We would like to allow the remote computers to connect via VPN to the main office server, but are unsure about the best approach to take. Is it possible to use Win2K3 as a VPN server without converting to domain? What are the trade-offs between using W2K3 as a VPN server vs. adding a small VPN appliance?
We have a small peer-to-peer office network with a Windows 2003 server and 10 Windows XP workstations at the “central” office. This main office is connected to the Internet via a T-1 line split between voice and data (AdTran). We have one remote office running two computers – one XP and the other NT 4. These “remote” computers are connected to the Internet via broadband cable. We would like to allow the remote computers to connect via VPN to the main office server, but are unsure about the best approach to take. We understand that Win2K3 can support VPN by itself, but we do not have a PDC or BDC, certificate authority, etc., set up, and don’t really want the extra expense in converting to a domain from peer-to-peer (extra domain controllers, etc.). Is it possible to use Win2K3 as a VPN server without converting to domain? What are the trade-offs between using W2K3 as a VPN server (assuming that this is possible in a peer-to-peer scenario) vs. adding a small (4-or-so tunnels) VPN appliance? (I’m thinking a separate IP address passed straight through the AdTran 610 to the VPN appliance.)
Via the Internet
It is possible to use the Win2K3 server to support a VPN. You can either use a VPN client on each machine at the remote end or use a VPN-aware appliance to establish the connection and let the remote workstations pass thru to the W2K3 server over the VPN connection. One problem with using a VPN client on each of the remote workstations is you may run into software compatibility issues between the workstation and an application running on the workstation. I have run into this on a few occasions, and this isn’t the easiest thing to troubleshoot. Another thing to watch for is that some of the entry-level firewall devices have a problem handling more than one VPN tunnel/connection occurring at the same time. Also, if you go with using the W2K3 server to handle the VPN and it goes down, the remote workstations are not going to be able to talk to anything at the server end of the connection. To use this type of functionality, I expect you would need to put the server into domain mode.
Another option to consider is to using a VPN-aware appliance/firewall at each end of the connection. All you need is an IP address at each end of the connection. A static IP address will be the best, but there are other ways to handle this, depending on the VPN appliance option you choose. Using an appliance off-loads the VPN task from your server to a device that is functioning as a firewall for each location and also deals with the VPN link. There are several options with this approach – Cisco PIX 501, a Linksys VPN router and Multitech are just three. There are others out there, these are three that I have worked with. There are several open-source routers that can also provide this same solution. If you have a couple of spare PCs available, this could be a solution you could have up and running quickly. I think the latter approach will be easier in the long run both in terms of implementation and the ability to support just about any OS at either end without having to worry about it being supported by a software VPN client.
