We have 2 offices connected with a fiber optics cables. On both sides FO is inserted into the fiber ports in the switches but we can install fiber pci-e cards in some servers if required.

The offices are small, all people generally trust each other, the LAN is insecure inside and we would rather leave it this way than building a strong security.

The fiber cable goes about 500m thru a public areas, it's easily accessible and could be used by someone to get access inside our LAN.

The idea is to build an encrypted channel between 2 offices to avoid any intrusion thru that cable.

What devices/software can you recommend? We need to have fully working ~1000mbit/sec link with the minimal system load. For example, if the offices will be connected with OpenVPN or similar software, will it be able to handle a gigabit connection? What server load should we expect? All servers are equipped with a similar CPUs - Core Quad 9440 but of course I don't want to use the whole CPU for VPN.

Having some separate device would be better, especially if the bridge will be transparent to TCP/IP.

The offices have no dedicated server rooms so we would like to avoid installing any loud industrial switches/routers.

  • To get at your data, an attacker would have to cut your cables. Is that doable? – Posipiet Oct 17 '09 at 19:29
  • Everything is possible in a public places. Of course the most possible case is to have it done by a young cool hackers but if they're smart enough, they can use an obtained info very easily. – disserman Oct 17 '09 at 20:10
  • Not only is it doable, there are tools to make it easy. Encrypting this link is not at all a bad idea. – Lee B Oct 17 '09 at 23:28

I would definitely recommend a hardware firewall device at each end with a persistent VPN connection between them, if you are worried about fiber splicing.

| improve this answer | |
  • after a couple of tests I've stayed with this. Our routers can easily do 1Gbit IPSec. Strange why I didn't check the routers before writing this question :) The only problem is probably to buy copper to fiber adapters (routers don't have neither fiber ports nor any modules) and that's it – disserman Oct 17 '09 at 22:20

Have you done any testing with common VPN solutions? Try it. I think you'll find that the performance impact of the encryption is acceptable. Modern block ciphers, like AES, are very efficient, and modern CPUs are very fast. For example, one core of my 2 GHz (Intel T2600) laptop can encrypt 120 MBps. I expect that the CPU cost of encrypting a gigabit per second on your 9440s would be less than 50% of one of your four cores.

It may be that the CPU cost of a VPN solution is too high, but I highly recommend at least trying it out. It's the simple, low-cost solution, and it's very likely that performance will be fine.

| improve this answer | |
  • I should clarify, that the "B" in "120 MBps" stands for "byte", not "bit". 120 MBps is more than what a one gigabit connection can carry, even at maximum efficiency -- jumbo frames, etc. – divegeek Oct 17 '09 at 19:48
  • Not yet because as I wrote, both sides are connected currently with an optical ports in a switch. Testing a common solutions will require buying at least 2 fiber cards for the servers. – disserman Oct 17 '09 at 20:12
  • If you are so sure about the server load, I would probably build a test configuration using OpenVPN and 2 local machines connected with a copper. Just one more question - is OpenVPN certificate authentication bi-directional? – disserman Oct 17 '09 at 20:16
  • Just tested. Test machine was 2x4 core 2ghz xeon, test between 2 xen DomUs, each has 2 2ghz cores. The speed with iperf / nc is 125Mbit/sec. How can I get more? CPU load is ~1 – disserman Oct 17 '09 at 20:50

Worst case, do exactly what you suggested: get a machine at each end to act as a router and forward packets over an openvpn link between them. No extra load on any other machines, and openVPN is pretty light, so it should be reasonable even on the routers.

A slightly better case would be to check out what Cisco or Juniper has in the way of a small office router that can handle gigabit. A quick google shows up SafeNet as having a product that claims to be able to handle up to 10gE, but it's hard to find a price for it online, so YYMV.

| improve this answer | |

You don't need to buy fiber cards for the server, see if you can't create a VLAN on the switches which includes the fiber link port and a port to a secondary ethernet card in the server. Then set up a VPN between them and route internal traffic over it.

| improve this answer | |
  • that's exactly what I've decided – disserman Oct 18 '09 at 9:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.