Best VPN design solution for central/branch offices

[spejic]

Hello all,

I would like your input on designing a VPN solution given the following:

Right now, the customer has a single office. I will be setting up a Cisco 1811w for them, and its main functions will be wireless access, firewall with CBAC, and EZVPN server.

The EZVPN server function will be implemented so that employees with laptops can work from home.

In the near future, there will be around 4 branch offices in operation.

Static IP is available for the main office, but I am unsure if static IPs will be available for the branch offices once they are established (there's 50-50 chance).

There will be one Active Directory server at the central location and it will have to be accessed from the branch offices.

My question is - given the uncertainty of the branch offices having static IPs - what is the best way to implement VPN to connect them to the branch office?

Each branch office will have a Cisco 831 installed.

Is EZVPN a viable solution given the above requirements?

Is it possible to set up the 831s as EZVPN clients without XAUTH, while still maintaining XAUTH for the employees using EZVPN clients?

If this is not going to work, then XAUTH might have to go.

Or, given the situation, would you opt for DMVPN... Unfortunately I don't know too much about that technology for now.. What are the advantages / disadvantages of using it, if it is an appropriate solution for this scenario?

Thank you all in advance for your input!

Sean

[m.sir]

Not sure about XAUTH vs. without XAUTH EZVPN. But I have used TED for similiar scenarion

check this link

http://www.cisco.com/en/US/products/sw/iosswrel/ps1830/products_feature_guide09186a0080087a9a.html

[Fernando_Meza]

Hi .. I am sure VPN server /client is the way to go. Xauth / No Xauth can be accomplished by creating two VPN groups (profiles) one without Xauth (for the spokes routers ... even thought you can also use Xauth as well ) and one with Xauth for the remote users.

DMVPN is useful when you require direct communication between the spokes without having to traverse the Hub site. It uses protocol named NHRP ( next hope routing protocol ) to DYNAMICALLY create the tunnels between spokes automatically and on demand traffic.

I hope it helps .. please rate it if it does !!!

[spejic]

Hi, thank you all for your replies.

I just finished my preliminary testing in my testlab - EZVPN server/client solution works great.

The only thing that I would still like to accomplish is being able to ping machines in the "remote office"

(I can connect to the server, which is behind the Cisco 1811w acting as an EZVPN server, but not from the server to the client machine, which is behind a Cisco 831, acting as an EZVPN client). The client machine is not firewalled or anything (neither is the 831). Please let me know how I could accomplish this. Thanks in advance!!

[Fernando_Meza]

Hi .. if you do tracert from the server to the clients behind the 831 how far does it go ..? You might need to specifically allow this on your 1811 router

[rkazmierczak · Accepted solution]

I think you need to use a network extension mode (configured in the vpngroup) instead of client mode. Just make sure that each branch office uses a different and not overlapping address space.

[spejic]

Thanks everyone for helping me out!!

[arisaperstein]

I just put in a DMVPN for a customer with 10 remote sites and two hub sites in different locations. The remote sites are 871's and the hubs are 1841's. We used a LAN-to-LAN VPN to tie the two hubs together. One of the spoke 871's is also running as an EZVPN server. With the exception of having IOS code issues, the DMVPN is very stable. The nice thing is that as they add sites, all we have to do is add the config for DMVPN to the new spoke and it will participate in the DMVPN. NATting was challenging but all in all, it is a great solution.