VWAN - Bets practice

[gstar1703]

Hi,

We need to allow 30 XP workstations from another company (merged)to log onto our 2003 AD domain. I already have a 2MB leased line into the office where the server is based & am installing another in the remote office. I will have Site to Site VPN also setup, but wondered if anyone could offer me advice or links to information on how exactly the remote users would logon to our domain across the VPN when they first boot the PC. Presumably the PCs will be looking for the DHCP server which will be at the other end of the VPN, so I guess I would have to force all traffic through that channel??

Any clarification appreciated

G

 

[fs483]

We actually have a similar setup except we put a local server in the remote office to do the authentication process at the loggin. Then for data/exchange access, users either use their local apps or use RDP to connect to the server at HQ. Both servers are linked through a hardware VPN (Cisco Pix). There's also replication between the two servers. Howerver, in our case HQ only has servers (no actual workstations) so DHCP is disabled. All DHCP is done on the local server.

 

[gstar1703]

Hi akwong & thanx for the reply -
In your example, I take it your networks are on differnt subnets & you have 1 AD server at each end of the VPN? Do you then create a trust relationship between the 2 domains?

Do you know if its possible to force all remote clients to logon to our AD server via VPN? What are the pros/cons of haveing a logon server remotely?

Cheers
G

 

[nokker]

A DHCP request is done at network layer 2 which is not routeable, so I dont think that you will de able to force the DHCP request to be made from your remote site to your HQ server. You could setup your local router at the remote site to serve as a DHCP server and make the traffic routeable.
This way you will be able to route all traffic through your VPN tunnel and make your clients authenticate against your HQ AD server.

/Tommy

 

[gstar1703]

Thanx for your response -
If I understand correctly, I will need some kind of device remotely to authenticate users and assign IP address? If I have another 2003 server down there to achieve this how easy is it to "replicate" users, computers,OUs, or is it more suitable to create new remote domain with different subnet, create a trust between domains then fire traffic over the VPN that way?

Sorry for all the questions, just wanna get it right first time round..

Thanx
G

 

[nokker]

You just need at device to assign IP addresses. Then you will be able to route traffic to your HQ. I'll prefer to have a seperate server assigned to the site, but you could just make it an AD member server. Then the replication will run automatically.

/Tommy