VPN site-to-site considerations

VPN site-to-site considerations.  Remote office users need to access two different data centers and the Main office.  So at least three different IP addresses.  In addition they also need to access their own machine back in the remote office when working from home.  There are two remote offices (15-20 users each)  and the one Main HQ office.  

Would it be better to design with one single VPN Concentrator hub or build individual tunnels from every office to every data center and remote location?  I'm leaning towards the 'one hub' VPN Concetrator with different profiles directing to remote offices.  
I need to hear pros, cons, drawbacks for each.  Thanks guys!!
LVL 17
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

JohnBusiness Consultant (Owner)Commented:
I think if users go to a Hub and back out to an office, it will be slow (and VPN is usually slow anyway).

So unless they need simultaneous access, I suggest accessing the office directly. Put a VPN box in each site.
Aaron TomoskyDirector of Solutions ConsultingCommented:
Will they be using their Remote Office desktops to access the DCs and HQ when at home? If so, just VPN to the remote office, then use the existing tunnels to get to the DCs/HQ.

IF they are accessing the DCs/HQ directly from home, then yeah, you will want VPN endpoints there.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Tiras25Author Commented:
They will be using their work laptops.  They also have development desktops that will stay in the offices.  

So yes, they will use a Client VPN when travelling.
Big Business Goals? Which KPIs Will Help You

The most successful MSPs rely on metrics – known as key performance indicators (KPIs) – for making informed decisions that help their businesses thrive, rather than just survive. This eBook provides an overview of the most important KPIs used by top MSPs.

JohnBusiness Consultant (Owner)Commented:
So then put VPN boxes at the sites - I think that is the best way for the best speed.
nociSoftware EngineerCommented:
For the offices use site-to-site VPN boxes, prefered VPN method is  IPSEC, as that has the least in overhead & transformations  and is designed to be an effective security mechanism. With  OpenVPN, SSLVPN's etc the problem is mostly that one travels the IP stack twice.
One time with the end to end packet, and one time with the encrypted packets.  

For the traveling systems L2TP is a flexible mechanism on top of IPSEC.
Tiras25Author Commented:
So one VPN Concetrator HUB vs. individual tunnel from each and every location better right?
JohnBusiness Consultant (Owner)Commented:
Make sure about speed as users may have multiple slow hops
nociSoftware EngineerCommented:
Do select the hardware that will support several tunnels (not just 1 or 2), you may never have a lot of tunnels (although each L2TP is a separate tunnel),  the higherend equipment has Hardware assistence for encryption. Be sure that AES  is used & supported on the tunnels as it faster the 3DES (which is arguably not that secure anymore).
JohnBusiness Consultant (Owner)Commented:
With good equipment you can do both. Entry point Cisco RV345 VPN routers or bigger if needed for volume will permit site to site between offices (you may need a bigger unit for the Hub). Make IPsec Tunnels between and then also make each point an access point. You can do all of this with a decent VPN router.
Jonny BTech (CEO)Commented:
Many things to consider in the VPN site to sites.   Lots of options available.  By the sounds of the size of your offices and networks requirements, I would suggest looking at the Sonic wall products.   They are perfect for small and medium business with limited budgets and the devices are affordable.  The site to sites can be easily setup with these devices and your main office can handle all the client vpns.  Keep in mind, that the main office would have to have more internet bandwidth to handle the other few locations and the clients.  The global VPN clients can be used on windows laptops with no issues.  if mac or linux clients are needed, you would have to switch
to the sslvpn setup as well for those to connect in.  :-)
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Hardware Firewalls

From novice to tech pro — start learning today.