VPN lan to lan traffic

[Hoplisenaf]

I need to setup a Lan to Lan VPN between two Branches. The problem or thing is, the VPN must be Router through a Server.

Basically one Router at each branch, but the Routers are not directly connected to the LAN network or switch; they go straight into one of the Lan ports on the Server, the other Lan port obviously into the Lan Network.

My understanding is that the Lan interface on the Server connected to the Router needs to be in another subnet than the other Lan port….To avoid the Lan traffic clashing with the Wan traffic.
So now I need to do 2 static Routes on both Routers.
1 Static Route for the VPN subnet traffic and another for the Lan traffic to be destined for the VPN subnet if desired.

Im sure there are allot of you guys that has done this set-up before.

Some-one please correct me if you think my setup for this is “incorrect”

 

[.Froot.]

Yeah this sounds correct.

 

[damian24]

You can do this and I have been successful as this type of implementation in the past.

A couple of questions you should ask though.

If you loose either server you could end up collapsing your 'VPN' and having no intersite access until the system is up. These thing happen for many reasons, not least of which is something silly like changing the IP of the wan network adapter on one of the servers.

the second thing, if these are active directory servers, you may want to be very very careful with multihoming them as (although totally possible) creates lots of other litltle loops you need to jump through to make sure it continues to work properly.

UPDATE

when I've done this in the past, I've just placed the routers as an additional device on the network with a static route to it's IP on the network, so all machines have intersite access, and if only the servers should have that access the use access lists in the router to configure that (very easy to do on Cisco's)



D

 

[Amida]

You can do this and I have been successful as this type of implementation in the past.

A couple of questions you should ask though.

If you loose either server you could end up collapsing your 'VPN' and having no intersite access until the system is up. These thing happen for many reasons, not least of which is something silly like changing the IP of the wan network adapter on one of the servers.

the second thing, if these are active directory servers, you may want to be very very careful with multihoming them as (although totally possible) creates lots of other litltle loops you need to jump through to make sure it continues to work properly.

UPDATE

when I've done this in the past, I've just placed the routers as an additional device on the network with a static route to it's IP on the network, so all machines have intersite access, and if only the servers should have that access the use access lists in the router to configure that (very easy to do on Cisco's)



D

Agreed. Your also probably going to be multi natting which is always a bad idea if you can avoid it.

 

[Hoplisenaf]

Thanks for the input......