hardware vpn sharing

We are equipping a roaming group of RDP users that connect to one Windows Server 2008 Terminal Server from various sites. They move from site to site as a group and when working, they are all at the same site, generally in the same room.

When on site, they will be behind whatever NAT device is installed at that site. These are generally simple common brand firewalls that don’t block ports; they just require that the session be initiated from the LAN side of the device.

We are working to develop a configuration that will allow their terminal server sessions to share scan and print devices at their remote sites as they roam. We are investigating a native Windows solution, third party software solutions, and hardware solutions if they exist. This question is in reference to a hardware solution.

We would like to find hardware routers with VPN built in that can be configured like this:

Install one as the main gateway and NAT device at the site where the Terminal Server is located. It would be the gateway for the LAN that the Terminal Server is installed on and fixed endpoint for roaming tunnels.
Have a roaming router/VPN device with at least two Ethernet ports. One port would get a protected address from the LAN where the group is working and establish an IPSec tunnel to the gateway where the Terminal Server is located. Use the second port on the roaming router/VPN device to service a small LAN that RDP clients and network scanners and printers could be connected and be used simply as any other network device as the hardware handles all the routing and tunneling.

Two things concern us.
One – That the tunnel can be established through most common NAT devices that they will encounter and be behind as they roam.
Two – That the VPN device at the main Terminal Server location can accept tunnels established from roaming addresses. I seem to remember on older VPN devices that tunnels could be defined from roaming addresses, but on the newer equipment, it seems that both ends of the tunnel need to be defined with a fixed address.

.

Thank you.
mj2112Asked:
Who is Participating?

Improve company productivity with a Business Account.Sign Up

x
 
mj2112Connect With a Mentor Author Commented:
Thank you both. I am assimilating your information. I will post back soon.
0
 
MysidiaConnect With a Mentor Commented:
"One – That the tunnel can be established through most common NAT devices that they will encounter and be behind as they roam."

My suggestion would be to ditch IPsec, then, and look to   OpenVPN solutions.
Or look to Logmein Hamachi.


In either case,  for your VPN hardware, you can look towards consumer routers that are capable of being flashed with DD-WRT  imagines  that have Hamachi or OpenVPN client capability;  due to the requirement to have multiple devices connect.


On the destination network side, look at using an x86 server with an interface outside your normal firewall rules (Bastion system),  or a virtual access server appliance...



The problem with using an IPsec VPN is,  that even with NAT-T    NAT traversal, it is not very robust or foolproof.

For a VPN that will reliably traverse NAT,  you should leverage a TCP or UDP based tunneling protocol  that by design works through a client-side NAT.
0
 
JohnConnect With a Mentor Business Consultant (Owner)Commented:
Take a look at Cisco RVxx VPN routers or Juniper Netscreen SSG routers. Both are reliable and both can handle NAT Traversal - I use it.

Hardware VPN routers work best with Static IP and always did. If your IP does not change a lot, you can get by with dynamic - I do that as well.

You can use NCP Secure Entry (www.ncp-e.com) for client access into these devices. NCP handles NAT Traversal very well.

... Thinkpads_User
0
 
mj2112Author Commented:
i didn't mean to click my own comment................
0
 
mj2112Author Commented:
Again, thank you both. I am using your advice as i decide. Best Regards...
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.