Recommendations for VPN

I'm looking for recommendations for VPN hardware to connect 4 small branch
locations to our main office. We currently run SBS2000 and we have set up
for occasional VPN connections (not permanent or full-time, but just
conneccted when needed). We're in the process of upgrading to SBS2003 this
summer, and then hopefully SBS2008 when it's out.

Can you point me to hardware needed on both SBS end and the 4 remote
locations which will allow a full time VPN connection, so, for example we
can back-up the remote locations at night to the main SBS location.

Also, am I correct in assuming that we will need dedicated IP addresses for
the 4 remote locations.

Thanks in advance.

Matabra
Wed Aug 13 06:29:04 PDT 2008

Hi,

Yes you will need dedicated IP addresses (whilst not strictly true, it will
make life easier)

If you are upgrading, Definitely get SBS2003 on VL with SA so you get a free
upgrade to 2008

Personally i recommend Draytek Vigors. Brilliant little devices, ~£100 each,
simple set up, reliable connections. We run DPM for 20 clients, all though
vigors.

Regards,

Matt

"Gary S" <garysmith@deletethis.cummingsandsmith.com> wrote in message
news:OF3nBPU$IHA.2244@TK2MSFTNGP05.phx.gbl...
> I'm looking for recommendations for VPN hardware to connect 4 small branch
> locations to our main office. We currently run SBS2000 and we have set up
> for occasional VPN connections (not permanent or full-time, but just
> conneccted when needed). We're in the process of upgrading to SBS2003 this
> summer, and then hopefully SBS2008 when it's out.
>
> Can you point me to hardware needed on both SBS end and the 4 remote
> locations which will allow a full time VPN connection, so, for example we
> can back-up the remote locations at night to the main SBS location.
>
> Also, am I correct in assuming that we will need dedicated IP addresses
> for the 4 remote locations.
>
> Thanks in advance.
>

James
Wed Aug 13 07:00:26 PDT 2008

I also use Draytek Vigors. Work very nicely to provide site-to-site VPN.

Matabra wrote:
> Hi,
>
> Yes you will need dedicated IP addresses (whilst not strictly true, it
> will make life easier)
>
> If you are upgrading, Definitely get SBS2003 on VL with SA so you get a
> free upgrade to 2008
>
> Personally i recommend Draytek Vigors. Brilliant little devices, ~£100
> each, simple set up, reliable connections. We run DPM for 20 clients,
> all though vigors.
>
> Regards,
>
> Matt
>
> "Gary S" <garysmith@deletethis.cummingsandsmith.com> wrote in message
> news:OF3nBPU$IHA.2244@TK2MSFTNGP05.phx.gbl...
>> I'm looking for recommendations for VPN hardware to connect 4 small
>> branch locations to our main office. We currently run SBS2000 and we
>> have set up for occasional VPN connections (not permanent or
>> full-time, but just conneccted when needed). We're in the process of
>> upgrading to SBS2003 this summer, and then hopefully SBS2008 when it's
>> out.
>>
>> Can you point me to hardware needed on both SBS end and the 4 remote
>> locations which will allow a full time VPN connection, so, for example
>> we can back-up the remote locations at night to the main SBS location.
>>
>> Also, am I correct in assuming that we will need dedicated IP
>> addresses for the 4 remote locations.
>>
>> Thanks in advance.
>>

Dave
Wed Aug 13 08:48:51 PDT 2008

Matt, you've got 20 clients backing up to your server(s) remotely using DPM?
I'd love to hear a quick run-down on the configuration if you've got a
second. Are you doing something onsite for the initial backup (wondering
how you'd get the first full backup over the wire in a reasonable amount of
time)?


"Matabra" <Matabra@hotmail.NOSPAM.co.uk> wrote in message
news:%23Sl9PiU$IHA.3392@TK2MSFTNGP03.phx.gbl...
> Hi,
>
> Yes you will need dedicated IP addresses (whilst not strictly true, it
> will make life easier)
>
> If you are upgrading, Definitely get SBS2003 on VL with SA so you get a
> free upgrade to 2008
>
> Personally i recommend Draytek Vigors. Brilliant little devices, ~£100
> each, simple set up, reliable connections. We run DPM for 20 clients, all
> though vigors.
>
> Regards,
>
> Matt
>
> "Gary S" <garysmith@deletethis.cummingsandsmith.com> wrote in message
> news:OF3nBPU$IHA.2244@TK2MSFTNGP05.phx.gbl...
>> I'm looking for recommendations for VPN hardware to connect 4 small
>> branch locations to our main office. We currently run SBS2000 and we have
>> set up for occasional VPN connections (not permanent or full-time, but
>> just conneccted when needed). We're in the process of upgrading to
>> SBS2003 this summer, and then hopefully SBS2008 when it's out.
>>
>> Can you point me to hardware needed on both SBS end and the 4 remote
>> locations which will allow a full time VPN connection, so, for example we
>> can back-up the remote locations at night to the main SBS location.
>>
>> Also, am I correct in assuming that we will need dedicated IP addresses
>> for the 4 remote locations.
>>
>> Thanks in advance.
>>

