Need help, small business network Router + switch + gigabit + remote access/vpn

[zkaudio]

Let me start by laying out our scenario. We are a CPA firm with 7 local Computers running Win XP Pro (all fairly new) and a 3.0ghz 4mb ram server running server2003 w/ 10 cal licenses.

We currently have an old Sonicwall router/fwall going into a crappy trendnet switch w/ 2 gigabit ports and 24 100mbps ports.

Our business is going paperless and we do a LOT of remote work, we have 3 employees in the field and myself and the other 2 principles do a lot of work remotely as well.

Many of our applications (quickbooks, ms GP/dynamicsGP, Lacerte tax, Mas90/200, Timeslips) have their data files on the server (1 raid 5 array of 160gb drives). It seems that these programs perform SIGNIFICATLY slower over our network than they do locally. My questions are as follows:

1. Would it be worth it to upgrade all of the machines locally to gigabit ethernet cards and get a new gigabit switch?

2. Our current method of remote connect only allows us to connect to the server (remote desktop) or one of the computers here (running vnc). We need a better solution as there are times when more than 2 remote employees are working remotely at once. Our IT (fired) told us that we couldn't access more than one computer using the same remote software (remote desktop / VNC /PC anywhere) so we thought we had to have each program use a specific computer with a specific port allocated to that program and that computer.

I have a client who has a Cisco Pix router, once I connect to their router w/ the cisco software, I can simply open up vnc and type in the local ip of any computer on their network and voilla I have access. This seems far superior to our network and it makes me believe there are probably even better solutions out there. I am very winxp pro savvy but the world of $300+ routers is completely foreign to me... I know my way around server2003 but again, only for maintenance, I wouldn't dare attempt to set one up from scratch.

Can someone help me choose some hardware that will allow me to do what I'm speaking of? I would like minimal network delays on the local network and a very simple remote access method that would allow as much use as possible of the terminal computers from remote access... we also have dual monitors on all in office computers, does remote connect allow you to view both monitors as one and scale the resolution?

I realize this question may not be perfectly eloquent and probably has holes all over it, but I would really appreciate it if anyone can help me out. I would like to drop whatever advice I get here on a new IT guy to make sure he knows his stuff.

Thanks in advance

 

[RebateMonger]

Did your IT person ever show you SBS 2003? That would have given you full menu-based Remote Access to all PCs in the network (Remote Web Workplace), as well as PPTP and IPSec VPN capability, Exchange Server and full Windows Mobile support, and lots of other features for running a business. The hardware and software cost would have been the same.

Changing your networking hardware won't affect Remote Access speed. That's limited by your Internet connection (both upload and download speeds).

 

[zkaudio]

Sorry to misrepresent, we DO have SBS2003, not normal server2003, and we use exchange...I have not, however, heard about this remote web workplace or anything else of relevance :/

Also, I am aware the networking hardware wont affect remote access speed, it was a different concern of mine (performance of programs whose data files lie across the network on the server)

Thank you for your reply nonetheless

 

[w0ss]

If you are running SBS2003 then you can setup pptp to allow remote users to connect. Then they will be able to vnc/remote desktop to the internal ip's. If you are letting people remote desktop to the SBS server you have put them all in the administrator group I assume. Thats bad since they could even by mistake break something or delete something.
Thanks,
Will

 

[Madwand1]

Originally posted by: zkaudio
Many of our applications (quickbooks, ms GP/dynamicsGP, Lacerte tax, Mas90/200, Timeslips) have their data files on the server (1 raid 5 array of 160gb drives). It seems that these programs perform SIGNIFICATLY slower over our network than they do locally. My questions are as follows:

1. Would it be worth it to upgrade all of the machines locally to gigabit ethernet cards and get a new gigabit switch?

There are two variables here -- the RAID 5 system on the server and the networking. A priori, it's impossible to judge the performance, but there's usually a good chance that a random RAID 5 implementation will have poor write performance, especially so with small writes, and slow network communication will make this problem worse.

I'd approach this problem by consulting the important application vendors for any recommendations; studying the data transfer patterns, and then studying the network and drive/file system performance under similar loads.

I'm generally a big supporter of gigabit networking; I encourage its adoption in general as a relatively inexpensive way to substantially improve performance, but it's hard to predict its impact in an unknown environment under specialized application load.

 

[RebateMonger]

Originally posted by: w0ss
If you are running SBS2003 then you can setup pptp to allow remote users to connect. Then they will be able to vnc/remote desktop to the internal ip's. If you are letting people remote desktop to the SBS server you have put them all in the administrator group I assume. Thats bad since they could even by mistake break something or delete something.l

That's not how SBS's Remote Web Workplace works. It's a secure Web Site that offers a Remote Desktop menu lets each employee log remotely onto their office computer. Additonally it offers access to the CompanyWeb (SharePoint site) and Outlook Web Access. It's considerably more secure than a VPN connection because it doesn't allow employees' home computers dirctly onto your network (like a VPN does).

Originally posted by: zkaudio
Sorry to misrepresent, we DO have SBS2003, not normal server2003, and we use exchange...I have not, however, heard about this remote web workplace or anything else of relevance :/

There are a couple of good books on SBS. Somebody ought to read one, or hire an SBS specialist for an hour or two to show you how things are SUPPOSED to work in SBS. There are tons of useful features that will take you forever to discover unless you either spend a LOT of time, read a book, or get some help.

 

[w0ss]

That's not how SBS's Remote Web Workplace works. It's a secure Web Site that offers a Remote Desktop menu lets each employee log remotely onto their office computer. Additonally it offers access to the CompanyWeb (SharePoint site) and Outlook Web Access. It's considerably more secure than a VPN connection because it doesn't allow employees' home computers dirctly onto your network (like a VPN does).


I didnt think you could do that without the SBS as your router? could be wroung but I never got it to work unless it was.

 

[cmetz]

zkaudio,

1) no.
2) For multi-user remote Windows application use, look into Terminal Services or Citrix.

I'd suggest you put your money into a new server with a lot of memory and I/O throughput, such as an HPaq DL385. It sounds like your applications have retarded I/O usage patterns - I know QB has this problem. If that's the case, network I/O is going to be very slow, local or VPN. So you might be best off running all those on one box and remotely using that box to run those programs. Citrix is expensive and a PITA to administer but does as good a job as you're going to get for this problem.

Use a Cisco 1800 series router as your new router/firewall/VPN terminator (be prepared for some Cisco bugs), and the Cisco VPN client. Using that combination you can restrict well what things VPN clients can get to. BTW, the PIX line is pretty much dead, so don't buy those.

 

[RebateMonger]

Originally posted by: w0ss
I didnt think you could do that without the SBS as your router? could be wroung but I never got it to work unless it was.

You can use RWW in single-NIC mode. Just forward TCP Port 3389 and TCP Port 4125 from your hardware router to your SBS 2003 Server. RWW will be able to access all the client PCs on your network. I don[t have any more single-NIC SBS installs, but it worked just fine when I did have them.

In SBS's single-NIC mode, you'll still want to make SBS your DHCP Server and DNS Server for all the client PCs. Turn off DHCP on the hardware router. Only use the router as the Default Gateway for the PCs.