Setting up a remote network

[naiku]

Over the weekend I was asked if I could set up a network for a relative in their office. The office network set up I am fine with, however they also want to be able to access the network remotely.

What is the best way to set this up securely? VPN? Is this easy to set up? they already have a static IP address. If I want for them to also logon to the network do I need to get Exchange server? or Microsoft Windows Small Business Server 2003? (also while looking at Small Business Server I saw this thing saying "5 Cals" can someone let me know what this means?).

Thanks.

 

[captaincrunch00]

As long as the main office has a server in it (probably Small Business Server would be the way to go for 5 users) you could set up VPN on it.

They could log into the server remotely, or they could just check their email via the web. Either way would work...

If the server has applications that the users need and there is no way the same programs can be loaded on the users PCs (databases or whatnot) then they'd have to remote in via terminal server and run the programs that way.

More info is going to be needed for a better answer I think.

As to the 5 CALs: Client Access License. That means 5 users can connect to it at once. If it's the small business server that means 5 people can log into the domain and that's pretty much it.
You would need more cals for more people, and exchange cals if you are going to run exchange.

 

[naiku]

Thanks for the reply, the server will only be used for accessing emails and data (word docs, blueprints, CAD drawings etc) applications themself will be on the individual PC.

If I understand correctly the 5 CAL's that come with small business server do not equal 5 CAL's for exchange and that the "Exchange Technology" mentioned in the information for Small Business Server means that the 2 programs are compatible? and that to access both data and emails I would need both programs? Thanks again.

 

[captaincrunch00]

So you'd have a server sitting in the main office that has the Small Business Server on it.
That would have your Domain Controller and Exchange on it, as well as users home folders and probably a shared public drive or two, right?

You'd want to use Terminal Server to have them connect right to that server, but you'd have to lock down what they can do because you dont want them deleting the Exchange store or screwing around in Active Directory.

Another way to do it would be to have them VPN into the network, and just have mapped drives to the folders they need. They can get email via OWA (outlook web access) or maybe even from Outlook if they were in through a VPN. I dont know on that one. This may be the better way to go, that way you wouldnt have users logging in to your DC and Exchange server, they'd just be going to shared folders and whatnot.

I wish someone smart would come to this thread and answer the question for you.

 

[captaincrunch00]

Oh, as to the CALs... I think you'd need Exchange CALs as well as the Windows Server CALs.

A good way to check this is to call 1-800-MICROSOFT and they can answer you much better than I can.

You have to have exchange CALs if they will connect to exchange in any way, shape, or form, and they also need Server CALs if they are connecting to your server to log into the domain.

I havent bought licenses in a bit, but a while ago any XP Pro computers already included the necessary license to connect to a domain, that may have changed. I would call Microsoft and ask them for sure though. And then get it in writing from them. It'll save your butt in the future.

 

[captaincrunch00]

Alright, 3 replies in a row. Wish I could edit my posts to include further info I wanted to say:

The way you'd connect the offices via VPN would be to have the firewall in the remote branch make a tunnel to the main office. This way anyone who logged into a computer at your remote office would automatically be connected to the main office. This is bad for security reasons. If you have a switch (you'd have to have one anyway) you could do Port Security on the switch so no other MAC addresses could connect to it, that would tighten security a bit.


Another way to do it would be:
You could get a Point to Point connection and not bother with VPNs because they'd be on a WAN (Wide Area Network), then it'd be just like they're sitting in another room in the main office. Of course you'd need a router with a CSU/DSU (I think..?) set up to handle the connection and to put them on your network/Vlan and all that stuff.

I'm going to stop now.

 

[linney]

Use Virtual Private Networks for Secure Internet Data Transfer

http://www.microsoft.com/windowsxp/using/mobility/expert/vpns.mspx

http://search.microsoft.com/results...te+Networks+for+Secure+Internet+Data+Transfer

 

[KenB]

VPN's are usually built into either the Router or the Firewall, check the specs. There is no need for a home server, you can just set up a client VPN application or use the one Microsoft supplied. Or if the home office has a Router you can usually connect the VPN Router to router. Of course this also will need a Broadband connection on both ends to make this tolerable.

HTH
Ken