Matabra
Wed Aug 13 08:59:06 PDT 2008

Hi Dave,

Essentially we run an onsite Full backup, Take back to the office, Use that
to start the backups. Then we host a Virtualised DC for them here (just a
small 128mb ram box) as you need to have a domain to log into DPM!

After that, Deltas come down the wire and we go back onsite every 3 months
or so to get an ASR for bare metal recovery.

Works like a dream.

If you want something a bit more detailed as to how we do it email me @
matthew@nospam.matabra.com

Matt

"Dave Nickason [SBS MVP]" <gwdibble@NOSPAM.frontiernet.net> wrote in message
news:#xoJYwV$IHA.5336@TK2MSFTNGP04.phx.gbl...
> Matt, you've got 20 clients backing up to your server(s) remotely using
> DPM? I'd love to hear a quick run-down on the configuration if you've got
> a second. Are you doing something onsite for the initial backup
> (wondering how you'd get the first full backup over the wire in a
> reasonable amount of time)?
>
>
> "Matabra" <Matabra@hotmail.NOSPAM.co.uk> wrote in message
> news:%23Sl9PiU$IHA.3392@TK2MSFTNGP03.phx.gbl...
>> Hi,
>>
>> Yes you will need dedicated IP addresses (whilst not strictly true, it
>> will make life easier)
>>
>> If you are upgrading, Definitely get SBS2003 on VL with SA so you get a
>> free upgrade to 2008
>>
>> Personally i recommend Draytek Vigors. Brilliant little devices, ~£100
>> each, simple set up, reliable connections. We run DPM for 20 clients, all
>> though vigors.
>>
>> Regards,
>>
>> Matt
>>
>> "Gary S" <garysmith@deletethis.cummingsandsmith.com> wrote in message
>> news:OF3nBPU$IHA.2244@TK2MSFTNGP05.phx.gbl...
>>> I'm looking for recommendations for VPN hardware to connect 4 small
>>> branch locations to our main office. We currently run SBS2000 and we
>>> have set up for occasional VPN connections (not permanent or full-time,
>>> but just conneccted when needed). We're in the process of upgrading to
>>> SBS2003 this summer, and then hopefully SBS2008 when it's out.
>>>
>>> Can you point me to hardware needed on both SBS end and the 4 remote
>>> locations which will allow a full time VPN connection, so, for example
>>> we can back-up the remote locations at night to the main SBS location.
>>>
>>> Also, am I correct in assuming that we will need dedicated IP addresses
>>> for the 4 remote locations.
>>>
>>> Thanks in advance.
>>>
>

Leythos
Wed Aug 13 09:11:53 PDT 2008

In article <OF3nBPU$IHA.2244@TK2MSFTNGP05.phx.gbl>,
garysmith@deletethis.cummingsandsmith.com says...
> I'm looking for recommendations for VPN hardware to connect 4 small branch
> locations to our main office. We currently run SBS2000 and we have set up
> for occasional VPN connections (not permanent or full-time, but just
> conneccted when needed). We're in the process of upgrading to SBS2003 this
> summer, and then hopefully SBS2008 when it's out.
>
> Can you point me to hardware needed on both SBS end and the 4 remote
> locations which will allow a full time VPN connection, so, for example we
> can back-up the remote locations at night to the main SBS location.
>
> Also, am I correct in assuming that we will need dedicated IP addresses for
> the 4 remote locations.

WatchGuard X700e series firewall for the main office, then X20 units for
the branch office locations.

Fixed IP at each location unless you want to use DynDNS.org, but it's
normally a problem without fixed IP's.

You also need FAST connections in both U/D directions if you want to
share files.

--
- Igitur qui desiderat pacem, praeparet bellum.
- Calling an illegal alien an "undocumented worker" is like calling a
drug dealer an "unlicensed pharmacist"
spam999free@rrohio.com (remove 999 for proper email address)

Cliff
Wed Aug 13 14:09:35 PDT 2008

Most of your business-class firewall appliances will support site-to-site
VPNs, so it really depends on budget.

