Corporate VPN Hardware Advice

[slinky]

Morning All,

I'm trying to look into a possible solution to allow VPN access into our network for remote users/management.

At present our IT team have built a solution, but is exceedingly intrusive for users with existing infrastructures at home...

The solution specified at the moment demands that an ADSL Modem with a Static public IP address is used. This, obviously, will cause problems for those users running routers and will almost definitely stop users on cable networks from being able to connect.

Can anyone make any recommendations as to hardware/software for VPN connectivity for up to 40 users with the least disruption to the end user?

Cheers,

slinky
[url]587racing.com|http://587racing.com[/url]

[TheExcession]

Not really, but what ever you do stay away from Checkpoint stuff.... been the bane of our life for too long now.

best
Ex

[zumbruk]

Well, the news is mixed. Until recently, we've used the Intel (which used to be Shiva which used to be LANRover) VPN stuff, which I like a lot. Bring up the VPN and it looks like you're attached to the remote network. Drive mappings, etc., etc., etc. Works through NAT gateways (which getting IPSEC to work through is tricky, although possible), no need for fixed addresses and so on. The bad news is that this product has been EOL'd, so we've had to switch to something else, which in the this case is the Cisco IPSEC product. This works fine through NAT/ADSL etc., but the PtB have decided to run it in the mode where it disables all other network connections on the local machine when it's running. This makes it a pain to use for those of us with home networks - although I would imagine it would be fine running in the 'other' mode.

Hope this helps.

[Plotloss]

Dont Netgear make a dongle thing for VPN use? Like a hard client type affair.

Suprised you say that about Checkpoint Ex, thought they were the Cisco of firewalls.

[GreenV8S]

I have VPN into our corporate network, but I tend to use a remote desktop via a third party provider instead; the VPN effectively puts my home PC inside the corporate network which seems like a fundamentally unwise thing to do and is also a pita if I want to access anywhere else at the same time.

[slinky]

GreenV8S said:

I have VPN into our corporate network, but I tend to use a remote desktop via a third party provider instead; the VPN effectively puts my home PC inside the corporate network which seems like a fundamentally unwise thing to do and is also a pita if I want to access anywhere else at the same time.

Agreed, but this will be for use on company supplied laptops only...

Cheers for the advise so far folks, keep it coming!

slinky

[BliarOut]

Have a look at the Sonicwall stuff. Might do what you want.

[zumbruk]

GreenV8S said:

I have VPN into our corporate network, but I tend to use a remote desktop via a third party provider instead; the VPN effectively puts my home PC inside the corporate network which seems like a fundamentally unwise thing to do and is also a pita if I want to access anywhere else at the same time.

Using a third party is an even unwiser thing to do, believe me. I assume you're talking about GoToMyPC, btw?

Remote desktop solutions are an even bigger can of worms. I've played with NetOp, VNC, Microsoft's piece of junk (whatever that's called), some tunneled through SSH and some not. We presently use Citrix, although I've never used it because the Solaris client is a festering heap of cack.

[rednotdead]

Can recommend GnatBox - have a look at www.gta.com or www.gsec.co.uk (UK distributor). Firewall with useful VPN client. Used them for years with no probs.

You might be surprised at the cost too - I wouldn't say cheap, I'd rather say 'value for money'.

[ErnestM]

BliarOut said:

Have a look at the Sonicwall stuff. Might do what you want.

SonicWall is what we use and it has myriad configuration options. For instance, I use an additional (smaller) SonicWall hardware router at home but I have a small SonicWall "client" ap that I use on my laptop for travelling access. SonicWall doesn't care about static IPs on the incoming front. If you want to enable bi-directional tunnel creation, however, it is easier to have static ones.

If you need more info on specific hardware, I will be happy to give you some...

ErnestM

[slinky]

That would be great if you could Ernest...

Would you mind dropping me an email in the office?

wil dot perry at mfs dot misys dot co dot uk ...

cheers,

slinky

[BliarOut]

And don't forget the deep packet inspection!

[GreenV8S]

zumbruk said:

Using a third party is an even unwiser thing to do, believe me. I assume you're talking about GoToMyPC, btw?

I believe you, but why is it unwiser (is that a word?)?

[billb]

www.appgate.com/

u can either download a java applet or just bung on some client software to set up the secure link in..

[nickjm]

Not thought of a Cisco Router in your office? The home users can then have the Cisco VPN Client on their PC's at home.

I use it at home to connect into work, using Windows authentication on our domain, works like a treat, if you can afford to spend that much on the router, that is.

[_dobbo_]

having just spent all day trying to work out why the hell a checkpoint firewall can initiate a VPN with us, but we can't initiate one with them, USING THE SAME BASTARD SETTINGS, vpn is now a curseword around these parts.

"Payload Malformed"? Say what? Hitting it with an axe might help.

[off_again]

_dobbo_ said:

having just spent all day trying to work out why the hell a checkpoint firewall can initiate a VPN with us, but we can't initiate one with them, USING THE SAME BASTARD SETTINGS, vpn is now a curseword around these parts. "Payload Malformed"? Say what? Hitting it with an axe might help.

As the Excession put it - its the bane of many peoples lives..... and trust me (having been on the receiving end of many a Check Point problem), it doesnt get any better.

Rest assured though - there are plenty other people out there in exactly the same situation - you certainly arent alone!

[_dobbo_]

off_again said:

Rest assured though - there are plenty other people out there in exactly the same situation - you certainly arent alone!

Not sure if that makes me feel any better!

Today I have to do the age old dance where I blame the other company's firewall, and they blame ours.

[zumbruk]

GreenV8S said:

zumbruk said: Using a third party is an even unwiser thing to do, believe me. I assume you're talking about GoToMyPC, btw? I believe you, but why is it unwiser (is that a word?)?

You trust a third party enough to let them capture every single keystroke?

[BliarOut]

_dobbo_ said:

having just spent all day trying to work out why the hell a checkpoint firewall can initiate a VPN with us, but we can't initiate one with them, USING THE SAME BASTARD SETTINGS, vpn is now a curseword around these parts. "Payload Malformed"? Say what? Hitting it with an axe might help.

check if the IKE algorithms are the same on each side of the VPN tunnel