6

I have users that need to be able to work remotely. In their current environment they use workstations with unique software that requires their IP address remain the same. Now that they are working remotely, they are assigned a new DHCP subnet for the VPN remote access and the software no longer works.

I'm considering creating a NAT for the remote users IP address to their former LAN IP so the software would work. However, I'm concerned this would cause a conflict even though the NAT wouldn't be used until the laptop leaves the office and remotes in.

I may be able to reserve IPs based on the remote users login at my VPN/firewall, but this only would help a single office location and not every office has an Internet connection and firewall/VPN.

Those other offices are connected via a private WAN and NATting those LAN subnet IPs at the main office with Internet access would result in duplicate BGP advertisements on the private WAN.

Has anyone run into this before, is it possible to do? I expect I will end up running Citrix, RDP, or Terminal Services. However, I'm curious if there is a simpler way. Thanks.

--ALSO-- Here are some examples of threads in the same 'spirit', although I'm looking to utilize a software VPN client and not a site-to-site VPN configuration:

http://forums.juniper.net/t5/SRX-Services-Gateway/Possible-to-bridge-same-subnet-over-VPN/td-p/112432

http://www.aminus.org/blogs/index.php/2005/04/16/site_to_site_bridged_ethernet_using_open_2?blog=2

  • I think you're looking at a Citrix/RDP solution. In my experience, this need has been met by leaving a desktop running at the workstation with the necessary static IP. Then the remote user either VPNs into the work network on their laptop and RDP's to the desktop, or launches an RDP client via Citrix. – Brett Lykins Sep 6 '13 at 19:24
  • Thanks for the comment, that is what I was expecting as well. Just curious if there are any other different ways to uniquely advertise these hosts or bridge the network via a VPN client. – raidORlostark Sep 9 '13 at 16:28
  • To clarify, will the remote users be working ONLY remote, or are they coming and going between the office and elsewhere? Each scenario would involve a little bit of a different solution. – Brett Lykins Sep 9 '13 at 23:46
  • A little more about the software might be useful. For instance, is this software installed on the local machine that requires the IP or are the machines connecting to the software on a server and it is expecting connections only from certain IPs? Is this something that can be configured in some fashion, or is it hard coded in a fashion where no updates are possible at all? – YLearn Sep 12 '13 at 23:03
6

The only way to properly do this, if their IP HAS to be the same as their desktop, is for them to RDP onto their desktop over the VPN.

Or fix the software that's got this ludicrous requirement

  • Thanks. Not a very exciting answer, but the most popular ;) . I am already down this path, however, some of the other answers brought up interesting ideas. Thanks again. – raidORlostark Sep 16 '13 at 18:27
2

Doesn't solve your imediate problem but given your title LISP would most definitely allow for a user to have one ip address in various "zones" although it probably still a bit complex for work/home usage.

What is LISP?

LISP is a network architecture and set of protocols that implements a new semantic for IP addressing. LISP creates two namespaces
and uses two IP addresses: Endpoint Idenfitiers (EIDs), which are assigned to end-hosts, and Routing Locators (RLOCs), which are 
assigned to devices (primarily routers) that make up the global routing system. Performing this separation offers several advantages,
including:
- Improved routing system scalability by using topologically-aggregated RLOCs
- Provider-independence for devices numbered out of the EID space (IP portability)
- Low-OPEX multi-homing of end-sites with improved traffic engineering
- IPv6 transition functionality
- IP mobility (EIDs can move without changing - only the RLOC changes!)
LISP is a simple, incremental, network-based implementation that is deployed primarily in network edge devices. 
It requires no changes to host stacks, DNS, or local network infrastructure, and little to no major changes to 
existing network infrastructures.

Cisco LISP explanation

1

You can easily accomplish this with openvpn. There are a lot of examples on the internet apart from the very nice documentation they have in their site. Just be aware you will need to set up a tap tunnel in order to bridge it with your lan and not a tun tunnel, which is routed. http://openvpn.net/index.php/open-source/documentation/howto.html#examples If you need more help on than contact me, I could share with you my working configuration.

1

Cisco implementation for RFC2002, aka mobile IP: http://www.cisco.com/en/US/products/ps6590/products_ios_protocol_group_home.html

and here's how to configure it(http web page link somehow does't work): http://www.cisco.com/en/US/docs/ios/ipmobility/configuration/guide/12_4t/imo_12_4t_book.pdf

Check out the presentation and white papers. Page 41 of 2nd listed presentation says 1700/1800/2600xm/2800/3700/3800/7200 with proper IOS are supported. One caveat is that you need Cisco Mobile IP client software installed on user's PC.

  • 1
    hi, could you add more details about what devices would run mobile ip and how the solution works for the OP? – Mike Pennington Sep 10 '13 at 22:46
0

I would forward the VPN to a windows server from the firewall, have the windows server handle the VPN connections. As long as the windows box is in the same subnet, users should receive the same ip's from DHCP within the same subnet as the windows box.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.