I will be setting up two remote offices to connect to our main office. I will be configuring each branch office router to run a site-to-site VPN to the main office.
I want to have individual users authenticate themselves with our ACS server at the main site. I have looked into Auth Proxy and it seems like the way to go. I have a few questions though...
Do I enable Auth Proxy on the branch router or on the main office router?
I know the VPN tunnel will only be created after interesting traffic comes through.... If I turn on Aut Proxy on the main router, will the auth proxy requests from the branch office user initiate the tunnel? If I turn it on the branch router, will the auth proxy traffic to the ACS server from the branch office activate the tunnel? also, will it time out before the tunnel gets up?
It seems like the smart place to put the Auth Proxy would be the main site router. It would be easier to control/configure/maintain.
Is there a design guide to using Auth Proxy for remote offices?
Are there any gotchas?
