Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Sounds like easy task to some but such a difficult task for me to do...

The main requirement for this task is to setup something in offices located on different locations, so (1st question) users are able to log on to the domain without VPN when they are in one of the offices. Additionally, (2nd question)how they can log on to the domain server when they are on the road like in a starbuck, what do they have to do to connect to domain after VPN connection are successful.

also it's my understanding that, we can't share resource from computers on different network segments, (3rd question)what is the best solution to bridge/combine two network segments(two office in different locations) so computers of different location can see each other.

Thank you in advance for any response.

share|improve this question
    
@joe. dedicated vpn boxes = good idea, having windows2003 handle vpn connections [ i assume they would come from 'road warriors' ] - not so good idea... in my opinion. –  pQd Apr 24 '10 at 15:41
add comment

1 Answer

i have a bad news for you:

you actually can share resources from computers on different network segments.

obviously performance of it will depend on the protocols and requirements. access to network shares via windows networking will be quite slow on typical adsl line, but still usable.

what you need is a vpn between offices, and static routes added on the edge routers in both [or more than 2] locations. you can go for standardized ipsec solution and use hardware/software provided by many vendors or you can use openvpn which does great job for me for last 6 years or so.

so an example - technology / vendor agnostic.

diagram

full image here.

explanation:

computers in office A use r00 as default gateway [and nat router, and dns machine and maybe even dhcp server probably]. they send all packets to hosts they cannot reach within 10.0.0.0/24 to that machine. similarly computers in office b use r10 as the gateway.

r00 has a default gateway pointing to the internet service provider and additional static route telling that networks 10.0.1.0/24 and 10.0.2.0/24 can be reached via vpn. this vpn can run locally on r00 or on separate box [here r01].

r01 is using your internet connection at the office [ this part was omitted in desperate attempt to make picture a bit readable] to establish encrypted tunnel to r11. r01 forwards packet received from the tunnel to r00 and received from r00 to r11.

r10, r11 do analogical job.

now your 'road warrior' - person sitting at Starbucks and wanting to access some internal resources [exchange server? file server? intranet web page?]. she is using available internet connection to establish encrypted tunnel to your vpn concentrator [ can be separate box or one of r01/r11 ] and depending on the company policy either sends all traffic via that box or just traffic destined to 10.0.0.0/24, 10.0.1.0/24, 10.0.2.0/24. as you see 'road warrior' gets ip address from different range - 10.0.2.0/24 - one allocated to 'dial up' users.

ps. this is a simple case - you can get things more complicated [ and more secure ], but i hope this gives you the idea how things can look like to achieve what you need.

share|improve this answer
    
Wow, thank you so much for the fast and detail response. Here's a draft plan, first I will put two VPN routers on each office to establish tunnel for the two distributed network to communicate. second, I will configure vpn service on a windows server 2003 machine which sits behind one of the vpn router, this server will manage all the remote vpn connection on top of its domain controller role. third, for all the connected users/computers, I will enable folder sharing on the user's local computer with restriction of DOMAIN user group (I haven't done that before), if that works, problem solved. –  Joe Apr 24 '10 at 15:30
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.