Having a dedicated server will definitely make it easier to manage as needs grow and change. Also, from your description of the situation, it sounds like you will have a variety of remote users using a variety of different types of connections and PCs at the other end. So, you don't have any control over that side of the equation. This means the only method of control you will have is on the server side of the equation. I think having a dedicated server will give you more flexibility in your ability to respond to and accommodate differing needs of the users. Also makes it easier for you to reset accounts, connections, etc., or even reboot the server when things get hung or just don't work quite right.

by curlergirl

Other comments: I think, if I'm interpreting your description of the situation correctly, that your users who have analog 56K modems will give up very quickly on using a VPN connection unless you provide some other method of desktop connection suchas remote control software or a terminal server/client setup. VPN connections are just too slow over a 56K modem.

One of your major problems is going to be dealing with managing home PCs, laptops, etc., over which you have no control at all. We've had quite a bit of experience with this with one of our clients. Our success rate is about 75% - with problems ranging from lack of user sophistication to one Win98 PC that we simply could not get to communicate reliably with the network at all. Begin to plan how you are going to handle this now before you get caught between an angry user (the rock) and your senior management (the hard place).

I don't have too broad of an opinion or experience level with web hosting. It seems to me it's a matter of bandwidth, traffic and control. If you need control and aren't too worried about high traffic requiring bandwidth and server power you don't have, then by all means do it in-house.

by curlergirl

Okay - Now I'm going to really earn those 12500 points!! Before you get into this VPN thing at all, look carefully at your users' needs and qualify whether a VPN connection will really answer those needs. Sometimes, all they really need is OutlookWeb Access, or perhaps a secure web site or FTP site that they can use as a portal to access data or documents that reside on your servers. Not to downplay the great things that VPN can do, but it also is a rather expensive, complicated propositionfor a few casual users who just want to get their email and download a few documents remotely.

Hope all of this rumination is helpful to you!

by maxwell edison

The answer to my question is, use a dedicated VPN server.

Thanks to all who helped with their comments and suggestions. Normally I'd leave a question like this open for a while to discuss some of the other issues you’ve raised (and answer the questions you've asked). But instead, I'll just extend my thanks for your time and for sharing your knowledge in the most gracious way.

For now I just need to focus on getting this thing done. I’ll use a dedicated Windows 2000 Server, separate from my PDC and BDC, and I’ll require all my remote users to have Windows 2000 Professional with some sort of high speed Internet account (broadband, satellite, etc.). And I’ll certainly make no performance guarantees if dial-up isneeded from an “out-of-town” hotel or something similar. And actually, even though I initially stated that I have a Windows 2000 PDC and BDC, those are still on the shelf, not yet on-line, and I first need to replace my NT 4.0 servers with those before I start on this remote access challenge.

I want to get this all done in 2-4 weeks, which will be a real challenge considering all the other things that will undoubtedly occupy my time. In addition, I have a lot of other unanswered questions in many areas of this transition. Which leads me to an offer I’d like to extend to the four of you.

I’m willing to offer bonus points (10,000 to 20,000) to any or all of you who are willing to communicate with me, either by email or phone (I’d pay the phone charges), to help me get over some of the humps I’m almost certainly going to run into. (I know points are worthless, except, of course, the value they carry by getting a question a lot of attention and to the top of the list, which does indeed have some value.)

If any of you are interested, email me – maxwell_t_edison@yahoo.com – and I’ll reply with a more det

by joseph moore

Ironically, today I am setting up SecuRemote on a laptop for a remote user to VPN into our office!

My first gut instinct is that the VPN on a domain controller is a bad idea. This means you will have a DC in a DMZ area, some segment of your LAN that can be touched by the public. You would have to make absolutely certain that your firewall policy is set up perfectly, only letting in the VPN protocols&ports while blocking everything else.
I have read about VPN setups that the VPN server is on an unscreened DMZ (no firewall between the DMZ and the Internet), and that the server itself is configured with IP filtering on its public NIC. There would then be a 2nd NIC that is patched to the internal LAN.
If a machine was in this type of setup and it was a DC, I would never sleep at night!
So, just for a security standpoint, I would keep the VPN on a separate box that is not a DC.

As for the web server, the same thing applies. I would never run a public IIS server on a DC. Now, I do like IIS, no that all of these bugs (like the directory traversal exploit) have been found and fixed. Yet, the idea of a domain controller being accessed by unknown people using anonymous connections really gives me the creeps!

It does all comedown to security. Do you really want a copy of your users on a DMZ, where it is just that much closer to the Internet? All you need is one really good "hacker" to find it and to get in, and then you are up the creek!

my 2 cents.

by maxwell edison

The answer to my question is, use a dedicated VPN server.

Thanks to all who helped with their comments and suggestions. Normally I'd leave a question like this open for a while to discuss some of the other issues you’ve raised (and answer the questions you've asked). But instead, I'll just extend my thanks for your time and for sharing your knowledge in the most gracious way.

For now I just need to focus on getting this thing done. I’ll use a dedicated Windows 2000 Server, separate from my PDC and BDC, and I’ll require all my remote users to have Windows 2000 Professional with some sort of high speed Internet account (broadband, satellite, etc.). And I’ll certainly make no performance guarantees if dial-up isneeded from an “out-of-town” hotel or something similar. And actually, even though I initially stated that I have a Windows 2000 PDC and BDC, those are still on the shelf, not yet on-line, and I first need to replace my NT 4.0 servers with those before I start on this remote access challenge.

I want to get this all done in 2-4 weeks, which will be a real challenge considering all the other things that will undoubtedly occupy my time. In addition, I have a lot of other unanswered questions in many areas of this transition. Which leads me to an offer I’d like to extend to the four of you.

I’m willing to offer bonus points (10,000 to 20,000) to any or all of you who are willing to communicate with me, either by email or phone (I’d pay the phone charges), to help me get over some of the humps I’m almost certainly going to run into. (I know points are worthless, except, of course, the value they carry by getting a question a lot of attention and to the top of the list, which does indeed have some value.)

If any of you are interested, email me – maxwell_t_edison@yahoo.com – and I’ll reply with a more det

This discussion is closed to new replies.