optimizing authentication in a slow link network???

[Rockstar101]

hello all,

This seems to be a tough one so I though i'd check in with the experts!

I have a situation, we have a domain with plenty of bandwidth but the problem is we have 1000's of branch offices and communication is via slow link bandwidth (vsat). How can authentication be tweaked to work best over this slow link.

If it were only a few sites then I would just put a DC at the site but its not feasible due the large number of sites we have.

Any suggestions? Thank you!

 

[dberg35]

How are the branches connecting VPN? If so what kind of VPN setup do you have?

 

[Rockstar101]

we are using satellite, no vpn or vnc, just tcp/ip. hopefully this answers your question. Thanks.

 

[pagy]

This may be of interest;

Planning Regional Domain Controller Placement

http://technet.microsoft.com/en-us/library/cc736771.aspx

Paul
MCSE 2003
MCSA 2003
MCITP Enterprise Administrator

If there are no stupid questions, then what kind of questions do stupid people ask? Do they get smart just in time to ask questions?
Scott Adams

 

[Rockstar101]

Hi Pagy, thanks for the link but placing DC at the location is not feasible since we have 1000s of site, it's just not in the budget.

I was thinking more along the lines of having the clients at the satellite locations authenticate users against their cached credentials and perhaps extending the TTL. This way when a corp user logs into a branch site we eliminate authentication traffic...?

Does that sound correct? or are there other ways to do this?

Thanks!

 

[pagy]

The link spoke about using hub sites, not placing a DC at every site. If some money is available you could look into using certain sites as hub sites..

What's the speed of the satellite link??

Paul
MCSE 2003
MCSA 2003
MCITP Enterprise Administrator

If there are no stupid questions, then what kind of questions do stupid people ask? Do they get smart just in time to ask questions?
Scott Adams

 

[dberg35]

Well for start satellite is has latency being it has to up to the satellite and back, that is slow in its self. You would be better having a wired connection like T-1 or cable then creating a VPN connection.

 

[Rockstar101]

ah sorry Pagy, understood. The speed of our Sat is approx 64k, 128 burstable. I understand Sat is slow just because it's Sat due to latency.

Perhaps establishing Hubs within the Sat route may be the way to go.

What about the allowing clients to authenticate users based on their cached credentials? That would also keep the client from having to come all the way back up the DC.

Thanks again!

 

[Rockstar101]

dberg35 - I would love to have a T1 or dsl but its not in our budget but that would be ideal. thanks.