7

I have users that need to be able to work remotely. In their current environment they use workstations with unique software that requires their IP address remain the same. Now that they are working remotely, they are assigned a new DHCP subnet for the VPN remote access and the software no longer works.

I'm considering creating a NAT for the remote users IP address to their former LAN IP so the software would work. However, I'm concerned this would cause a conflict even though the NAT wouldn't be used until the laptop leaves the office and remotes in.

I may be able to reserve IPs based on the remote users login at my VPN/firewall, but this only would help a single office location and not every office has an Internet connection and firewall/VPN.

Those other offices are connected via a private WAN and NATting those LAN subnet IPs at the main office with Internet access would result in duplicate BGP advertisements on the private WAN.

Has anyone run into this before, is it possible to do? I expect I will end up running Citrix, RDP, or Terminal Services. However, I'm curious if there is a simpler way. Thanks.

--ALSO-- Here are some examples of threads in the same 'spirit', although I'm looking to utilize a software VPN client and not a site-to-site VPN configuration:

http://forums.juniper.net/t5/SRX-Services-Gateway/Possible-to-bridge-same-subnet-over-VPN/td-p/112432

http://www.aminus.org/blogs/index.php/2005/04/16/site_to_site_bridged_ethernet_using_open_2?blog=2

Improve this question
5
  • I think you're looking at a Citrix/RDP solution. In my experience, this need has been met by leaving a desktop running at the workstation with the necessary static IP. Then the remote user either VPNs into the work network on their laptop and RDP's to the desktop, or launches an RDP client via Citrix.
    – Brett Lykins
    Sep 6, 2013 at 19:24
  • Thanks for the comment, that is what I was expecting as well. Just curious if there are any other different ways to uniquely advertise these hosts or bridge the network via a VPN client.
    – raidORlostark
    Sep 9, 2013 at 16:28
  • To clarify, will the remote users be working ONLY remote, or are they coming and going between the office and elsewhere? Each scenario would involve a little bit of a different solution.
    – Brett Lykins
    Sep 9, 2013 at 23:46
  • A little more about the software might be useful. For instance, is this software installed on the local machine that requires the IP or are the machines connecting to the software on a server and it is expecting connections only from certain IPs? Is this something that can be configured in some fashion, or is it hard coded in a fashion where no updates are possible at all?
    – YLearn
    Sep 12, 2013 at 23:03
  • Mobile IP (and Mobile IPv6, for IPv6) are designed for this type of requirement.
    – auspicious99
    May 5, 2020 at 16:03

6 Answers 6

Reset to default
7

The only way to properly do this, if their IP HAS to be the same as their desktop, is for them to RDP onto their desktop over the VPN.

Or fix the software that's got this ludicrous requirement

Improve this answer
1
  • Thanks. Not a very exciting answer, but the most popular ;) . I am already down this path, however, some of the other answers brought up interesting ideas. Thanks again.
    – raidORlostark
    Sep 16, 2013 at 18:27
2

You can easily accomplish this with openvpn. There are a lot of examples on the internet apart from the very nice documentation they have in their site. Just be aware you will need to set up a tap tunnel in order to bridge it with your lan and not a tun tunnel, which is routed. http://openvpn.net/index.php/open-source/documentation/howto.html#examples If you need more help on than contact me, I could share with you my working configuration.

Improve this answer
2

Doesn't solve your imediate problem but given your title LISP would most definitely allow for a user to have one ip address in various "zones" although it probably still a bit complex for work/home usage.

What is LISP?

LISP is a network architecture and set of protocols that implements a new semantic for IP addressing. LISP creates two namespaces
and uses two IP addresses: Endpoint Idenfitiers (EIDs), which are assigned to end-hosts, and Routing Locators (RLOCs), which are 
assigned to devices (primarily routers) that make up the global routing system. Performing this separation offers several advantages,
including:
- Improved routing system scalability by using topologically-aggregated RLOCs
- Provider-independence for devices numbered out of the EID space (IP portability)
- Low-OPEX multi-homing of end-sites with improved traffic engineering
- IPv6 transition functionality
- IP mobility (EIDs can move without changing - only the RLOC changes!)
LISP is a simple, incremental, network-based implementation that is deployed primarily in network edge devices. 
It requires no changes to host stacks, DNS, or local network infrastructure, and little to no major changes to 
existing network infrastructures.

Cisco LISP explanation

Improve this answer
2

Cisco implementation for RFC2002, aka mobile IP: http://www.cisco.com/en/US/products/ps6590/products_ios_protocol_group_home.html

and here's how to configure it(http web page link somehow does't work): http://www.cisco.com/en/US/docs/ios/ipmobility/configuration/guide/12_4t/imo_12_4t_book.pdf

Check out the presentation and white papers. Page 41 of 2nd listed presentation says 1700/1800/2600xm/2800/3700/3800/7200 with proper IOS are supported. One caveat is that you need Cisco Mobile IP client software installed on user's PC.

Improve this answer
1
  • 1
    hi, could you add more details about what devices would run mobile ip and how the solution works for the OP?
    – Mike Pennington
    Sep 10, 2013 at 22:46
0

I would forward the VPN to a windows server from the firewall, have the windows server handle the VPN connections. As long as the windows box is in the same subnet, users should receive the same ip's from DHCP within the same subnet as the windows box.

Improve this answer
0

Mobile IP (RFC 5944), and Mobile IPv6 (RFC 6275) are specifically designed to handle this kind of scenario, where you have users that move around but to keep, or be somehow reachable at, their original home network IP address.

Mobile IP defines the concepts of home network and foreign network, how packets can be routed to the home network by normal IP routing, and then forwarded to the foreign network.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.