Failover internet access

Question

My company have several remote office connected via a T1 connection. All the remote offices use terminal services to access the servers at the main office. Well, we had a hiccup a couple days ago and one of the lines was terminated by accident by AT&T, and that office had NO internet access and no access to the main office and the servers. Which caused a stand still in the business at that location.

There was local dsl internet access for the public there. Slow but some things come have been done at least.

So my question, how do you setup a failover router / internet access? Something that can be automatic or extremely easy for a noobie to switch over. We are a win2003 network.

Answer 1

Several solutions could fit your needs, depending of several parameters like existing hardware or your budget.

If you only need internet access when the T1 is down, this should be easy with a dual wan router or a firewall.

If you also need access to the corporate network, you could establish an IPSec tunnel over internet. This tunnel can be handled by a router (existing T1 router?) or a firewall.

AT&T could also provide you with a backup line, which provide both Internet & corporate access.

The following questions could help you also :

Backup Internet Providers?

Network Balancing / Failover with MPLS and IPSEC Tunnels

And here is a more theoretical question, but could help to give you a more technical answer about backup routing : EIGRP for Failover

Answer 2

If we are talking about linking branch-office LANs it's doable with VPN hardware/software solutions.

One way to do it is like this:

MAIN: your main site with let's say LAN with 192.168.0.0/24 network OFFICE-A: your main site with let's say LAN with 192.168.1.0/24 network OFFICE-B: your main site with let's say LAN with 192.168.2.0/24 network

for MAIN:

1. Get two upstream links with publicly accessible IPs
2. Get a setup/hardware to handle routing (and failover) through both upstreams
3. Setup VPN server to allow connections through both links
4. Setup relevant routes to branch offices trough tunnels. 

for OFFICE-A and B:

1. Get upstream link and maybe another upstream or 3G provider.
2. Check that it's easy to switch between them (like unplug cable, 
   plug in another if you don't need automatic failover)
3. Setup VPN client (software/hardware) that can handle multiple 
   VPN-server targets and handles failover of VPN tunnel.
4. Setup routing so that routing to MAIN goes trough VPN tunnel.

With this setup your terminal service servers have always the same IP and recovery from link failures is relatively fast. Biggest hurdles with this are: witch VPN solution (vendor, software/hardware), does this require network restructuring, in-house expertise or consultant and how to find the needed know-how in your area. With a setup like this you don't need access to upstream (ISP) routers and you don't need MPLS (if you talking about a big company with big branch offices then MPLS etc solutions are preferable)

If you need publicly available service failover then that's another beast.