Best way to connect two small office locations

[Wolfi]

Hi Guys,

I would like to connect two small office locations (A and B) with 5-5 users and I would like to set up some kind of VPN solution between these sites. Is it possible these sites to have separate internet access? So I wouldn't like e.g. tunneling A's internet traffic to B, then to internet.

I just want to reach A's resources from B and vica versa, but internet breakouts should be on A and B site also.

What kind of hardware and technology do you recommend to build that topology?

I think about IPSec over GRE, but I don't know which hardware is suitable for this small business.

Thank you so much your opinion in advance!

[Joseph W. Doherty]

Much of Cisco's small ISRs would support both Internet access and a VPN tunnel between sites.

Which device to chose would much depends on how much bandwidth you have to the Internet.

You can share one link (per site) for both VPN and Internet, although your VPN can be setup to provide more predictable performance if you have separate VPN and Internet links at each site.

On the low bandwidth end, Cisco's 800 series could do both functions.

[Karsten Iwen]

I would take two Cisco Meraki MX64 into consideration. 

[Wolfi]

Thanks, I will definitely consider Meraki in the future, but now I don't need it, sorry.

[doodles6970]

You could use DMVPN.
Depending on your router hardware I would certainly recommend this solution. It’s easy to setup and easy to maintain and you can apply IPSEC to the tunnels

[doodles6970]

Article and setup guide for DMVPN

https://supportforums.cisco.com/t5/security-documents/dmvpn-with-configuration-example/ta-p/3145736

[Wolfi]

Thanks for your replies!

There is only one internet connection on both sites, so local internet breakout and VPN have to use the same WAN interface. Site A has 10/10 Mbps and B has 30/30 Mbps internet connection.

I though that Cisco RV042G could do the necessary functions (NAT, IPsec site-to-site tunnel, some QoS). It doesn't have DMVPN, but cheaper than 800 series.

What's your opinion?

[doodles6970 · Accepted solution]

I would always suggest go with what ever makes your life easier. In my opinion I would always go with something that’s a bit more future proof, something like the 800 Or a ISR 1000. I think having DMVPN would make your life a lot easier. Plus if you ever get any remote sites / home workers you would have the Infrastructure to support it already.
Ryan