Printable View
I have two small offices that I want to improve the security with a router and hardware firewall at both locations. I connect to the internet with DSL and use static IPs inside. I run 25 computers at each site. Currently I am using Linksys 4 port routers. I would also like the ability to use VPN to connect between the sites. Any help or advice is greatly appreciated. Thanks!
I have two small offices that I want to improve the security with a router and hardware firewall at both locations. I connect to the internet with DSL and use static IPs inside. I run 25 computers at each site. Currently I am using Linksys 4 port routers. I would also like the ability to use VPN to connect between the sites. Any help or advice is greatly appreciated. Thanks!
I just ordered our company a Cisco 831 Ethernet Router. Don't have it yet, but it looks cool. Either that, or I would go with a watchguard firewall.
Just depends on how much you are wanting to spend.
watchguard
link: http://www.cdw.com/shop/products/def...spx?EDC=415245Quote:
Firebox SOHO 6tc is a high performance end-point VPN and firewall solution for remote offices with mobile VPN users. Protects with stateful packet filtering, application level gateways, and optional web content filtering. Firebox SOHO 6tc includes a subscription to LiveSecurity® Service
and anti-virus protection.
75Mbps Packet Filter Throughput
20Mbps VPN (3DES) Throughput
6 - 10/100 Fast Ethernet ports
50 User License
Can handle up to 10
Mobile User Clients and 6 Branch office VPN Tunnels
Remote Management
Firebox SOHO 6|tc Features:
Comprehensive Security
Easy Setup and Management
Broadband Connection
Virus Protection
Scalable Platform
Cisco
link: http://www.cdw.com/shop/products/def...spx?EDC=449437Quote:
Features:
Stateful Inspection Firewall
Access Control Lists (ACLs),
Network Address Translation/Port Address Translation (NAT/PAT),
Lock-and-Key security, dynamic ACLs, and router and route authentication
Cisco Intrusion Detection System (IDS)
Hardware-accelerated IPSec 3DES encryption
Cisco Easy VPN Remote
URL Filtering with WebSENSE software and server*
IPSec NAT Transparency (NAT Traversal or NAT Aware IPSec)
PKI support with digital certificates
IP QoS-Low-latency queuing, Weighted Random Early Detection, committed access rate (CAR), Class-Based Traffic Shaping
Asynchronous Transfer Mode (ATM) QoS (for Cisco 837)-ATM Traffic UBR, VBRnrt, VBRrt, and CBR with per-VC queuing and traffic-shaping
High-performance encryption
IP Multicast technology
Cisco Router Web Setup Tool
Supported by Cisco VPN Solution Center, CiscoWorks VPN/Security Management Solution (VMS) and Cisco Secure Policy Manager
*Features targeted for future Cisco IOS Software Release
Default DRAM1 Memory 32MB
Maximum DRAM Memory 48MB
Default Flash1 Memory 12MB
Maximum Flash Memory 24MB
both of those are under $500
I just ordered our company a Cisco 831 Ethernet Router. Don't have it yet, but it looks cool. Either that, or I would go with a watchguard firewall.
Just depends on how much you are wanting to spend.
watchguard
link: http://www.cdw.com/shop/products/def...spx?EDC=415245Quote:
Firebox SOHO 6tc is a high performance end-point VPN and firewall solution for remote offices with mobile VPN users. Protects with stateful packet filtering, application level gateways, and optional web content filtering. Firebox SOHO 6tc includes a subscription to LiveSecurity® Service
and anti-virus protection.
75Mbps Packet Filter Throughput
20Mbps VPN (3DES) Throughput
6 - 10/100 Fast Ethernet ports
50 User License
Can handle up to 10
Mobile User Clients and 6 Branch office VPN Tunnels
Remote Management
Firebox SOHO 6|tc Features:
Comprehensive Security
Easy Setup and Management
Broadband Connection
Virus Protection
Scalable Platform
Cisco
link: http://www.cdw.com/shop/products/def...spx?EDC=449437Quote:
Features:
Stateful Inspection Firewall
Access Control Lists (ACLs),
Network Address Translation/Port Address Translation (NAT/PAT),
Lock-and-Key security, dynamic ACLs, and router and route authentication
Cisco Intrusion Detection System (IDS)
Hardware-accelerated IPSec 3DES encryption
Cisco Easy VPN Remote
URL Filtering with WebSENSE software and server*
IPSec NAT Transparency (NAT Traversal or NAT Aware IPSec)
PKI support with digital certificates
IP QoS-Low-latency queuing, Weighted Random Early Detection, committed access rate (CAR), Class-Based Traffic Shaping
Asynchronous Transfer Mode (ATM) QoS (for Cisco 837)-ATM Traffic UBR, VBRnrt, VBRrt, and CBR with per-VC queuing and traffic-shaping
High-performance encryption
IP Multicast technology
Cisco Router Web Setup Tool
Supported by Cisco VPN Solution Center, CiscoWorks VPN/Security Management Solution (VMS) and Cisco Secure Policy Manager
*Features targeted for future Cisco IOS Software Release
Default DRAM1 Memory 32MB
Maximum DRAM Memory 48MB
Default Flash1 Memory 12MB
Maximum Flash Memory 24MB
both of those are under $500
hi there pointman,
I'm a newbie on vpn but basically you can implement vpn using hardware or software. vpn can be via gateway-gateway vpn or client to gateway vpn.
