BOVPN between Firebox Edge X20e and Core X1250e

I'm very much a novice when it comes Watchguard products and networking between subnets so I need some suggestions if I'm on the right track for my project.  Please be kind :)

I've been recently told that the VLAN connecting two of my buildings is being cut so I'll have to come up some sort VPN solution. I already have a Firebox Core 1250e (central office, site A) and have been looking at a Firebox Edge X20e for the "Branch Office" or site B. This is for a university so all IP addresses are public class B, but for example purpose I'll change the first part of address to 192.168.actual.ipaddress.

The current network (site A) is using 192.168.11.0/25, site B will use 192.168.62.128/26. Site B will only have 2 users and ~ 15 devices.  Both firewalls configured in Drop in Mode.

Site A (Core) firewall is currently configured with a trusted interface of 192.168.11.40 (gateway set 192.168.11.1)
Site B (Edge) firewall may be configured with a trusted interface of 192.168.62.180 (gateway 192.168.62.127?). The Edge will also be acting a DHCP server, and use the DNS/WINS servers from site A.

My limited understanding of BOVPNs is that it is a permanent(ish) IPSec VPN which makes it so instead of individual users connecting using PPTP/IPSec/SSL, one connection is made from the local firewall to the remote firewall. By using keep alives the connection should stay up indefinitely. Is this correct?

Its very important the site A and B can communicate just as before. Is this as simple as putting in the DNS/WINS server in Edge device for Site As servers?

Is the Edge X20e the best solution or could I go down to the X10e?

thanks for you help!
futureman0Asked:
Who is Participating?
 
dpk_walConnect With a Mentor Commented:
First thing, any of the firebox X Edge series cannot be configured in drop-in mode; so Edge would always do NAT for any/all devices behind it. If you need drop-in mode you need X550e or higher [you might be better off looking at some other vendor like fortigate in this case for cost consideration].

For VPN your observations are correct; ideally VPN tunnel is not supposed to go down, however, sometimes the tunnels flap, but can be looked into.

If you would have a max of 15 devices which would connect to internet then X10e would fit your requirement; for more users either get user upgrade or move to X20e.

Once site-to-site VPN is up between sites, it would be like accessing networks as earlier; however, you might experience some latency when compared to earlier user experience.

Thank you.
0
 
futureman0Author Commented:
Thanks for the information about the Edge series not doing drop-in mode. That saved me a lot of hassle. I'd rather stick to the Watchguard family of products, I can get X550e with a nice discount. Still it seems like a huge waste just for 15 devices.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.