ISA is always a good option, but obviously getting an ISA server at each
location can get expensive. A cheaper alternative is to get a watchguard
core or peak for the main location and some watchguard edge devices for the
four remote branches.

In the case of both ISA and Watchguard, as long as your main location has a
static IP, the remote locations can be dynamic. The connection is initiated
by the remote location, so only the recipient end (the home office) needs to
be static for the remote locations to find it and establish a connection.

-Cliff

"Gary S" <garysmith@deletethis.cummingsandsmith.com> wrote in message
news:OF3nBPU$IHA.2244@TK2MSFTNGP05.phx.gbl...
> I'm looking for recommendations for VPN hardware to connect 4 small branch
> locations to our main office. We currently run SBS2000 and we have set up
> for occasional VPN connections (not permanent or full-time, but just
> conneccted when needed). We're in the process of upgrading to SBS2003 this
> summer, and then hopefully SBS2008 when it's out.
>
> Can you point me to hardware needed on both SBS end and the 4 remote
> locations which will allow a full time VPN connection, so, for example we
> can back-up the remote locations at night to the main SBS location.
>
> Also, am I correct in assuming that we will need dedicated IP addresses
> for the 4 remote locations.
>
> Thanks in advance.
>

Gary
Thu Aug 14 04:34:23 PDT 2008

thank you both for your suggestions, I'll look into them.

"James Hurrell" <j_a_hurrell@don't.send.me.spam.com> wrote in message
news:OFG$yzU$IHA.4616@TK2MSFTNGP06.phx.gbl...
>I also use Draytek Vigors. Work very nicely to provide site-to-site VPN.
>
> Matabra wrote:
>> Hi,
>>
>> Yes you will need dedicated IP addresses (whilst not strictly true, it
>> will make life easier)
>>
>> If you are upgrading, Definitely get SBS2003 on VL with SA so you get a
>> free upgrade to 2008
>>
>> Personally i recommend Draytek Vigors. Brilliant little devices, ~£100
>> each, simple set up, reliable connections. We run DPM for 20 clients, all
>> though vigors.
>>
>> Regards,
>>
>> Matt
>>
>> "Gary S" <garysmith@deletethis.cummingsandsmith.com> wrote in message
>> news:OF3nBPU$IHA.2244@TK2MSFTNGP05.phx.gbl...
>>> I'm looking for recommendations for VPN hardware to connect 4 small
>>> branch locations to our main office. We currently run SBS2000 and we
>>> have set up for occasional VPN connections (not permanent or full-time,
>>> but just conneccted when needed). We're in the process of upgrading to
>>> SBS2003 this summer, and then hopefully SBS2008 when it's out.
>>>
>>> Can you point me to hardware needed on both SBS end and the 4 remote
>>> locations which will allow a full time VPN connection, so, for example
>>> we can back-up the remote locations at night to the main SBS location.
>>>
>>> Also, am I correct in assuming that we will need dedicated IP addresses
>>> for the 4 remote locations.
>>>
>>> Thanks in advance.
>>>

Gary
Thu Aug 14 04:36:13 PDT 2008

Leythos, I looked briefly at the Watchguard products. Do you use them as
both a firewall and VPN appliance? Can we dispense with ISA on the SBS
server (I'm thinking here of the SBS2008 upgrade to come). Do you use the
Watchguard anti-virus as well, and if so, can this replace a server based
anti-virus such as Trend? Thanks in advance.

"Leythos" <void@nowhere.lan> wrote in message
news:1218651040_249580@news.usenet.com...
> In article <OF3nBPU$IHA.2244@TK2MSFTNGP05.phx.gbl>,
> garysmith@deletethis.cummingsandsmith.com says...
>> I'm looking for recommendations for VPN hardware to connect 4 small
>> branch
>> locations to our main office. We currently run SBS2000 and we have set up
>> for occasional VPN connections (not permanent or full-time, but just
>> conneccted when needed). We're in the process of upgrading to SBS2003
>> this
>> summer, and then hopefully SBS2008 when it's out.
>>
>> Can you point me to hardware needed on both SBS end and the 4 remote
>> locations which will allow a full time VPN connection, so, for example we
>> can back-up the remote locations at night to the main SBS location.
>>
>> Also, am I correct in assuming that we will need dedicated IP addresses
>> for
>> the 4 remote locations.
>
> WatchGuard X700e series firewall for the main office, then X20 units for
> the branch office locations.
>
> Fixed IP at each location unless you want to use DynDNS.org, but it's
> normally a problem without fixed IP's.
>
> You also need FAST connections in both U/D directions if you want to
> share files.
>
> --
> - Igitur qui desiderat pacem, praeparet bellum.
> - Calling an illegal alien an "undocumented worker" is like calling a
> drug dealer an "unlicensed pharmacist"
> spam999free@rrohio.com (remove 999 for proper email address)

Dave
Thu Aug 14 08:53:14 PDT 2008

Thanks. If I ever end up attempting this, I'll give you a shout. I'm a big
fan of DPM, and you're the first one I've heard of doing it to offsite.


