VPN suggestions? 1

[davidmulcair]

Hi there,

Our company is looking into setting up a VPN to connect branch offices. I've been looking into several products, and wanted to know what everyone thought was a superior (mainstream) hardware or software product. The branch offices are very small (<10 systems).

Thanks.

David

 

[davidmulcair]

Seems like the tunnels are getting stopped at the GNAT box... I enabled remote management, and i can get to THAT throught the GNAT, but the tunnel just shows

02:54:40
02:54:40 IKE[1] Tx >> MM_I1 : <my IP address> SA

(i replaced my ip with <my ip address>)

and doesnt continue connecting from there.. Now im quite lost.

Any idea anyone?

 

[davidmulcair]

And finally,

Would it be feasible (smart, secure) to use the linksys as a firewall replacement to the gnat? This seems like the simplest way. That said, when testing this kind of set up, the domain server still didnt seem to carry through.

 

[fyrewyr]

For the &quot;No Domain Servers...&quot; at the remote site - assuming the domain server is on the local network, you'll get this when the tunnel isn't up, for sure. When the tunnel is up, and you still get the message, try setting the primary and secondary WINS server on the client machine. You will need a route from the remote->local as well as the local->remote - either provided by the LinkSys (remotely) and locally, half by the GNAT and half by the other Linksys, or on the client machines.

No response through the GNAT could be a routing problem (or a block) - do you see the ESP packet come out the other side of the GNAT?

I can't answer whether you should use the LinkSys instead (refer to lack of experience with GNAT). There's some feeling that this router is low end (you get what you pay for) so I like having it behind another wall. The only problems we've had with ours was when our ISP reassigned our &quot;fixed ip&quot; to someone else (hello). Helpful detail: The BEFSX41 doesn't refresh the web page when you &quot;Connect&quot; the tunnel (even though it seems to, it will still say &quot;Disconnected&quot; - you have to &quot;refresh&quot; the page again after the connect is attempted - or view the logs. The tunnel's actually there, so it's just an interface nuisance.

And finally, an offer. I just realized there's a VPN forum, and this thread is long (my fault). While at culmination you should carefully weigh remote management (perhaps using Out of Band management, like a modem + PCAnywhere) I'm happy to provide personal assistance that way. I'll post my spam-magnet account next, so it can be flagged seperately if inappropriate. I'm sure you know not to post specifics here. I'll do what you need to ensure non-disclosure, and if we solve it, we can post the solution back for the forum's benefit.

 

[fyrewyr]

jogglie at excite