What's the Most Common VPN Topology

[MrControversial]

I'm in the planning stages for a VPN connecting three small sites (about four PC's each). I'm reading the manual for the Netgear Firewall that I will be using and it only has an example for connecting two VPNs. It's an A --> B configuration where LAN A tunnels to LAN B. However, how should I do a third, LAN C? If I do A --> B and C --> B will LAN's A and C be able to communicate? It's a logical star topology so it seems as if it should work.

The alternative is to tunnel A --> B, A --> C, and B --> C, creating a logical ring. Obviously that's added complexity if we add more sites. Which route should I go?

 

[Rapidskies]

Are you doing this because there is a host site with a server everyone is accessing? If so do a star topology, 1 vpn tunnel to the host site from the 2 remote sites. Otherwise if you just want everyone to be able to access one another create 2 vpn tunnels from each site to the other sites (full mesh). Oh and use Cisco routers 😛

 

[Boscoh]

The most common is a star topology - aka: wagon wheel, or hub-and-spoke.

Basically its A -> B, A -> C, A -> D, A -> E, etc.

Whether or not B, C, D, and E will be able to communicate with each other will depend on your VPN equipment. I have no idea about the netgear stuff, but I'd guess and say that low-end equipment wont support that kind of feature.

 

[MrControversial]

Well, the Firewalls we currently use are old 3COM Office Connect 25's which use a star topology to connect to a 3COM SuperStack at our main site. However, each firewall allows us to connect to destination networks. So although each site connects to a "hub" so to speak, each can "see" one another.

As far as CISCO routers, the sites aren't large enough to justify the cost. Spending $1,000 on a router for whizbang features we won't even use just doesn't make sense to me. Secondly, I find CISCO routers needlessly complex for what we need.

 

[EatSpam]

I do this sort of thing with OpenBSD's isakmpd. Works very well.

 

[FreshPrince]

checkpoint safe@office is a cheap solution for remote offices that require stable enterprise level vpn connections.