1

We have 2 offices connected with a fiber optics cables. On both sides FO is inserted into the fiber ports in the switches but we can install fiber pci-e cards in some servers if required.

The offices are small, all people generally trust each other, the LAN is insecure inside and we would rather leave it this way than building a strong security.

The fiber cable goes about 500m thru a public areas, it's easily accessible and could be used by someone to get access inside our LAN.

The idea is to build an encrypted channel between 2 offices to avoid any intrusion thru that cable.

What devices/software can you recommend? We need to have fully working ~1000mbit/sec link with the minimal system load. For example, if the offices will be connected with OpenVPN or similar software, will it be able to handle a gigabit connection? What server load should we expect? All servers are equipped with a similar CPUs - Core Quad 9440 but of course I don't want to use the whole CPU for VPN.

Having some separate device would be better, especially if the bridge will be transparent to TCP/IP.

The offices have no dedicated server rooms so we would like to avoid installing any loud industrial switches/routers.

3
  • To get at your data, an attacker would have to cut your cables. Is that doable?
    – Posipiet
    Oct 17, 2009 at 19:29
  • Everything is possible in a public places. Of course the most possible case is to have it done by a young cool hackers but if they're smart enough, they can use an obtained info very easily.
    – disserman
    Oct 17, 2009 at 20:10
  • Not only is it doable, there are tools to make it easy. Encrypting this link is not at all a bad idea.
    – Lee B
    Oct 17, 2009 at 23:28

4 Answers 4

3

I would definitely recommend a hardware firewall device at each end with a persistent VPN connection between them, if you are worried about fiber splicing.

1
  • after a couple of tests I've stayed with this. Our routers can easily do 1Gbit IPSec. Strange why I didn't check the routers before writing this question :) The only problem is probably to buy copper to fiber adapters (routers don't have neither fiber ports nor any modules) and that's it
    – disserman
    Oct 17, 2009 at 22:20
2

Have you done any testing with common VPN solutions? Try it. I think you'll find that the performance impact of the encryption is acceptable. Modern block ciphers, like AES, are very efficient, and modern CPUs are very fast. For example, one core of my 2 GHz (Intel T2600) laptop can encrypt 120 MBps. I expect that the CPU cost of encrypting a gigabit per second on your 9440s would be less than 50% of one of your four cores.

It may be that the CPU cost of a VPN solution is too high, but I highly recommend at least trying it out. It's the simple, low-cost solution, and it's very likely that performance will be fine.

4
  • I should clarify, that the "B" in "120 MBps" stands for "byte", not "bit". 120 MBps is more than what a one gigabit connection can carry, even at maximum efficiency -- jumbo frames, etc.
    – divegeek
    Oct 17, 2009 at 19:48
  • Not yet because as I wrote, both sides are connected currently with an optical ports in a switch. Testing a common solutions will require buying at least 2 fiber cards for the servers.
    – disserman
    Oct 17, 2009 at 20:12
  • If you are so sure about the server load, I would probably build a test configuration using OpenVPN and 2 local machines connected with a copper. Just one more question - is OpenVPN certificate authentication bi-directional?
    – disserman
    Oct 17, 2009 at 20:16
  • Just tested. Test machine was 2x4 core 2ghz xeon, test between 2 xen DomUs, each has 2 2ghz cores. The speed with iperf / nc is 125Mbit/sec. How can I get more? CPU load is ~1
    – disserman
    Oct 17, 2009 at 20:50
2

Worst case, do exactly what you suggested: get a machine at each end to act as a router and forward packets over an openvpn link between them. No extra load on any other machines, and openVPN is pretty light, so it should be reasonable even on the routers.

A slightly better case would be to check out what Cisco or Juniper has in the way of a small office router that can handle gigabit. A quick google shows up SafeNet as having a product that claims to be able to handle up to 10gE, but it's hard to find a price for it online, so YYMV.

1

You don't need to buy fiber cards for the server, see if you can't create a VLAN on the switches which includes the fiber link port and a port to a secondary ethernet card in the server. Then set up a VPN between them and route internal traffic over it.

1
  • that's exactly what I've decided
    – disserman
    Oct 18, 2009 at 9:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .