VPN Hardware Client with Split Tunneling (How do I design this?)

Question

I want to implement a network design for my home office that has the capabilities of connecting to a VPN or Tunneling service and performs Split Tunneling within the network appliances.

The reason for wanting a VPN/Tunneling Hardware Client is that not all devices on the network would have the capability of running a software VPN Client.

The reason for needing Split Tunneling is to reduce unnecessary latency.

In my search for a router, I have tentatively settled on a Cisco RV345P and it appears that the Teleworker VPN Client feature might meet my needs on the VPN Hardware Client need. Unfortunately, in the product literature, it appears that split tunneling is only an option when the router is configured as the VPN Host.

The following issues are preventing me from moving forward with hardware purchasing:

1-Teleworker VPN Client mode receives IPsec policies pushed by the VPN server, but what protocol is Cisco's Teleworker VPN Client mode capable of receiving? IPsec/L2TP would meet my requirements, but I don't want to make an assumption that Teleworker VPN Client mode would work (the RV345P Admin guide doesn't elaborate on how this connection is established).

2-Cisco Software; I have never purchased Cisco hardware before, so I'm not clear on firmware vs. software. I understand that mobility users using something like Cisco Easy VPN would require software licenses. What about the Teleworker VPN Client Mode? Is this a feature built into the firmware, or is this a feature that you would have to pay a license for?

3-Is split tunneling even possible on a client side router, nearly every reference to split tunneling I can find refers to this taking place at the VPN server or through a software client on a PC/device. My guess is at this point is that the RV345P is not capable of this. Can this issue be solved by implementing more than one appliance?

Thank you in advance for any constructive tips, I'm pretty stuck on how to proceed (No help offered yet by Cisco sales or Cisco Small Business Community)

Nick

Answer 1

If your router is a client to the VPN server, then you really don't need to worry about split tunneling, which concerns host configurations. You simply use routing to determine which interface is used for traffic passing through the router. You normally would have a default route to the public Internet, and a route to specific networks through the VPN tunnel. The packets will be routed based on the routing table in the router.

The hosts on your network will be oblivious about whether or not the tunnel is up. All they know is to send packets, and the router takes care of routing them to the Internet default or VPN.

What you may need to worry about is the networks to which the VPN leads may overlap your network addressing. You will need to take some ugly measures (e.g. readdress your network or NAT) in that case.