Hi I have seen similar setups, I ran on with multiple site, but only base having multiple gateways (cable and adsl). all the firewalls where running on openwrt (linksys wrt52Gs careful though they with die under a lot of openvpn encrypted traffic)
http://lartc.org/howto/ is the place to start with multiple isp's. You have to decide on your networking policy, is it going to shared, load balance, fail over. You could also look at setting up a tun device sitting on top of openvpn and try and aggregate the lines - but very complex setup. I would suggest to keep it simple if you have 3 offices A, B & C.and 2 connections at each site (same spec) 1 & 2 then something like this (forgetting about DMZ's, presuming its all private traffic) A2 -> B1 B2 -> C1 C2 -> A1 These can be the primary paths - this is simple to do with weight/metric is the routing table and then the failback (backup routes) A1 -> B2 B1 -> C2 C1 -> A2 you could have 2 instances of openvpn running at the same time and again you will need to setup routing with weights/metrics so on A you would have something link (private LAN) ip r a B/24 via <openvpn primary interface addr> metric 5 ip r a B/24 via <openvpn secondary interface addr> metric 10 this way primary route would be used until it is not available. NOTE this doesn't do any load balancing, so you don't get the benefit of 2 lines. as for userid's, is this for vpn login, workstation login ? What is the predominant OS used in the company, probably stick with that. I am not sure if you can link AD and/or ldap into openvpn with cert's and userid password. Alex On Tue, Jul 15, 2008 at 03:11:57PM +1000, Sven Peters wrote: > Yes, you're right. > > I'm intending to use simple linux hardware without snmp. Was wondering > if heartbeat could be used to see if the hardware breaks and do the > activation of the inactive interfaces on a second similar machine. > > VPNwise I was thinking about OpenVPN but still open to any other > products which are open source. > > I had already a look at http://lartc.org/howto/ and got some ideas but > it'll still be a lot of work to put together all the scripts. > > As it isn't such an uncommon problem I was wondering if somebody else > has a similar setup and likes to exchange experiences, ideas and > pitfalls. You can reach me off list. > > Sven > > > Daniel Pittman wrote: >> Sven Peters <[EMAIL PROTECTED]> writes: >> >> G'day Sven. >> >> >>> I'm about to start to set up multiple offices with the normal services >>> (SMB, IMAP, etc) in different cities. I want all of them connected via >>> VPN and this needs to be as much reliable as possible. VPN Service >>> for people on the road needs to be available as well (with >>> Password+Certificates). I'd love to get all useraccounts into LDAP as >>> well later on. >>> >>> Therefore I've set up every location with two different DSL lines >>> which I now want to use to interconnect the locations. I thought of >>> setting up Linux firewalls with multiple interfaces (one internal, one >>> DMZ, two for the DSL connections) but not sure what's the best way to >>> do it. >>> >>> Has anybody experiences in this setup and can provide some hints, help >>> or even time to help setting this up in the next weeks? >>> >> >> You have chosen to do some relatively difficult networking for someone >> who needs to ask for basic hints on how to implement it; good luck. >> >> The best readily available reference I know of for the sort of thing you >> are looking at doing is the Linux Advanced Routing add Traffic Control >> howto, which has not seem much by way of updates in years: >> >> http://lartc.org/howto/ >> >> The content is still good and it should guide you to the appropriate >> tools for implementing whatever routing and availability policy you want >> to have based on your multiple links, etc. >> >> >> In terms of more specific advice, it is unlikely anyone can help you >> yet: you need to tell us an awful lot more, including what (VPN) >> technologies you intend to use for connecting the sites, what routing >> policies you want to use, what hardware is in play, etc. >> >> After all, recommending that you use SNMP to determine link availability >> for fail-over purposes is going to be useless if your hardware turns out >> to be lacking SNMP capabilities, right? >> >> Regards, >> Daniel >> > -- > SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/ > Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html > -- "The person who runs FEMA is someone who must have the trust of the president. Because the person who runs FEMA is the first voice, often times, of someone whose life has been turned upside down hears from." - George W. Bush 01/04/2001 Austin, TX
signature.asc
Description: Digital signature
-- SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/ Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html