"Matabra" <Matabra@hotmail.NOSPAM.co.uk> wrote in message
news:eC4aG2V$IHA.4380@TK2MSFTNGP02.phx.gbl...
> Hi Dave,
>
> Essentially we run an onsite Full backup, Take back to the office, Use
> that to start the backups. Then we host a Virtualised DC for them here
> (just a small 128mb ram box) as you need to have a domain to log into DPM!
>
> After that, Deltas come down the wire and we go back onsite every 3 months
> or so to get an ASR for bare metal recovery.
>
> Works like a dream.
>
> If you want something a bit more detailed as to how we do it email me @
> matthew@nospam.matabra.com
>
> Matt
>
> "Dave Nickason [SBS MVP]" <gwdibble@NOSPAM.frontiernet.net> wrote in
> message news:#xoJYwV$IHA.5336@TK2MSFTNGP04.phx.gbl...
>> Matt, you've got 20 clients backing up to your server(s) remotely using
>> DPM? I'd love to hear a quick run-down on the configuration if you've got
>> a second. Are you doing something onsite for the initial backup
>> (wondering how you'd get the first full backup over the wire in a
>> reasonable amount of time)?
>>
>>
>> "Matabra" <Matabra@hotmail.NOSPAM.co.uk> wrote in message
>> news:%23Sl9PiU$IHA.3392@TK2MSFTNGP03.phx.gbl...
>>> Hi,
>>>
>>> Yes you will need dedicated IP addresses (whilst not strictly true, it
>>> will make life easier)
>>>
>>> If you are upgrading, Definitely get SBS2003 on VL with SA so you get a
>>> free upgrade to 2008
>>>
>>> Personally i recommend Draytek Vigors. Brilliant little devices, ~£100
>>> each, simple set up, reliable connections. We run DPM for 20 clients,
>>> all though vigors.
>>>
>>> Regards,
>>>
>>> Matt
>>>
>>> "Gary S" <garysmith@deletethis.cummingsandsmith.com> wrote in message
>>> news:OF3nBPU$IHA.2244@TK2MSFTNGP05.phx.gbl...
>>>> I'm looking for recommendations for VPN hardware to connect 4 small
>>>> branch locations to our main office. We currently run SBS2000 and we
>>>> have set up for occasional VPN connections (not permanent or full-time,
>>>> but just conneccted when needed). We're in the process of upgrading to
>>>> SBS2003 this summer, and then hopefully SBS2008 when it's out.
>>>>
>>>> Can you point me to hardware needed on both SBS end and the 4 remote
>>>> locations which will allow a full time VPN connection, so, for example
>>>> we can back-up the remote locations at night to the main SBS location.
>>>>
>>>> Also, am I correct in assuming that we will need dedicated IP addresses
>>>> for the 4 remote locations.
>>>>
>>>> Thanks in advance.
>>>>
>>

Leythos
Thu Aug 14 15:44:32 PDT 2008

In article <#dEV3Hg$IHA.4616@TK2MSFTNGP06.phx.gbl>,
garysmith@deletethis.cummingsandsmith.com says...
>
> Leythos, I looked briefly at the Watchguard products. Do you use them as
> both a firewall and VPN appliance? Can we dispense with ISA on the SBS
> server (I'm thinking here of the SBS2008 upgrade to come). Do you use the
> Watchguard anti-virus as well, and if so, can this replace a server based
> anti-virus such as Trend? Thanks in advance.

We use them as the firewall (which they are) and as a Site-Site VPN
appliance, which they also include.

The UTM package, which includes AV, is NOT a substitute for local AV
scanning. The AV from the firewall supplements.

--
- Igitur qui desiderat pacem, praeparet bellum.
- Calling an illegal alien an "undocumented worker" is like calling a
drug dealer an "unlicensed pharmacist"
spam999free@rrohio.com (remove 999 for proper email address)