1

We currently use many IPSec VPNs to connect to separate companies, but the VPNs are managed by a third party. We are interested in running these VPNs ourselves, using any method as long as it is IPSec. These clients share information with each other exclusively through us. Our organization acts as the hub that connects two spokes.

Are there any methods or best practices you may know of related to efficiently managing a large number of IPSec VPNs like this?

3
  • It sounds like you want to run the VPNs on servers, and that is a question you should ask on Server Fault because servers are off-topic here. We could help with VPNs on network devices, e.g. routers. – Ron Maupin Jan 4 '17 at 20:08
  • I should clarify, we are interested in best practices related to managing many IPSec VPNs independent of whether or not it is on a server or any other method, really anything within the scope of Network Engineering. I have edited my question. – user33278 Jan 4 '17 at 20:16
  • We are going to need to know what you mean by "manage." You can create VPNs on a router that has a public IP address, but there really isn't any maintenance to it. – Ron Maupin Jan 4 '17 at 21:20
2

So the question is kind of vague but there are some guiding principles worth considering:

  1. Separate connectivity into tiers - so, for example, a few external aggregation boxes might feed into a larger number of boxes focused strictly on encryption and decryption that, in turn, connect to infrastructure that separates customer connections into multiple logical tenants that are then cross-connected through a layer that can provide appropriate policy based controls and security. Greater flexibility in this regard will let you make more optimal choices about horizontal versus vertical scale - so more cheap boxes vs fewer high-density/exotic ones, etc.

  2. Good management invariably means a very deep understanding and integration of operational processes into orchestration. You don't bolt automation on. Like security you really have to bake it in from the start. As you put together your infrastructure you want to choose product sets that integrate with your toolsets and you want to provide a product that integrates with your customer's toolsets. Success in anything like an SP network is going to be pretty directly tied to the extent you can keep humans out of day-to-day provisioning, troubleshooting, etc.. and to maximize the effectiveness of those humans when their attention is required.

  3. Visibility and measurement are worthy investment targets. Be able to gather data from each and every tier and device and have an efficient and sane way to store and analyze this information. These areas are often neglected earlier in the process and it causes a lot of pain. This can be the means by which business and infrastructure can be well done and can be a significant competitive advantage and source of revenue.

Anyhow - if you can more specifically describe the problem you're trying to solve we can make better recommendations about the sorts of technologies and approaches that might be a win.

1
  • Excellent suggestions, thank you! Marking as answered. – user33278 Jan 5 '17 at 16:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.