Remote Working & Server Access

[Pentangle]

What makes you say that? The old versions didn't, but any partners will upgrade the software when you buy it anyway if it's running the old version.

That depends upon who you buy it from, obviously.

 

[Leo-InstallingIT]

Well yes, especially with Cisco kit in shortage at the moment there are a lot of brokers selling old stock, so something to watch out for..

 

[smo]

Thanks for all your help chaps.

So when i change the office router to either the Draytek or Cisco, what do i use for the client software? Is it built into windows or do i need a 3rd party application?

 

[Leo-InstallingIT]

I'm not an expert on draytek to be honest, but I think it will come with it. But Pentangle is probably best to advise on that one!

For the Cisco one, in true Cisco style they like to make life difficult. They don't send it on a disk for you. But if you have someone install it for you, which might be advisable they will provide it. If not, just give me a shout.

Thanks

Leo

 

[Pentangle]

Thanks for all your help chaps.

So when i change the office router to either the Draytek or Cisco, what do i use for the client software? Is it built into windows or do i need a 3rd party application?

The built-in Windows VPN client should suffice. Whilst it only supports PPTP/L2TP and not IPSEC, it's *free*

 

[crumble]

The built in Windows client will work fine, however Draytek do their own VPN client which I tend to use. Partly because it's less confusing for users(!) and partly because apparantly the compression is better. And it is also free!

See the bottom of this page
http://www.draytek.co.uk/support/downloads.html

 

[smo]

Thank you all, its been a great help.

I shall order up some new kit and report back on how i get on!!!!

 

[Page]

PLEASE do and add to this thread so it is there for long term reference

 

[computer storm]

One other solution that has not been put to you is installing a terminal server, this will then allow multiple connections to one server and also run the applications locally on the server. This will also allow user to map network drives to the information needed and also allows you control of access to your network. This would also allow you to add any applications to the server and let users access then as if they were locally connected.

The end user would access via remote desktop and it works well, you just have to make sure you get the hardware correct and work out how much memory would need to be installed for it to run smoothly.

This would also do away with the VPN connection as everything is accessed via a termianl window. Saves you buying a new router.

 

[Pentangle]

One other solution that has not been put to you is installing a terminal server, this will then allow multiple connections to one server and also run the applications locally on the server. This will also allow user to map network drives to the information needed and also allows you control of access to your network. This would also allow you to add any applications to the server and let users access then as if they were locally connected.

The end user would access via remote desktop and it works well, you just have to make sure you get the hardware correct and work out how much memory would need to be installed for it to run smoothly.

This would also do away with the VPN connection as everything is accessed via a termianl window. Saves you buying a new router.

Read posts #3 and #20.

 

[computer storm]

Read posts #3 and #20.

Sorry about that mate, didnt see that bit in post 3, should read more before responding, but as you know if Terminal server is setup correctly and the pipe good then it is a good solution for the end user.

 

[Pentangle]

Sorry about that mate, didnt see that bit in post 3, should read more before responding, but as you know if Terminal server is setup correctly and the pipe good then it is a good solution for the end user.

No worries - I know that, you know that, but the OP didn't like the experience.

 

[smo]

I'm sure its a good solution in some situations, sadly its not ideal for what i want and doesnt suit our application from my experience.

 

[StevieT]

Have you considered moving to "Software as a Service". I can imagine all the techies starting to glow red

Why have all that expensive equipment based in the office, if people are working from home. Base everything on the net, then people just need Internet access.

Backups automated, access to info far quicker, no hardware issues. Get the simpler life, you know it makes sense

 

[Pentangle]

Have you considered moving to "Software as a Service". I can imagine all the techies starting to glow red

Why have all that expensive equipment based in the office, if people are working from home. Base everything on the net, then people just need Internet access.

Backups automated, access to info far quicker, no hardware issues. Get the simpler life, you know it makes sense

So tell us all how that's going to solve his unwillingness to run his bespoke application remotely.

Have you also considered the entirety of his setup? or are you just flinging buzzwords around?

 

[Leo-InstallingIT]

Software as a service is great, except you can't really have a bespoke package as a service...

None of us have ruled out hosting the application remotely and accessing it to increase bandwidth. But other issues such as data security have to be considered then.

 

[smo]

Hosting remotely isnt really an option and i dont buy into the whole "better" thing either.

We would have to have a dedicated server, this would cost hundreds a month, then we would need a seperate database server to remain PCI compliant due to the handling of data and Card details. Our system was also never designed to work like that in that environment which would cause numerous problems.

I appreciate the input, but dont think for our application it would work.

 

[smo]

I promised an update so...

