HP MSR20 Router VPN Questions

Question

I have limited experience with routers, I was wondering if some offer some insight. I am considering deploying a series of HP MSR20 (or similar routers) at a number of satellite offices which have cable modems. The routers would need to provide NAT for internet access, and at the same time maintain a VPN connection to the main office (with another MSR20) to provide access to the servers there (DHCP, Active Directory, IIS, SQL) in a hub and spoke model. Communication between the satellite offices would be minimal. Most importantly it would need to ensure that the clients at the satellite offices do not use the main office's internet connection. How feasible is this? Are there any caveats that I should be aware of? Anything I should look in to since most of the units i've worked with in the past are SOHO class.

Thanks!

Answer 1

If you're using a cable internet provider DHCP, AD, and even possibly IIS should work without too terribly many issues, however I do not recommend doing SQL queries and accessing a SQL database over a VPN connection, unless you somehow have managed to get a fiber connection to the main office :) What I have done in the past is use the firewall to at each satellite location to handle DHCP, or if there is a local server have it handle DHCP and AD, then NAT the traffic from one subnet to the other in your VPN setup. IE: if the satellite office is 192.168.1.X and the main office is 192.168.0.X make sure there is a rule so traffic can be translated (the technical term escapes me right now) to the other subnet. As far as the SQL portion is concerned I use terminal servers or microsoft's RemoteApp. The kicker is one, two, or maybe even 3 people could use a "native" client and connect to an SQL server over the VPN but it can possibly/probably will be unusable slow. Any more than that and you will start to run into issues with dropped connections, slow network and internet speed etc. I would try to get with someone who really knows SQL through and through, they might know of a way to do this over a VPN?

Good Luck!

msindle