Setting up a VPN?

[BlckMgk]

Any help?

-BlckMgk

[Lazerus]

WTH is a VPN?

JC.

[Maniac]

Ehe.

Not THAT easy man!

Need ALOT more details.

Is it for a company? is it for private use?

If its for a company, then look at Cisco products. You need alot, a VPN/RSA server, VPN-Concentrators etc etc.

If its for private use, then you simply could set up a "tunnel" between you and the other dude, and voila, you have a VPN of sorts...

[AKIron]

What Maniac said. However, there are two basic ways to configure a VPN (and a lot of variations). Network to network or PC to network. If you are looking to connect a home pc to an office network you can do this in several ways. My preferred method is to configure a network firewall/gateway to allow a vpn connection and then create a Windows connection. This is very easy to do and can be done in less than 10 mintues if your router supports VPNs.

[save]

Site to site VPN is easy IF you got
fixed ipadress


Cisco is a breeze if you got 2 pix'es
you only need one firewall or  router in
the other end.
all the stuff maniac ( hej grabben    )  talks about is optional .


Normally client to site is easy to set up in the client ( windows                                     tomshardware.com has a excellent guide online

Cisco client is easy if they do not enforce the firewall , northel and checkpoint firewall-1 clients  = also easy although not if you dont want more than one client at the time.

You might have to open stuff in your firewall for return traffic.

save
communications system specialist

[Trell]

Check point is also simple .  are you looking to build one?  or just link into a system allready??

[Vulcan]

CISCO SUCKS. IT SUCKS DONKEYS BALLS... DON'T TOUCH THAT CRAP.

Ok, now thats out blck what would you like to know?

I can do site to site IPSEC, remote access IPSEC, and SSL for ya

(p.s I lean towards Netscreen as a superior technologicaly product, esp over Cisco and Checkpoint, and Sonicwall for a great "ease of use" product)

[Maniac]

Originally posted by save
Site to site VPN is easy IF you got
fixed ipadress


Cisco is a breeze if you got 2 pix'es
you only need one firewall or  router in
the other end.
all the stuff maniac ( hej grabben    )  talks about is optional .


Normally client to site is easy to set up in the client ( windows                                     tomshardware.com has a excellent guide online

Cisco client is easy if they do not enforce the firewall , northel and checkpoint firewall-1 clients  = also easy although not if you dont want more than one client at the time.

You might have to open stuff in your firewall for return traffic.

save
communications system specialist

Tja Save! Läget?

Listen to the expert, im just a admin

[Vulcan]

Nobody in their right mind would buy Cisco equipment for VPNs. PIXs are the biggest pile of dog doodoo on the market for security (Cisco themselves can't even keep their own code safe, and seem to like putting backdoors on their kit). Putting a PIX in for a firewall is like using duct tape for a lock on your front door. The security functionality is out of date, the VPN functionality is primitive at best for todays requirements.

Blckmgk tell us the answers these questions:
 - is it for a site to site VPN or for remote access users
 - if its site to site, how many sites and do you want meshed tunnel redundancy, is there going to be a Head Office with multiple remote branches?
 - if its remote access how many users and whats the ratio of users to actual users expected to be using it at any given time (ie, say you have 100 users, but only expect no more than 10 or so to be VPNing in after hours)
 - how fast are your internet links
 - what sort of budget are you working too?

[BlckMgk]

Well the VPN setup will be something along the lines of a server/client access there will only be a few users 3-5 total who will need access to the server.

I'm running Windows 2003 Small business server.

I currently have my internet running into a router, then into a switch. Should I make my server the firewall/router, then plug it into the switch?

Any suggestions, literature that I could read on a setup would work for me. Thanks for the comments folks.

-BM

[Vulcan]

IIRC SBS can act as a server, but its not very good at VPNs. You can tack on ISA Server to SBS for firewalling but once again its not as good as a real firewall.

I'd chuck on a Netscreen 5GT or 5GT Plus (5GT is 10 IP version, Plus is unlimited IPs protected by the firewall, so if you only say 8 users buy the 5GT, if you have 20 users, buy the Plus).

If are running any services on the SBS server such as email (ports 25, 110, or 143), or Web the 5GT can add extra protection with Deep Inspection - application layer firewalling. Stops all those hacker nasties and worms from attacking these applicaitions on your server where a normal SPI firewall (ie equivilant Cisco and Checkpoint products) lets these attacks straight through.

I also recommend a service contract with any 5GT's I sell, it enhances your warranty, support, and you get all the firmware revisions for one year.

Now, heres the catch, if you buy 5GT+Deep Inspection sub for 1 year+Service contract it works out to within a couple of bucks as the 5GT Antivirus + Service Contract (AV service contract includes Deep Inspection and AV updates for 1 year). So even if you don't use the antivirus you practically get it free.

So you buy the AV version

Then you buy VPN Client, NS-R8A-010 or NS-R8P-010, this licenses up to 10 users, the R8A is essentially the Safenet VPN Client rebranded, and the R8P is the Safenet Client with the Sygate personal firewall. The R8A is cheeeeeeeap, probably US$100 for the 10 user.

The 5GT will support up to 10 concurrent VPN users, it does up to 20Mbps of 3DES IPSEC traffic, so its a nice fast little box. It also supports things like traffic shaping within the VPN tunnels, extremely helpful for things like Terminal Services sessions.

I could go on all day about the 5GT's features, its a wicked piece of hardware. Brochures are here: http://www.juniper.net/products/glance/nscn_5.html   and here    http://www.juniper.net/products/glance/remote.html
Hope that helps.