What are the reasons for choosing separate or combined VPN and Internet routers?

Question

Here's a network design question: I've just been reading "IPv6 for Enterprise Networks" by McFarland et. al. and it (among other Cisco documents) separates out Internet routing from remote access VPN. What are the advantages and disadvantages of using separate routers for remote access VPNs vs. general Internet traffic, assuming they go through the same uplink?

And as a secondary issue, what are the advantages or disadvantages in splitting out site-to-site and road warrior VPN between different routers?

(The VPN in my specific case is OpenVPN running on Vyatta, but from my perspective this is more about the design than the technology choice.)

Answer 1

There's a bunch of stuff to consider here, although a lot of it depends on your environment.

First, device flexibility. If there's an emergency update that needs a reboot of the device to take effect, are you ready to take down the combined services to deal with that update? This can become a rabbit's hole of "what if?" scenarios but it's something to think about.

Secondly, performance. Will a single device handle the encryption traffic and the routing? Will it do so for the lifetime of the product? Are you going to end up buying a "big" single replacement box because one of the functions needed more horsepower, where a "medium" and "small" box would do if they were separate?

Redundancy - this ties in to the flexibility point, do you require redundancy on any of these devices? Is it easier to maintain a single HA pair rather than multiples? Perhaps HA is only required for specific functions.

Routing - this can be fun if you've got separate devices bringing traffic in to the environment. Are they all aware of each other? Are they all aware of the (possibly) multiple paths available to each other? Simplifying down to less devices can be beneficial here, but if your environment isn't this involved you may never have to worry about it.

Additional services - are you running firewalling, traffic inspection, or threat prevention on these remote links? Are you going to need an additional "protection" box for every service you break out from the main device?

Those are some of the primary things we consider. In my opinion there isn't a simple "always do it this way" answer for this one.

Answer 2

If you have proper security policies in place, there is no need to separate these two devices out. If you have a properly spec'd firewall, then performance is not a reason to separate them out either.

It's good of the vendor to tell you to split these two out as they end up selling you two firewalls instead of a single device.

Answer 3

Pending the way your ISP may deliver MPLS VPN and Internet traffic may dictate your design choices for you. By separating the functions you may choose to utilize different ISP’s for partial redundancy (last mile issue) while also separating the router load and administrative/management functions.

VPN remote access clients do not support routing protocols. The preferred method for directing packets to a remote network is to create a default route on the remote access client that directs all packets to the remote network. This is the default configuration for VPN remote access clients.

VPN connections between facilities use either Point-to-Point Tunneling Protocol (PPTP) or Layer Two Tunneling Protocol/Internet Protocol security (L2TP/IPSec) over an intermediate network, such as the Internet. By using the Internet as a connection medium, VPN saves the cost of long-distance phone service and hardware costs associated with using dial-up or leased line connections. A VPN solution includes advanced security technologies such as data encryption, authentication, and authorization.

Internet egress could be as simple as aggregating all traffic destined for the Internet behind a NAT/PAT firewall/Internet Gateway.

URLS for review: http://www.cisco.com/en/US/products/ps6604/products_white_paper09186a00801281f1.shtml#wp39765 http://technet.microsoft.com/en-us/library/cc739294(v=ws.10).aspx

Answer 4

I might have missed someone already providing this answer, but just-in-case. The biggest reason that I would separate them is: SECURITY. If you have one router that serves all of those purposes, then you have only a single device that needs to be compromised before an attacker has full access to your network, and every device on it.

By separating the devices, you can create multiple trust zones, which better define access. That way, if someone gains access to your VPN router, they only have access based on the specific rules that are defined in your internet router, etc.

Hope that helps.

Answer 5

While they may be on the same network, it is still easier to seperate them as you can restrict and control inbound traffic a lot better (because you seperate them in groups) based on the purpose. It might be that you do not want people connecting through the VPN to have access to all machines in the network.

Answer 6

one more thought on this - if you use Cisco ASA as your internet termination device:

you can't use the context feature if you are using VPN services on the same boxes (assuming you have/want an active/active setup)