Hardware.
- you have a firewall that supports vpn and do vpn gateway. e.g symantec firewall 200R
- you have a router that supports vpn and do vpn gateway. e.g Linksys BEFSX41
Software
- you can use a win2k server box running a RAS (remote access service) as a vpn gateway.
http://support.microsoft.com/default...Fwct110900.asp
- you can run a linux box as vpn gateway. (Done this personally ssl+pptp+redhat 7.3)
http://www.linuxjournal.com/article.php?sid=4772
http://www.poptop.org/
Both have it's pro and cons. Hope this help some.
--lara
hi there pointman,
I'm a newbie on vpn but basically you can implement vpn using hardware or software. vpn can be via gateway-gateway vpn or client to gateway vpn.
Hardware.
- you have a firewall that supports vpn and do vpn gateway. e.g symantec firewall 200R
- you have a router that supports vpn and do vpn gateway. e.g Linksys BEFSX41
Software
- you can use a win2k server box running a RAS (remote access service) as a vpn gateway.
http://support.microsoft.com/default...Fwct110900.asp
- you can run a linux box as vpn gateway. (Done this personally ssl+pptp+redhat 7.3)
http://www.linuxjournal.com/article.php?sid=4772
http://www.poptop.org/
Both have it's pro and cons. Hope this help some.
--lara
Thanks for the informative and quick replies you both have supplied. You have given two real alternatives and I intend to check into both. Again, Thanks!
Thanks for the informative and quick replies you both have supplied. You have given two real alternatives and I intend to check into both. Again, Thanks!
No problem.
If you have any more questions, just let us know.
No problem.
If you have any more questions, just let us know.
:)
Hi,
here's another link you might want to take a look at. I chose this product
for a class assignment, so I cannot give you a recommendation, but it seems to have
versatility and features redundancy as well.
http://www.linksys.com/products/prod...id=34&prid=589
The router comes in at under $250.- a piece, if you shop around. It fits in well
with xDSL. Best would be to use SDSL with a Service Level Agreement. Many
ISP's provide this service these days. The plans are flexible and inexpensive.
A 256K up/down service should put you in the $ 150.- monthly fee range,
but you may not even need that much bandwidth. You can always upgrade the service.
Some negative issues in comparison to traditional Frame Relay or ISDN may be that
you'll have to deal with possible oversubscription of the service, scheduled maintenance outages,
and last but not least, the exposure to the internet.
This raises the issue of hidden costs associated with maintaining a security policy
(ie. Updates, Wireless Access if installed, etc), AV software, tech support( configuration and maintenance).
But a gateway to gateway VPN config should be relatively easy to set up.
:)
Hi,
here's another link you might want to take a look at. I chose this product
for a class assignment, so I cannot give you a recommendation, but it seems to have
versatility and features redundancy as well.
http://www.linksys.com/products/prod...id=34&prid=589
The router comes in at under $250.- a piece, if you shop around. It fits in well
with xDSL. Best would be to use SDSL with a Service Level Agreement. Many
ISP's provide this service these days. The plans are flexible and inexpensive.
A 256K up/down service should put you in the $ 150.- monthly fee range,
but you may not even need that much bandwidth. You can always upgrade the service.
Some negative issues in comparison to traditional Frame Relay or ISDN may be that
you'll have to deal with possible oversubscription of the service, scheduled maintenance outages,
and last but not least, the exposure to the internet.
This raises the issue of hidden costs associated with maintaining a security policy
(ie. Updates, Wireless Access if installed, etc), AV software, tech support( configuration and maintenance).
But a gateway to gateway VPN config should be relatively easy to set up.
Thanks Bluthund, I didn't even know that linksys made routers other than the 59.99 home user type that I am using now.
Thanks Bluthund, I didn't even know that linksys made routers other than the 59.99 home user type that I am using now.
:)
You're welcome.
I made a mistake regarding my statement about 'oversubscription'.
It is usually Cable that has that problem. Anyway, I hope you come right
with your network.
:)
You're welcome.
I made a mistake regarding my statement about 'oversubscription'.
It is usually Cable that has that problem. Anyway, I hope you come right
with your network.
Some good suggestions. My feeling is that if you're going to take the hardware firewall route, then get a hardware firewall, like Cisco's PIX. The low-end one will probably work very well once you get it tweaked for your network.
Some good suggestions. My feeling is that if you're going to take the hardware firewall route, then get a hardware firewall, like Cisco's PIX. The low-end one will probably work very well once you get it tweaked for your network.
Yeah, the hardware firewall option is looking the best for me. I think it would have the less latency of all and if it ever fails, I can put an ACL on the router until I could replace the firewall unit. Again and again, Thanks to all for some of the best ideas.
Yeah, the hardware firewall option is looking the best for me. I think it would have the less latency of all and if it ever fails, I can put an ACL on the router until I could replace the firewall unit. Again and again, Thanks to all for some of the best ideas.