I got the Draytek 2820n and first impressions are good, well built and loads of features, it seems to be working ok so far but ive only set up the basic ADSL settings and firewall and am about to configure the VPN tunnels and then move onto the WLAN and 3G setup.

So far so good....

 

[Pentangle]

Good stuff - glad to hear it's working out for you.

Incidentally, there was a recent update from Draytek for the 2820 firmware - doesn't seem to have made anything worse, so there's some decent additions in it if yours shipped with the prior firmware.

Cheers,
Mike.

 

[smo]

I've put the latest firmware on the router today.

Having problems with the VPN, couldnt get IPSEC to work, managed to get PTPP working though which at least proves its possible, however, how do i go about mapping the drives across a VPN???

 

[Leo-InstallingIT]

As you probably don't have DNS setup for your internal stuff the best way will be to use the IP address.

So if you map the drive to \\192.168.1.50\SharedDocs

Obviously replace the 192.168.1.50 with the actual IP address of the machine and the SharedDocs with the shared folder name.

It will then probably ask for a username & password, just enter the user details from that PC.

Hope that helps.
Many Thanks

Leo

 

[smo]

Hi Leo,

That's a great help and confirms what i thought....however, i presume that i need to be using different IP ranges at the differing locations as i use 192.168.x.x at both work and home currently, and know that the other pimary VPN location uses it too!!

Am i best changing one to another range?

 

[Leo-InstallingIT]

Yeah, you are best changing it.

Usually 192.168.x.x ranges will be setup with a /24 subnet (255.255.255.0), so you can actually just have the second to last digit at each site different.

Personally I find it's usually best to change the VPN site to a 10.x.x.x range because you have a bit more flexibility and usually covers the home accessing work scenario well.

Many Thanks

Leo

 

[smo]

Thanks Leo, i shall look at changing the office over to 10.0.x.x tomorrow....that will be fun, choices to do it before of after a busy day!!

 

[Pentangle]

Is the VPN a branch-to-branch one, or a client-to-server?

i.e. is the tunnel between two routers or between the router and a PC?

Also, have you depracated WINS on your office network or are you still running it?

 

[Pentangle]

Thanks Leo, i shall look at changing the office over to 10.0.x.x tomorrow....that will be fun, choices to do it before of after a busy day!!

One thing you will need to ensure is that your office network range doesn't overlap any of your remote site network ranges. Changing the office to 10.x.x.x is probably the easiest way of ensuring this (although I would guard against using 10.0.0.x for obvious reasons).

It's not a case of "you are best off changing it", more that "it won't work if you don't change it". This is because a VPN is purely a combination of 2 technologies:

- An encrypting packet encapsulator (to take data, encrypt it, and packetise it)
- A temporary addition to your endpoint's routing table (in order to divert the packets to the relevant remote endpoint)

...it's the latter technology that won't work if you have both ends with an overlapping IP numbering convention.

 

[smo]

Pentangle - its client 2 server at the moment for ease of setup with differing hardware at each site so i have the 2820n at work and use their software to "dial in"

I shall change the office over to 10.x.x.x tomorrow then as whilst i can connect at the moment i cant map or access anything as they are on the same IP range currently.

With 10.x.x.x can i change any of the "numbers" after the 10, or am i restricted to only the last set (10.0.0.x) for setting the computers? ie: can i have 10.1.1.1 - 10.1.1.10 or does it have to be 10.0.0.1 - 10.0.0.10??

 

[Pentangle]

Pentangle - its client 2 server at the moment for ease of setup with differing hardware at each site so i have the 2820n at work and use their software to "dial in"

I shall change the office over to 10.x.x.x tomorrow then as whilst i can connect at the moment i cant map or access anything as they are on the same IP range currently.

With 10.x.x.x can i change any of the "numbers" after the 10, or am i restricted to only the last set (10.0.0.x) for setting the computers? ie: can i have 10.1.1.1 - 10.1.1.10 or does it have to be 10.0.0.1 - 10.0.0.10??

It all depends upon how you subnet your network

(and if you didn't understand subnetting, subnet masks, and networks, then you should take a look at a good FAQ about subnetting, for example: http://articles.techrepublic.com.com/5100-10878_11-6089187.html)

If you're in a hurry though, and you've only ever subnetted your networks with a subnet mask of 255.255.255.0 (/24) then the answer is "no, every PC on the same network segment should have the same first, second and third octet numbers".



(the name's "Mike" by the way).


(oh and I edited this question because I first read it and thought you were talking about per network, rather than per machine in the network!)

 

[smo]

Sorry, Mike

I did mean per network, so i guess i could have 10.2.6.1 - 10.2.6.10 without a problem??

I shall read the guide on subnetting, im no IT expert, i know a bit but not enough!!!

