IPSec passthrough

[aldi]

How great is it on consumer-y ADSL routers in your experience? For the purposes of VPN'ing from an XP box over 'tinternet into a 2K/Citrix box... how does it handle multiple connections etc or am I better just getting a router that accepts VPN connections directly?

Cheers
Neil

[zumbruk]

aldi said:

How great is it on consumer-y ADSL routers in your experience? For the purposes of VPN'ing from an XP box over 'tinternet into a 2K/Citrix box... how does it handle multiple connections etc or am I better just getting a router that accepts VPN connections directly?

I have good news and bad news. The good news is that I have a SOHO ADSL router that works perfectly well with IPSec. The bad news is that it's a Cisco one and they're about £220.

[off_again]

As already mentioned, it can often be better to invest in the more expensive stuff for a business use.

That said, I have seen a couple of limitations:

1) Many dont support more than one IPSec tunnel passed through - hence only one PC behind it
2) Some dont like certain VPN clients - check on the support pages first (Netgear and Linksys are pretty good)
3) Some VPN clients dont give you much flexibility on passthrough - check functionality first

Basically, you need to try and match the client to the router and work from there. Most VPN clients do UDP encapsulation and this is fine, but some dont (rarer now so not too much of a problem). However, there is a standard for this but most dont meet it yet so it differs from client to client. Shouldnt cause a problem as I am at home behind a NetGear ADSL router using an IPSec client to my corporate network in Finland / USA - works a treat and only the fact that I have to use a flippin RSA token causes me grief.....

[deva link]

Not sure how relevant this is, but I use Netscreen Remote to VPN into our office. My employer officially doesn't support home routers, preferring everyone to connect using an ADSL modem.
However many staff use routers, of various main brands, and they work OK.

We did have a lot of probs with an earlier version of Netscreen Remote, which seemed to be NAT-Traversal related, and the only way I could get it to work on my SMC router was by using the DMZ, however since the Netscreen version upgrade it's been fine.

[bogie]

I use a Netgear one - works fine...most consumer ones support a maximum of 2 simultaneous tunnels - make sure you have your MTU size set correctly as if its too small it can cause problems

[aldi]

Hmm, thanks for the advice all, plenty to think about there.

I'm looking at swapping in a Vigor 2800 for the terminating end, (allthough the eicon shiva 500 looks nice too) and probably a netgear with IPSec passthrough for the originating end - if the router does passthrough then a client that does UDP encapsulation isn't required if I've understood correctly?

[UpTheIron]

aldi said:

How great is it on consumer-y ADSL routers in your experience? For the purposes of VPN'ing from an XP box over 'tinternet into a 2K/Citrix box... how does it handle multiple connections etc or am I better just getting a router that accepts VPN connections directly? Cheers Neil

Do I understand you correctly? Multiple users to connect to a Presentation Server (i.e. normal usage, opposed to you connecting for admin access). Take a look at Citrix Secure Gateway (or better still) Citrix Access Gateway. CSG is "free", but you need a Windows Server box to run it on, CAG is approx $2000 + $90/user. Both will be easier to live with (and therefore cheaper TCO) than a plethora of site-to-site VPNs.

[aldi]

UpTheIron said:

aldi said: How great is it on consumer-y ADSL routers in your experience? For the purposes of VPN'ing from an XP box over 'tinternet into a 2K/Citrix box... how does it handle multiple connections etc or am I better just getting a router that accepts VPN connections directly? Cheers Neil Do I understand you correctly? Multiple users to connect to a Presentation Server (i.e. normal usage, opposed to you connecting for admin access). Take a look at Citrix Secure Gateway (or better still) Citrix Access Gateway. CSG is "free", but you need a Windows Server box to run it on, CAG is approx $2000 + $90/user. Both will be easier to live with (and therefore cheaper TCO) than a plethora of site-to-site VPNs.

Yes thats about right, couple of remote offices and maybe us for admin. One office is allready on a leased line so would maybe look at replacing that too and saving some ££££. Reliability would be the question of questions though, and fatness of pipe for local print jobs. Will check out CSG, sounds interesting!