A small, cheap VPN

By Ron Nutter
Network World Fusion, 07/02/01

Any idea on where I could find some leads on implementing a cheap VPN solution for a small business (10 workstations) running on a Windows NT 4.0 network with a Linksys DSL/Cable router that handles both NAT and DHCP for the network? The VPN client computers will be accessing via cable modem. When I say cheap I mean less than $900. Is there something out there like that? Hardware or software?
-- Neraj Tuli

You might have to raise your $900 figure a little bit to get the VPN functionality you are looking for, because it's beyond what the Linksys DSL/Cable router can do. I am familiar with two different approaches of providing remote access via VPN - one using Novell's Border Manager (a software solution) and the other using Nortel's Contivity VPN hardware.

In either case, you'll need to replace your Linksys router. Both of the options will provide the firewall function. The thing that you should be most concerned about is the level of encryption that you can get so that any remote access to your network. The higher the level of encryption, the more difficult that it will be to "snoop" into the traffic going to and from your network.

In the U.S., you'll be able to use 128-bit encryption. Overseas encryption levels may be limited to 56 bit depending on what a particular country allows.

The Nortel solution will require, at a minimum, the Contivity 600 so you can handle the remote tunnels from external users coming in. You will have the option of running either the Nortel Contivity client software at the worsktation or a Contivity 100 or 400 for those users who will be working from another fixed location. This will give them the ability of having a direct encrypted connection to the network at your office as well as being able to surf the Internet without requiring any changes at the remote workstation.

The Novell solution will require the use of remote client software at the workstations that are not on your office network or a smaller Border Manager server at the remote location to provide the site to site VPN functions.