Site to Site VPN while keeping ISA in the Mix

Javier — Thu, 09 Dec 2004 04:04:00 GMT

If you have a remote office or a branch it might be a good idea to have those users connected to your primary office permanently. You could even have an additional domain controller on the remote site or even make the users login via a Terminal Server on your primary location. To connect the two locations together you have a couple of options:

Connect each computer individually using PPTP VPN to the SBS box directly.
Use a PPTP VPN-capable router on the remote site and establish the VPN directly to the SBS box.
Use 2 VPN routers (IPSec) to establish a site to site VPN.

Option #3 is fairly common. However, this method presents a problem when you want to keep using ISA. You cannot put the router in front of ISA anymore because you will terminate the VPN tunnel there and your users will not be able to access the resources in the LAN. So, what can you do? Well, there are a couple of ways to go around this problem… I will discuss one way:

You will need two VPN-capable routers (and know how to create a “normal” tunnel between them) and two public IPs on the site where ISA is located.

Your setup should look like this:

Basically, what you need is to give ISA and the VPN router in the main office 2 distinct public IPs and put them parallel to each other. Then turn off the DHCP on the VPN router on the main office and make sure is on the same subnet as the internal LAN and connect it to the same switch as the SBS internal NIC. Configure the VPN link between the 2 sites as you would in a "normal" situation and make sure your VPN router is blocking all incoming traffic. As with any VPN the remote LAN must be on a different subnet.

Now, the last step would be to tell the local LAN how to find the remote one (since SBS is the default gateway the computers will try to use that one instead of the VPN router). To correct this we must create a static route on the server… so go and run the following command on the SBS box "route add -p 10.0.0.0 mask 255.255.255.0 192.168.16.3" and you should be good to go.

There could be other variations in this scheme, but if you understand the steps involved here then its easy to modify this to do whatever you want.

Javier's SBS Wonderland : ISA

Site to Site VPN while keeping ISA in the Mix