Thanks, Simon.

 

[Pentangle]

Sorry, Mike

I did mean per network, so i guess i could have 10.2.6.1 - 10.2.6.10 without a problem??

If they're assigned to computers in your office site, then yes that's fine.

Remember, you'll need to change the router LAN address as well. Common standards would have you place the router at either .1 or .254 (and I choose .1 always).

 

[smo]

I'll start with the router when i change it all over, and likewise i set it at .1

 

[shugied]

That Draytek router has another useful feature. If you are in an area where you can only get basic broadband, and need a bit more bandwidth, it has a second WAN port so you can "add" two broadband links together. You need a second router, but your old Netgear one will do the job.

 

[Pentangle]

That Draytek router has another useful feature. If you are in an area where you can only get basic broadband, and need a bit more bandwidth, it has a second WAN port so you can "add" two broadband links together. You need a second router, but your old Netgear one will do the job.

A bit misleading, as it doesn't do aggregation, merely failover and load-balancing.

 

[shugied]

A bit misleading, as it doesn't do aggregation, merely failover and load-balancing.

True, but you don't get true aggregation for that sort of money, and when set to load balance the Draytek can make good use of both outgoing connections, which can be useful in some circumstances. I was using "add" rather loosely though, I didn't think a complete technical explanation would be of benefit to the chap who bought the Draytek.

 

[Page]

A bit misleading, as it doesn't do aggregation, merely failover and load-balancing.

We are at the end of the line and have a separate fax line

Can you suggest any that do do aggregation since this might be worth us looking at

 

[Pentangle]

We are at the end of the line and have a separate fax line

Can you suggest any that do do aggregation since this might be worth us looking at

For proper aggregation you would need to talk to your ISP and see if they offer it as a service (as aggregation requires specialist kit both in your office and also at the ISP end). It's also a lot more expensive than a simple DSL router. Think several hundred a month.

 

[shugied]

We are at the end of the line and have a separate fax line

Can you suggest any that do do aggregation since this might be worth us looking at

As Pentagle points out, true aggregation is expensive, but the Draytek load balancing might provide a solution, depends really on what you are trying to do.

 

[boogs]

What an interesting thread. When I moved offices earlier this year this is exactly what I wanted to do as I work from home mostly. Although I have a desktop PC on my desk at work, these days I never use it as I just take my laptop back and forth. When I am in the office, logged into the server via the laptop, the server file drive is mapped to my laptop so I can access our Quickbooks data file. All I wanted to be able to do was the same thing from home but via the internet connection - didn't seem like rocket science to me but it proved impossible to do.

I have used gotomypc successfully in the past but wanted to move away from that as a) it meant my desktop pc has to always be on and available and b) I have to spend extra having additional user licenses for software on my laptop and desktop.

 

[shugied]

What an interesting thread. When I moved offices earlier this year this is exactly what I wanted to do as I work from home mostly. Although I have a desktop PC on my desk at work, these days I never use it as I just take my laptop back and forth. When I am in the office, logged into the server via the laptop, the server file drive is mapped to my laptop so I can access our Quickbooks data file. All I wanted to be able to do was the same thing from home but via the internet connection - didn't seem like rocket science to me but it proved impossible to do.

I have used gotomypc successfully in the past but wanted to move away from that as a) it meant my desktop pc has to always be on and available and b) I have to spend extra having additional user licenses for software on my laptop and desktop.

Gotomypc, like logmein, has it uses, one being that it is very simple to get going. I've always been slightly unhappy about a third party being involved, but it might just be my paranoia at work (at least it's not google!!). But you've spotted some of the drawbacks too.

External access to a server can be simple, but often seems to be more fiddly than expected. What server and router do you have?

 

[Page]

The vigor 2930 says that it does aggregation

On their website http://www.draytek.co.uk/products/vigor2930.html

The Vigor 2930 is a high-performance dual-WAN firewall. The two dedicated ethernet WAN ports can provide load balancing, WAN failover or bandwidth aggregation (increasing total bandwidth onto the Internet). Versions with SIP-Compliant VoIP (Voice-over-IP) and ISDN support are also available. High Speed total WAN througput of up to 70Mb/s is available, and IPSec VPN throughput of up to 40Mb/s. Extensive QoS support and comprehensive Web Content filtering features help you make the most efficient use of your bandwidth.

The Vigor 2930 is in an all-new DrayTek housing design with all LEDs and sockets provided conveniently on the front. This makes desk usage, wall mouting or rack-mounting (optional bracket required) all equally covenient.

-------

But you are hinting that I would still need to liaise with my broadband supplier (BT) and that it is not as simple as having 2 lines in ?