Site-to-Site VPN Connection

Forums › LAN (ethernet/Wifi/routers/Bluetooth) › Site-to-Site VPN Connection

CBSYS

129 posts

Master Geek

Topic # 175261 23-Jun-2015 12:54

Hi There,

I've got two offices A&B want to connect together via internet through VPN.

Office A, Orcon UFB with NetComm nf4v router.
Office B, Spark VDSL(moving to UFG in a few weeks) with Huawei HG659b router.

Is it possible to connect them together that we can share Diskstations as network drives and printers PBX phones etc.?

Thank you very much for your helps in advance.

1 | 2

1202 posts

Uber Geek
+1 received by user: 133

Reply # 1329866 23-Jun-2015 13:19

Don't know about those routers but even if they could create a tunnel you really need a router that's capable of hardware acceleration to get the best speeds and QOS for your VoIP phones.

cisconz

cisconz
1153 posts

Uber Geek
+1 received by user: 76

Trusted

Subscriber

Reply # 1329883 23-Jun-2015 13:42

One person supports this post

I would not be using ISP supplied routers for VPN connections.
1 reason for this is that I have seen them have their configurations reset on multiple occasions when the ISP makes a changer on their end.
Secondly, you would be far better to have 1 ISP in both locations to ensure your VPN traffic is staying within 1 core network and not relying on ISP - ISP transit links.

Hmmmm

pdath

251 posts

Ultimate Geek
+1 received by user: 110

Reply # 1329918 23-Jun-2015 14:22

One person supports this post

A pair of Cisco 897's will do this job very nicely. Here is a tool to build the config's for them.
http://www.ifm.net.nz/cookbooks/890-isr-wizard.html

Try my latest project, a Cisco type 5 enable secret password cracker written in javascript!

wasabi2k

2090 posts

Uber Geek
+1 received by user: 848

Reply # 1329920 23-Jun-2015 14:30

pdath: A pair of Cisco 897's will do this job very nicely. Here is a tool to build the config's for them.
http://www.ifm.net.nz/cookbooks/890-isr-wizard.html

What sort of throughput would you seen on that?

An 887VA struggled just routing and NAT on a 100Mbps UFB connection.

nitrotech

1202 posts

Uber Geek
+1 received by user: 133

Reply # 1330010 23-Jun-2015 15:52

2 people support this post

Cheapest with hardware acc is Edge Router Lite - if you're going to go down that path then get someone skilled in using the ERL to configure it.

In fact i'd recommend that you consult an expert to get a good scope of your project requirements because VPN done wrong will frustrate everyone working in the business.

CBSYS

129 posts

Master Geek

Reply # 1330027 23-Jun-2015 16:11

Thank you all for your replies!

Do I really need a pair of cisco c897s?
They seem quite expensive.

Is there any other alternative hardware I can choose, If I can not use ISP provided ones?

Aredwood

1561 posts

Uber Geek
+1 received by user: 464

Subscriber

Reply # 1330322 24-Jun-2015 00:29

CBSYS: Thank you all for your replies!

Do I really need a pair of cisco c897s?
They seem quite expensive.

Is there any other alternative hardware I can choose, If I can not use ISP provided ones?

The Ubiquity Edge router lite. As mentioned above.

I have one on my own connection. Works really well on UFB.

coffeebaron

4914 posts

Uber Geek
+1 received by user: 1953

Trusted

Subscriber

Reply # 1330332 24-Jun-2015 07:39

2 people support this post

I use Draytek 2800 series for site to site VPN

Chorus has spent $1.4 billion on making their xDSL broadband network faster. If your still stuck on ADSL or VDSL, why not spend from $150 on a master filter install to make sure you are getting the most out of your connection?
I install - Naked DSL, DSL Master Splitters, VoIP, data cabling and general computer support for home and small business.
Rural Broadband RBI installer for Ultimate Broadband and Full Flavour

Need help in Auckland, Waikato or BoP? Click my email button, or email me direct: [my user name] at geekzonemail dot com

chevrolux

2993 posts

Uber Geek
+1 received by user: 829

Subscriber

Reply # 1330335 24-Jun-2015 07:45

One person supports this post

Mikrotik rb2011. Fine for 100Mbps.
Set up an L2TP tunnel, encrypt with IPSec. Put in appropriate routes for each subnet. Done. Would take no more than half an hour to set up from scratch.

