IT Employment

Ask something
Discussion Locked

VPN /WAN/Internet Access

0 helpful
7 replies

by ewallig

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi there, newbie question - want to create two sites in a single W2K domain and connect them (primarily for replication purposes) via VPN (both sites will have ADSL WAN access). I want to use the existing broadband connection that both sites will have and not resort to a secondary connection, such as modems or frame relay.

New to the VPN concept - will site A's Internet traffic have to be routed through the site B's default gateway/WAN access (or vice versa), or can both sites access the Internet independent of the VPN connection?

The general idea in this case is to connect the routers (or VPN-enabled firewalls) so that replication is possible between the sites and site-to-site traffic is relatively secure. The concept may be expanded to other locations if proven effective here.

Sorry, probably a pretty lame explaination of what I'm trying to do...any suggestions? Thanks in advance...

Ed Wallig
Web and Tehnical Support / Network Administrator
GCF Global Learning

7 replies

by jorgy1

I know that we just set up a VPN solution for a client and tested it using a VPN client connection from within the domain. Our scenario was as follows...clients on the network that accessed the internet via a router connected to a DSL modem. We set the VPN up on the server (Win2K domain controller) and tested from within the domain from one of the clients. So, we went from client to server via the VPN but both client and server had internet access. We also had an outside source test the connection going from client to router to modem to modem to router to server. It was only the second time I had set one up so my explanation is probably a little messed up....but it worked!

by lordinfidel

Is to due what is called a "Tunnel" between the 2 sites.

The best, easiest and transparent way to do this is at each locations firewall.

Using IPSec (using 3DES and MD5 as the preffered encryption and hash), as long as your firewall/routers support it, setting it up between the 2 is usually pretty straight forward.

It is easier when both locations have static IP's and are always available.

If you have ADSL, 10 to 1 odds you should have a hardware based router/firewall.

If you don't and you are still using the modem that came with your service. A cheap and relatively easy to deploy solution is Netopia's R4541 series ADSL routers w/vpn. They go for around 270-299.

If you get 2 of these and deploy them as your router/firewall solution, 1 on each end of the connection. Then set up an IPSec tunnel between the 2 of them. You will be good to go. Netopia's site has some easy to follow directions on how to do this.

If you want to be a little more advanced and "adventurous" (and free). Get yourself 2 linux boxes and install FreeSwan on it. It is a free VPN solution. But it requires knowledge of linux, vpn and firewalling. Not for the faint of heart.

by dukebytes

Might want to look into the Cisco PIX 506. One at each location. They will act as a gateway, firewall and a VPN tunnel for you.

You can browse to the internet or go to a box at the other office via the "inside" network.

You can force all traffic thru one location to get email, internet etc... if you want to - but that would be "double dipping" on one end and not really neccessary.

I have a 3-way meshed VPN using a preshared key and all Cisco eq - works well :)

Good Luck,
Duke

by dukebytes

The examples on the web site help a lot when setting up the VPN - they have examples for just about every configuration that you can think of.

Use preshared keys - the CA certificates stuff is a bit hard to work with.

Also buy the upgrade to the IOS for the 156bit (3DES) encryption.

The only other thing that I can think of is if you have A LOT of people at these locations. I know that there is a limit to the number of connections in and out on the 506. Might have to upgrade to a 515+if you need the connections.

One more thing :) If you want to work on the VPN ACLs or maps or anything like that - YOU MUST disable the crypto map and the isakmp on the outside interface before making changes - it will lock up if you don't.

Example:
no crypto map mymap interface outside
no isakmp enable outside

Then make your changes and reapply these commands:
isakmp enable outside
crypto map mymap interface outside
in that order and the VPN will come right back up.

The biggest problems that I had with the VPN stuff was getting the passwords for the keys right on all the boxes.

Good luck,
Duke

by dukebytes

Good luck with the beancounters :)

Actually I hope that they go for it - the Cisco/VPN stuff is a lot of fun to work with.

Duke

This discussion is closed to new replies.