Re: Static Routes in VPN

From: Javier Gomez [SBS MVP] (javier_gomez_at_remove.this.engineer.com)
Date: 05/27/04 

Date: Thu, 27 May 2004 08:24:20 -0400

Hi Mark!

If you ask me... I wouldn't install ISA on the 2nd office and simply do the
same setup as the other post (ISA is kind-of expensive). However, if you
really want to use ISA there are several excellent articles in isaserver.org
dealing with a site-to-site vpn between 2 ISA boxes.

What is the purpose of the remote server? File/print server? Strickly
speaking you don't need a 2nd server at all for doing what you want...
however, having another server might be useful for storing files, ect. that
don't need to travel over the VPN. Also, a 2nd DC might prove useful if the
internet is down (but if everything that you need is at the 1st site then
this doesn't help you at all). Finally, you need to consider a that normal
broadband connection (thus the VPN link) are not usually very fast... so
what exactly the users need to access in the 1st office? Mail? Files? a
database? How many users are we talking about? What kind of connection you
have in each site?

I'm giving you some questions for you to think about... I'm sure you have
considered most of them, but it never hurts to put them in black and
white.:-)

What you want to do is certainly possible... is just a matter of what is the
best and most reliable way to acomplish it.

Cheers, 

-- 
Javier [SBS MVP]
<< SBS ROCKS !!! >>
"Mark" <anonymous@discussions.microsoft.com> wrote in message
news:136ad01c443c1$5cd887a0$a101280a@phx.gbl...
> The setup at the minute is there is no setup!
>
> I have looked at that thread and the diagram that he has
> done is pretty much what I would like to do.  I need the
> users at the remote site to be able to access everything
> at the main site and for users at the main site to be
> able to take there laptops to the second site and connect
> as normal.
>
> I did some reading last night and I think the way forward
> is to connect the two offices using ISA server VPN.
> So at the second office I would have
>
> Internet
>     |
> ISA Server
>     |
>    Hub
>     |
> Workstations
>
> I think I will have to install the ISA server at the
> second site and after going through the ISA VPN wizard,
> join it to the main domain.  Will I need a DC at the
> second site or will it use the main one through the link?
>
> Then once this is all set up (and I am very old ;) ) a
> user from the main site should be able to take their
> laptop to the second site and connect as normal?!?
>
> Thanks for all your help Javier, your helping to keep me
> sane!
>
> Mark
>
> >-----Original Message-----
> >No need for apologies... I'm half asleep today, so I'm
> dumber than the usual
> >:-)
> >
> >I was kind of confused with your setup... I was thinking
> something among the
> >lines of this post:
> >http://groups.google.com/groups?hl=en&lr=&ie=UTF-
> 8&c2coff=1&selm=2eac5d02.0405131207.6d547a8d%
> 40posting.google.com
> >
> >But, the part I'm missing here is how is 2nd office
> connected to the 1st
> >one. What is the layout in the 2nd office? You connect
> the server directly
> >to the SBS box (via VPN)?
> >
> >2nd Office
> >
> >      Internet
> >         |
> >       Server
> >         |
> >     Hub/Switch
> >         |
> >     Workstations
> >
> >or maybe:
> >
> >     Internet
> >         |
> >  Firewall/Router
> >         |
> >    Switch/Hub
> >          |
> >-----------------
> >|                        |
> >Server        Workstations
> >
> >-- 
> >Javier [SBS MVP]
> >
> ><< SBS ROCKS !!! >>
> >
> >"Mark" <anonymous@discussions.microsoft.com> wrote in
> message
> >news:12c7201c44344$3e5b1450$a301280a@phx.gbl...
> >> OK sorry to confuse you, im confused enough already!
> >>
> >> What we have at present is a main office with sbs2k.
> We
> >> also have a second site that at present has no IT
> >> installed.  What I would like to do is connect the two
> >> sites so that a user from the main office could go to
> the
> >> second office and plug in there laptop and work as
> >> normal.  If thats possible?
> >>
> >> I was planning on placing a server at the second office
> >> with just DHCP and RRAS installed, no DC, and getting
> the
> >> two servers to talk through RRAS which I have acheived.
> >>
> >> Maybe this is the incorrect way of doing this as I have
> >> never done it before.  If you know how it should be
> done,
> >> please let me know as I have no other ideas!
> >>
> >> thanks
> >>
> >> Mark
> >>>-----Original Message-----
> >>>I'm having some trouble understanding your setup. Maybe
> >> a little diagram
> >>>would help.
> >>>
> >>>If you are doing VPN server-2-server... could you check
> >> that the PC has the
> >>>remote server is acting as the gateway?
> >>>
> >>>-- 
> >>>Javier [SBS MVP]
> >>>
> >>><< SBS ROCKS !!! >>
> >>>
> >>>"Mark" <anonymous@discussions.microsoft.com> wrote in
> >> message
> >>>news:12e1901c44329$ef6a0780$a101280a@phx.gbl...
> >>>> Javier
> >>>>
> >>>> I have since entered the static routes with a subnet
> >> mask
> >>>> of 255.255.255.255 whcih appears to work.  I can now
> >> ping
> >>>> each server from the other but I am unable to plug a
> PC
> >>>> configured for the main office into the remote office
> >> hub
> >>>> and connect to the network.  What have I missed!?!?
> >>>>
> >>>> Mark
> >>>>
> >>>>
> >>>>>-----Original Message-----
> >>>>>Ok Javier
> >>>>>
> >>>>>The main office server is 192.168.100.1,
> 255.255.255.0
> >>>>>and the remote office is 172.10.0.1, 255.255.0.0
> >>>>>
> >>>>>I'm just starting to set this up, the remote office
> has
> >>>>>had nothing in it until now.
> >>>>>Maybe you could answer a couple of other questions?
> >>>>>
> >>>>>The server for the remote office, what does it have
> to
> >>>>>have installed on it? At present it has DHCP and RRAS
> >>>> but
> >>>>>nothing else. It is Server 2003. Does it need to be a
> >>>>>DC?  Do I have to import it into the main domain?
> >>>>>At the minute it's just a standalone machine.  I plan
> >> on
> >>>>>installing ISA at some point as the firewall.
> >>>>>
> >>>>>I got the two connected using 0.0.0.0 as the static
> >>>> route
> >>>>>but this stopped us being able to browse at the main
> >>>> site?
> >>>>>
> >>>>>All I want this server at the remote office to do is
> to
> >>>>>act as a VPN connection to the main office so that
> if a
> >>>>>mobile user goes to the remote location, they can
> plug
> >>>>>there laptop in and access the network as if they
> were
> >>>> at
> >>>>>the main office.
> >>>>>I hope you can help Javier and thanks
> >>>>>
> >>>>>Mark
> >>>>>>-----Original Message-----
> >>>>>>Give us the whole stuff IP/masks of both servers and
> >>>>>router (VPN).
> >>>>>>
> >>>>>>-- 
> >>>>>>Javier [SBS MVP]
> >>>>>>
> >>>>>><< SBS ROCKS !!! >>
> >>>>>>
> >>>>>>"Mark" <anonymous@discussions.microsoft.com> wrote
> in
> >>>>>message
> >>>>>>news:128ad01c44310$21a70c30$a401280a@phx.gbl...
> >>>>>>> Hi all
> >>>>>>>
> >>>>>>> I am trying to add a static route on a vpn so that
> >> the
> >>>>>>> two servers will talk nicely to each other but
> when
> >> i
> >>>>>tey
> >>>>>>> and enter the static ip, i get an error
> >>>>>>>
> >>>>>>> The Network mask entered is not valid.
> >>>>>>> The destination address cannot be more specfic
> than
> >>>> the
> >>>>>>> network mask.
> >>>>>>>
> >>>>>>> The IP i am entering is 192.168.100.1 and the
> >> network
> >>>>>>> mask is 255.255.255.0
> >>>>>>> That is what my lan NIC is set at so why does it
> not
> >>>>>work?
> >>>>>>>
> >>>>>>> Please help, I'm having a bad enough day as it
> is!!!
> >>>>>>>
> >>>>>>> thanks
> >>>>>>> Mark
> >>>>>>
> >>>>>>
> >>>>>>.
> >>>>>>
> >>>>>.
> >>>>>
> >>>
> >>>
> >>>.
> >>>
> >
> >
> >.
> >

