1

I want to implement a network design for my home office that has the capabilities of connecting to a VPN or Tunneling service and performs Split Tunneling within the network appliances.

The reason for wanting a VPN/Tunneling Hardware Client is that not all devices on the network would have the capability of running a software VPN Client.

The reason for needing Split Tunneling is to reduce unnecessary latency.

In my search for a router, I have tentatively settled on a Cisco RV345P and it appears that the Teleworker VPN Client feature might meet my needs on the VPN Hardware Client need. Unfortunately, in the product literature, it appears that split tunneling is only an option when the router is configured as the VPN Host.

The following issues are preventing me from moving forward with hardware purchasing:

1-Teleworker VPN Client mode receives IPsec policies pushed by the VPN server, but what protocol is Cisco's Teleworker VPN Client mode capable of receiving? IPsec/L2TP would meet my requirements, but I don't want to make an assumption that Teleworker VPN Client mode would work (the RV345P Admin guide doesn't elaborate on how this connection is established).

2-Cisco Software; I have never purchased Cisco hardware before, so I'm not clear on firmware vs. software. I understand that mobility users using something like Cisco Easy VPN would require software licenses. What about the Teleworker VPN Client Mode? Is this a feature built into the firmware, or is this a feature that you would have to pay a license for?

3-Is split tunneling even possible on a client side router, nearly every reference to split tunneling I can find refers to this taking place at the VPN server or through a software client on a PC/device. My guess is at this point is that the RV345P is not capable of this. Can this issue be solved by implementing more than one appliance?

Thank you in advance for any constructive tips, I'm pretty stuck on how to proceed (No help offered yet by Cisco sales or Cisco Small Business Community)

Nick

2
  • Are you asking about using the router as a VPN client to a different VPN server, or are you asking about using the router as a VPN server to which external clients will connect? Removed off-topic request for product or resource. – Ron Maupin Dec 14 '17 at 22:32
  • Thanks for the response. I am asking about using the router as a VPN client to a different VPN server. – N Johnson Dec 14 '17 at 23:31
0

If your router is a client to the VPN server, then you really don't need to worry about split tunneling, which concerns host configurations. You simply use routing to determine which interface is used for traffic passing through the router. You normally would have a default route to the public Internet, and a route to specific networks through the VPN tunnel. The packets will be routed based on the routing table in the router.

The hosts on your network will be oblivious about whether or not the tunnel is up. All they know is to send packets, and the router takes care of routing them to the Internet default or VPN.

What you may need to worry about is the networks to which the VPN leads may overlap your network addressing. You will need to take some ugly measures (e.g. readdress your network or NAT) in that case.

2
  • Very appreciative for the Answer to my question. Is "Network Engineering" a proper venue for posting a new question regarding the different options for effecting a desired routing table: IGMP Proxy, RIP, Static? The simplest routing (I think) that would meet my needs would actually be based on device address rather than traffic type. – N Johnson Dec 15 '17 at 17:58
  • You should read the What topics can I ask about here? for what is or is not on-topic here. Each SE site has one of those. – Ron Maupin Dec 15 '17 at 18:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.