Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
?
Solved

Site to Site VPN - 1 Domain

Posted on 2011-05-11
13
Medium Priority
?
413 Views
Last Modified: 2012-05-11
Hi Everyone,

I have recently been requested to look into the possibility of connecting 2 offices together.  I am relatively new to this and am hoping to pull on your expertise.

From my background I would assume that a site to site vpn using sonicwall or cisco smb products would be a good start given there are a relatively small amount of users (Site A and Site B having 20 staff each).

From what I have been reading most of today, it has always pointed me that each workstation/user at Site B would have to vpn to site A individually.  I am hoping I have not come accross great sites.

Is it possible to have Site A and Site B constantly connected where the workstations connected to the router and switch at Site B are authenticating and joining the domain of the server at Site A which would effectively give the impression of 1 network regardless of location?

If it is possible, would the users still log on etc as if it was normal or would they each individually need to create a VPN connection?

I am not currently limited to any version of MS Server however workstations will be using a mix of W7 and XP.

Any help would be appreciated.
0
Comment
Question by:J-J-G
  • 6
  • 4
  • 3
13 Comments
 
LVL 22

Expert Comment

by:Jakob Digranes
ID: 35735585
There's no problem setting up a Site-to-Site VPN for constant connection, and put servers in Site A and let all clients at Site B connect and authenticate to servers in Sita A without extra connection.

Be aware that Wan-bandwidth can be an issue if they access databases or large files on remote site.
I'd recommend the Fortigate 50B in each site - they're easy to install, configure and has a lot of feature. It also has integrated SSL-VPN for all users for connecting outside of offices.

Do something like this.
Site A: 10.10.10.0 network. Server at 10.10.10.10.
Site B: 10.10.11.0 network. Has a route to 10.10.10.10 going out via VPN connection. All other traffic going out local gateway.

If they access databases or applications with large files on remote location - look into deploying Windows Terminal Services for those applications
0
 
LVL 4

Expert Comment

by:every1isevil2
ID: 35735596
vpn site to site means u join the 2 networks together via router like sonic wall or cisco asa

if u choose to have 1 dc u can have the users auth to site a from site b.    but u will run into preformance issues when users auth.  or query dns or dhcp.  

best practice is to have 2 dcs  
0
 
LVL 22

Accepted Solution

by:
Jakob Digranes earned 500 total points
ID: 35735642
Here's some things to consider regarding placement of DC:
http://technet.microsoft.com/en-us/library/cc736771%28WS.10%29.aspx

remember - you need more than just two DCs. For each server location you need UPS, Backup and adequate facility ... that might be costly

So you need to consider WAN link reliability, effects of DC unavailable versus the cost and security considerations of having 2 DCs ... and with that, where file shares and application shares would be, together with replication and backup.

The most secure is to build a proper server infrastructure at Site A: with backup and redundancy and UPS. And let users at Site B connect to it.
With 20 users - the WAN link, as long as it isn't slow 64kbps link - would cope with DC logins, as well as DNS and DHCP, and DHCP you most likely get from local firewall - which rarely produce any traffic. The WAN link bandwidth would be noticable with large files or database applications.

But WAN link reliablility is another issue --- is the link stable? And look into the effects of unreachable DC; can they still login via cached user profiles? secondary DNS?
0
VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

 

Author Comment

by:J-J-G
ID: 35735683
In regards to having a dc at both ends, will they both communicate user profiles etc when a user works half the week at site a with the remainder of the week at site b?

In this case, since exchange would reside at site a's server, would speed issues arise when using outlook?
0
 
LVL 4

Assisted Solution

by:every1isevil2
every1isevil2 earned 500 total points
ID: 35735813
yes they will both communicate user profiles.  active directory will replicate its self accross both sites.  


depends on your wan link, isp or how many users have email.  you will need to monitor bandwith usage.
but if you a huge thoughput it wouldnt cause preformance issues
if you only have a few email accounts look into a hosted exchange server.  
the major issue will be the thoughput of site a internet if you choose to keep your exchange server there
0
 
LVL 22

Expert Comment

by:Jakob Digranes
ID: 35735816
User Profiles, and other file shares is located at one server - but you can use script to copy, or deploy Microfost DFS to have same data both sites, and user MS replication.
But I'd not recommend using roaming profiles throug hWAN links ...

Exchange/Outlook might be an issue if the mailboxes are large and WAN link is poor.
What bandwidth can you get on WAN link? 10Mbit should be sufficient
0
 
LVL 22

Expert Comment

by:Jakob Digranes
ID: 35735839
btw --- looks like i might have misunderstood user profiles.
Yes - as every1isevil2 says: User Profiles and settings are replicated. Roaming user profiles or folder redirection is not ...
0
 
LVL 4

Expert Comment

by:every1isevil2
ID: 35736015
actually after rereading what i posted.  i should of used username or login cred

but as to what jakob_di said.  your isp will be the determining factor in preformance and how its going to be setup
0
 

Author Comment

by:J-J-G
ID: 35736703
Ok so under the assumption that a 10Mbps connection is available, it would be ok to have a dc at each site, exchange running at site A and both sites offering shares to the other site?

Email is preferred to be kept in house and not in the cloud as yet, however if large files etc do start arising with email boxes needing to be bigger than what they currently, then hosted would be the way to go.

Apart from the user profiles, so specifically roaming profiles and folder redirection, is there any way to have this across both sites or is this done by what you said jakob_di?
0
 
LVL 22

Expert Comment

by:Jakob Digranes
ID: 35736787
if 10 Mbps is available, you can have all servers at Site A, and let anything run from that site (rememeber the UPS and backup thing)

If you want roaming user profiles, shares and folder redirection on each server at each site -
0
 
LVL 22

Expert Comment

by:Jakob Digranes
ID: 35736793
sorry ... you need DFS (addition to answer above)
0
 

Author Comment

by:J-J-G
ID: 35743045
Thanks for that.  At what point of connection speed would you have a server at each site?

I am about to start the cost benefit analysis including the ongoing costs of a link at 10mbps compared with slower speeds and the costs associated with 2 servers (and associated components)
0
 
LVL 4

Expert Comment

by:every1isevil2
ID: 35743073
best practice says to have at least 2dcs in case one goes down.  users can auth to a different one without rebuilding the AD from scratch.  and in AD sites and services you can set when you want the AD replication to occure.  i usually set them off hours when users arent in the office.  or when a very limited ammount of users are working.  
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Because virtualization becomes more and more common, and, with Microsoft Hyper-V included in Windows Server at no additional costs, and, most server hardware nowadays is more than capable of running a physical Small Business Server (SBS) 2008 or 201…
This is an article about my experiences with remote access to my clients (so that I may serve them) and eventually to my home office system via Radmin Remote Control. I have been using remote access for over 10 years and have been improving my metho…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

579 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question