Relevant Pages

  • PIX501 ISA SBS2003 Network Setup Thoughts
    ... This was the setup I was handed. ... ports pointing to 3 windows 2000 server boxes and 1 pointing to the SBS ... install ISA set it as the default gateway and leave it be, however, by ...
    (microsoft.public.windows.server.sbs)
  • Re: Static Routes in VPN
    ... works but if I didn't install ISA at the second site, ... >same setup as the other post (ISA is kind-of expensive). ... >What is the purpose of the remote server? ... >broadband connection are not usually ...
    (microsoft.public.backoffice.smallbiz2000)
  • Re: HTTP trouble in 2004
    ... > understand is why can't I ping the public address of the DC. ... >> separating the DC role from the ISA Server role. ... >>>I appear to be an ISA dummy and have a small problem. ... My nics are setup with teh DC being the DNS server and my IE ...
    (microsoft.public.isaserver)
  • Re: Help with SBS2003 New installation and networking
    ... My modem does not have a setup option to allow forwarding of ip addresses. ... And I haven't been able to get ISA setup properly. ... internal private IP in Small Business Server 2003? ...
    (microsoft.public.windows.server.sbs)
  • Re: Wrong Logonserver users getting second site:
    ... people working when the wrong server was being used for authentication. ... second site for authentication, How can i test this and what could be ... run Dcdiag no errors, Sites & services is setup ...
    (microsoft.public.windows.server.active_directory)