Best way for VPN.

I have done it numerous ways.  The current solutions I am using is with Watchguard firewalls, but it works with Symantec or Pix.  I have also done it with Windows VPN.

What are you trying to accomplish?

In my case, the core network is at City Hall.  I have a Watchguard at City Hall and at the remote sites.  The Firewall's establish a Secure VPN tunnel between themselves.  So, now my remote sites actually logon to the domain from those remote sites.  If the romote site has a resonable amount of users you might want to put a Domain Controller there.  That way the users authenticate to that DC which could also act as their file server, etc., but you would still have the connectivity and accessibility to the main site.

I have two remote sites, each with about 12 users. I would like to give them domain connectivity to the main site, but I would like to have each site use its own route out to the internet, so I dont have all the internet access piped through the VPN, just the domain information, like authentication and file sharing.  But if the VPN goes down, I want them to have internet access too. How will this work with things like active directory integrated DNS and DHCP?

I have setup multiple networks using Cisco routers.  My personal preferance is the Cisco 831 router.  It comes with a 4 port hub on your inside interface and a Ethernet connection to you WAN side.  This router also comes with an encryption module and an IOS firewall, all for under $500.00.  The 1700 series router are fine, just more expensive, and you have to purchase the IOS firewall and encryption separately.  The configuration on the 831 routers is pretty easy as well.  There is even a web bases configuration tool on these to help you configure the router.  I am not sure if the 1700 series routers come with this since I only the Command Line Interface to configure routers.

If your connectivity to the main site goes down, your internet should be fine.  Most firewalls or routers are smart enought to route traffic appropriately unless you tell it otherwise.  In other words, Internet traffice can always go directly to the web, however, requests to that certain server or resource that the firewall or router knows is over the VPN will be routed over the VPN.  If the VPN goes down, local and internet traffic still work fine.

You should take a look ath this link:

http://www.microsoft.com/technet/prodtechnol/windows2000serv/technologies/activedirectory/deploy/depovg/advpnddd.mspx

It provides some insight into configuring Acitve Directory replication over slower connections such as a VPN. I have tried to do this in the past and had issues around the replcation. One word of advice.....schedule your replications for off-peak hours. AD Replication can suck up the bandwith of a VPN very quickly.

For hardware I would recommend a PIX. Even the smaller 501's can do site-to-site VPN's. This Cisco article shows how to set up a simple Pix to Pix VPN.

Good Luck,

--Chris