Printable View
Anyone here have any recommendations for vpn setups? I've been reading up on a few cIPe, PPTP, SSH & SSL VPNS. What do you find is the best for a small sized network. The main traffic that will be passing on this vpn would be backups from one server to another server. Both servers are on two different networks, but are internet accessible.
Thanks,
PuRe
For the small size network VPN's I set up, I prefer a site-to-site hardware based VPN endpoint routers over a software-to-software VPN solution. Hardware based VPN's are faster, easier to maintain but may not have as many features. I usually use a AES 128bit key with perfect secrecy forwarding.
Setup parameters of the VPN, well, you can usually get advice from the software or hardware VPN manufacturer help/setup files.
As far as what ZT3000 said, I have good experience w/ this product...
... http://www.watchguard.com/products/soho.asp ...
this is not a plug, it's just my experience
Thanks for the reply guys. That firebox sure looks sweet, I've gotta say. But for the price, I'd probably be better off getting a SOHO (small office/home office) type Cisco router.
Thanks,
PuRe
You're going to run backups across the internet? Just curious of the amount of bandwidth you have at both locations and the amount of data you're going to be backing up. This fits the idea of an off-site backup, but it might be too much load for your pipes.
As far as VPN's go, if you're looking for an inexpensive device, I've used the Linksys VPN routers and they do a decent job for a hardware VPN. They're owned by cisco now which gives me a little bit of a fuzzy feeling, but they're still not 100% reliable and from time to time need to be power cycled to repair their confusion.
I am a new person. Any one say how to setup a VPN connection between two winxp terminals using IPSec. Please point any articles you found to be useful.
Where I work I'm pretty sure they run the backups across our WAN from one of our data centers to headquarters (where most of the servers reside). I think since its such a hefty push though they only run it on the weekends but I could be mistaken.Quote:
Originally posted here by zENGER
You're going to run backups across the internet? Just curious of the amount of bandwidth you have at both locations and the amount of data you're going to be backing up. This fits the idea of an off-site backup, but it might be too much load for your pipes.
Well, I'm planning on doing weekly backups. They'll all be tar'ed and gzip'ed. Both servers are directly connected at 100Mbps. Current activity on the server probably utilizes only 5% bandwidth at most, so it's not going to be a real issue at the moment. And in the future when bandwidth utilization does go up, I can always use traffic shapping to specify the amount of bandwidth i want to use for certain protocols or ports. So for example, what I may do, is limit the incomming bandwidth on the receiving server down to 1-2Mbps , so that it doesn't hurt the rest of the traffic on the sending server.
PuRe
Now you've lost me. Originally you said you had two servers on different networks that were internet accessable. Now you're saying they're directly connected with a 100Mbs connection? If they're directly connected you don't need a VPN.
I think what he meant by that is that his two network connections are 100Mbs that connect to the internet and through that they connect to each other (if that makes sense).Quote:
Originally posted here by zENGER
Now you've lost me. Originally you said you had two servers on different networks that were internet accessable. Now you're saying they're directly connected with a 100Mbs connection? If they're directly connected you don't need a VPN.
Yes, what CuseMMA said.
Both servers are directly connected to the internet at those speeds. Not physically connected or in physical proximity.
PuRe
Ok, maybe you misunderstood my question about your available bandwidth. You're machines are no doubt connected to a switch or some other network device at 100Mbs. The question I have for you about bandwidth is what is your bandwidth to the internet. This will be your bottleneck for throughput.
The servers I have are located in a Data Center. They're available through put is exactly what the network card they are using is.
They contain 10/100Mbps network cards, and they can utilize up to 100Mbps. The isn't any bottleneck issues. If anything, my bottleneck would be the effectiveness of my nic. The switch and routing equipment is all high end cisco equipment, operating at much higher speeds then my nic can put out, so there's not really any bandwidth issues right now.
Thank you,
Genesis F.
Ok, maybe I'm asking this in the wrong manor. What type of internet connection do you have? Cable? DSL? Frac-T? T-1? Frame relay? Something else?
Aye, just because you have a 10/100 NIC doesnt mean that your cable or T-1 line will give you 10/100 speed.
If they are on the same intranet then you will get the 100 speed and all is happy. Since it sounds like you will be going thru cable or a T-1 line, you are at the mercy of your provider.
