General VPN Questions and Need VPN Hardware Recommendations

[Minjin]

I'm trying to get a VPN setup and I need some help. I have two offices (A and B) that I need to connect such that they both appear to be on the same LAN for so that a user at either location can see fileservers and license servers from both sites. I also need to setup client - site A and client - site B connections.

Do I need to run an IPSEC VPN? SSL seems much easier but I don't know if I can use it with the FlexLM license server software I need to run. I am currently using Hamachi for client - site but it was a pain to get it working on the same PC as my license server (had to run two NICs) and I really don't want to continue using it. I'm not sure what kind of VPN it uses.

Do I really need to get one of the pay VPN clients or do the free versions work just as well?

What hardware would you recommend? I have access to and can change anything at either site. I'm currently looking at a couple of routers such as RV042 and FVS336G which seem as though they might do the job. I'm currently running a FIOS modem/router at one location but I imagine I can put it in some kind of passthrough mode.

Any suggestions or recommendations? And sites I need to read?

Oh and I have one more advanced question in case the above is too boring. Let's say I get a site to site VPN going. Is there any (easy) way to restrict certain users to only accessing one of the sites? Or should I just forgo the site to site stuff and use nothing but clients at each location?

edit: oh, let's say a dozen users total

 

[ViviTheMage]

How is your cisco ios knowledge? Think you could setup a site to site vpn on 2 routers, and an ASA as the VPN connection for your remote users? If you have a dozen or so users a ASA 5505 would be fine, like this : ASA 5505 or a 5510 if you need more then 10 users.


For routers, anything in the 2800 cisco series would work.

 

[drebo]

Couple of questions: do the clients actually need to be on the same LAN subnet, or do you just need host-to-host connectivity?

The reason I ask is because one is vastly more simple than the other to set up.

If you don't need L2 adjacency across the VPN, then an IPSEC tunnel will work just fine. If you do need L2 adjacency across the VPN, you need to set up an L2TP VPN, which is more difficult.

Either way, I recommend the Juniper SRX series. Depending on required throughput and the number of users on each side, an SRX100 or SRX210 should be sufficient.

 

[ViviTheMage]

Another key thing, what is your budget?

 

[AD5MB]

a bridged VPN connects your NAT network to the far NAT network. so you can ping a router at 192.168.1.110 from your router at 192.168.1.50. this is very useful if you have a mobile research facility and want a stable IP address scheme. the other version is routed VPN.

if you have a high tolerance for technobabble:
http://openvpn.net/index.php/open-source/documentation/howto.html

http://www.dd-wrt.com/wiki/index.php/VPN_(the_easy_way)_v24+

the RV042 will give you a very slow network. VPN is a processor intensive task. the processor in a SOHO router will give you a .5 meg throughput. If you need video and VoIP you need a frast processor on a real computer

 

[Tbirdkid]

Site to site vpn is as easy as an ASA at each end with the licensing. Put the fios router in bridge mode, and configure away...

 

[RadiclDreamer]

How is your cisco ios knowledge? Think you could setup a site to site vpn on 2 routers, and an ASA as the VPN connection for your remote users? If you have a dozen or so users a ASA 5505 would be fine, like this : ASA 5505 or a 5510 if you need more then 10 users.


For routers, anything in the 2800 cisco series would work.

The 5505 has other license packages other than 10 user, they even have an unlimited version. The cost difference isnt much either

 

[freegeeks]

GRE + ipsec
any cisco router with the right license can do it