Edgerouter lite is an ok piece of kit but compared to a Mikrotik it's like comparing a corolla with a Ferrari.

pdath

251 posts

Ultimate Geek
+1 received by user: 110

Reply # 1330338 24-Jun-2015 07:46

wasabi2k:
pdath: A pair of Cisco 897's will do this job very nicely. Here is a tool to build the config's for them.
http://www.ifm.net.nz/cookbooks/890-isr-wizard.html

What sort of throughput would you seen on that?

An 887VA struggled just routing and NAT on a 100Mbps UFB connection.

An 887VA will do 50Mb/s to 70Mb/s. An 897 can flat line a 100Mb/s circuit with a little breathing room.

Try my latest project, a Cisco type 5 enable secret password cracker written in javascript!

nitrotech

1202 posts

Uber Geek
+1 received by user: 133

Reply # 1330367 24-Jun-2015 09:01

chevrolux: Mikrotik rb2011. Fine for 100Mbps.
Set up an L2TP tunnel, encrypt with IPSec. Put in appropriate routes for each subnet. Done. Would take no more than half an hour to set up from scratch.

Edgerouter lite is an ok piece of kit but compared to a Mikrotik it's like comparing a corolla with a Ferrari.

Are you using the 2011 for VPN in a production environment?

I can tell you that it can only pull 10mbps and at that puts the CPU at 100% and the router becomes unresponsive when transferring large files.

If the OP puts in a 2011 into each site and runs voip phone and NAS etc IMO is asking for trouble.

I agree that Mikrotik would be good but unless you put in an RB1100 you're not going to get VPN hardware acceleration and the link would be swamped causing unhappiness in the workplace.

chevrolux

2993 posts

Uber Geek
+1 received by user: 829

Subscriber

Reply # 1330433 24-Jun-2015 09:54

nitrotech:
chevrolux: Mikrotik rb2011. Fine for 100Mbps.
Set up an L2TP tunnel, encrypt with IPSec. Put in appropriate routes for each subnet. Done. Would take no more than half an hour to set up from scratch.

Edgerouter lite is an ok piece of kit but compared to a Mikrotik it's like comparing a corolla with a Ferrari.

Are you using the 2011 for VPN in a production environment?

I can tell you that it can only pull 10mbps and at that puts the CPU at 100% and the router becomes unresponsive when transferring large files.

If the OP puts in a 2011 into each site and runs voip phone and NAS etc IMO is asking for trouble.

I agree that Mikrotik would be good but unless you put in an RB1100 you're not going to get VPN hardware acceleration and the link would be swamped causing unhappiness in the workplace.

Actually yea that's a good point. More referring to PPPoE throughput. And you are right, with IPSec they seem to top out around 10-12Mbps.

So instead of the 2011 perhaps the 850Gx2?

nitrotech

1202 posts

Uber Geek
+1 received by user: 133

Reply # 1330458 24-Jun-2015 10:09

chevrolux:
nitrotech:
chevrolux: Mikrotik rb2011. Fine for 100Mbps.
Set up an L2TP tunnel, encrypt with IPSec. Put in appropriate routes for each subnet. Done. Would take no more than half an hour to set up from scratch.

Edgerouter lite is an ok piece of kit but compared to a Mikrotik it's like comparing a corolla with a Ferrari.

Are you using the 2011 for VPN in a production environment?

I can tell you that it can only pull 10mbps and at that puts the CPU at 100% and the router becomes unresponsive when transferring large files.

If the OP puts in a 2011 into each site and runs voip phone and NAS etc IMO is asking for trouble.

I agree that Mikrotik would be good but unless you put in an RB1100 you're not going to get VPN hardware acceleration and the link would be swamped causing unhappiness in the workplace.

Actually yea that's a good point. More referring to PPPoE throughput. And you are right, with IPSec they seem to top out around 10-12Mbps.

So instead of the 2011 perhaps the 850Gx2?

No hardware acceleration on the 850 until V2 is released and this could be some time away.

Zeon

3347 posts

Uber Geek
+1 received by user: 359

Trusted

Reply # 1330460 24-Jun-2015 10:11

One person supports this post

You could go PFsense and build your own. A pre-built device is probably easier in which case look at Mikrotik or maybe Ubiquiti?

BTW thinking of something as "expensive" can actually cost you more in the long run. Investing up front for a more reliable service is usually good business sense.

cisconz

cisconz
1153 posts

Uber Geek
+1 received by user: 76

Trusted

Subscriber

Reply # 1330487 24-Jun-2015 10:41

The other option would be to outsource it to someone like Mako Networks. They provide a managed firewall service with 2 click VPN's

Hmmmm

1 | 2