If the computers are both in the same data center, then they are on the same intranet.
If the computers are in seperate data centers, then they are seperate intranets and once you have the VPN in place you can transfer data between the two servers, but the max speed will not be 10/100.. it will most likely be 900kbs - 1.3mbs depending on your connections to the internet at each location.
Unfortunatly, it will be based on the slowest link in the chain.
Plain English
Server 1=========Internet=======================Server 2
100Mbps=======VPN @ 100Mbps================100Mbps <<~~Represents speed
Datacenter 1=====Internet======================Datacenter 2 <<~~server locations
Thank you for that diagram Pure. The thing is that they're asking you what TYPE of connection you have between the two centers.
We know that locally you're at 100Mbps but as stated already you're limited by what's BETWEEN the endpoints. We've gotten really off-track with this discussion, btw.Quote:
Posted by zENGER
Cable? DSL? Frac-T? T-1? Frame relay? Something else?
I'm sorry we have gotten off track. Please visit fastservers.net for information on datacenter. The second datacenter is similarly connected.
++++++++++Back to VPN Discussion Please++++++++++++
If I wasn't going to implement a hardware based VPN, what software based VPN solution would you recommend for the setup so thoroughly described(lol).
PuRe
I don't really have any experience with VPNs so I can't give you a personal reccomendation but I did find this site that looks like it might be of good use to you:
http://vpnlabs.org/
Hope it helps!
I understand that the servers have a 10/100 network card...
but you are paying a 3rd party vendor for your internet connection. they are giving you a connection that has a finite speed. Who is your vendor? at what speed are you connecting? this is relevant.
using your diagram and adding points of reference
Server 1 == 10/100 -- internet company --- lots of hops -- internet company --- 10/100 == Server 2
Your VPN will never be 100Mbps, unless you are using the internet2 connections that some colleges have.
If you are not sure, contact your accounting department and ask them the name of the company that is paid to give you your internet at your place of business.
Your internet company provides you with bandwith. this is the amount of data that can be sent / received at any point in time usually represented in down / up (down TO you and up FROM you [example, some DSL will give you 1.5Mb/386kb which is 1.5Mb you can download from the internet but only 386kb with which you can SEND to another server - internet connection]).
We keep asking this information because if you have a T-1 line (highly recommended as it is usually has a static IP address) then you set it up one way, and if you have residental cable (usually has DHCP addresses) then you would need to set it up a different way.
Ok, I looked at the link you posted about "fastservers". Is this the location where you datacenter is collocated? If so, the listed text shows that the connection is dual OC-48's which each operate at 2.4gbs. This is much higher than your 100Mbs, which would answer my question. Is this a correct assumption?
If this is the case and your gear is collocated, you might have a problem getting a hardware VPN product into the mix. Software might end up being your only route. From the looks of things it looks like you don't own much of the infrastucture? Let us know how your stuff is currently configured.
Exactly. Which is the reason I was originally trying to look into a software based vpn. Because it's only going to be about once per week anyways, by only two servers.Quote:
Originally posted here by zENGER
Ok, I looked at the link you posted about "fastservers". Is this the location where you datacenter is collocated? If so, the listed text shows that the connection is dual OC-48's which each operate at 2.4gbs. This is much higher than your 100Mbs, which would answer my question. Is this a correct assumption?
If this is the case and your gear is collocated, you might have a problem getting a hardware VPN product into the mix. Software might end up being your only route. From the looks of things it looks like you don't own much of the infrastucture? Let us know how your stuff is currently configured.
A software based VPN recommendation would be nice.
PuRe
Your original post said you had a small network, which a network with an OC-48 would be by no means considered... small. Anywayz, if your only goal is to create a tunnel for backups, I suggest something like stunnel. This is a very lightweight app that can create a secure tunnel between two sites. Of course this is not exactly a VPN, as a VPN isn't port specific, but it will still serve your purpose.
What operating sistems are on those servers?
If you have w2k servers (or other MS servers) then you don't need extra software. You already have what you need for setting VPN between servers...
If this is a case, I would sugest L2TP with IPSec enabled, because it offers better encryption and security than PPTP...
I'm using CentOS and Red Hat Ent.
PuRe