Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a client with two networks in two buildings and they want to access each others resources. Right now site B connects to site A via a VPN over a T1 line. They want to get rid of the T1 and go to our local cable provider which offers a 50mb down 5mb up package. Site B's ip scheme is 192.168.1.x and site A's scheme is 192.168.0.x. We have 2 Watchguard XTM 25's and are ready to use them to pin up the VPN.

In summary I have all the parts ready to do connect the two networks, my question to the community is what do I need to watch out for and do I need any specific routes on the firewalls to allow traffic to move from the .0 network to the .1 network and vice-verse.

Unfortunately this is my first time to do something like this and I'm kinda on my own!

share|improve this question
up vote 1 down vote accepted

Many of the details of how to set things up here are specific to your Watchguard box. I've never worked with those devices, so I'll speak in generalities. I'll also assume that you've figured out how to configure a site-to-site VPN tunnel between the Watchguards (which I'll refer to as "routers" from here on out).

  1. A site-to-site VPN tunnel needs to be established between routers
  2. A static route needs to be set on Site A's router to route traffic destined to through the VPN to site B
  3. A static route needs to be set on Site B'S router to route traffic destined to through the VPN to site A
  4. Firewall rules between sites should be set up using a "default deny" policy, which requires you to explicitly specify Access Lists for what IP addresses and ports are open between sites. For instance, if Site A users only need access to a file server and a printer in Site B, firewall rules should be put in place that only permit that traffic, and no other traffic. This limits collateral damage if, perchance, a workstation gets infected with a virus, it would not be able to spread through the VPN to systems in the other site.
  5. You probably want some sort of monitoring mechanism to alert you if the tunnel drops

Steps 2 and 3 will likely be set up automatically by the router when you configure the VPN tunnel.

Be aware that intra-site network performance will likely suffer quite a bit after this change. It's true, the available bandwidth of the cable connections is higher than the T1. However, your latency will likely increase by an order of magnitude (which is a huge deal for protocols like CIFS, which are very chatty and suffer greatly over high-latcency connections), and the reliability of the WAN will go down significantly. Even if these are "business class" cable internet connections, they're of a different class of service than a T1 is.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.