Does anyone know what would be the best practice to securely connect 2 or more branches with HQ over the Internet, and to allow communication between all of them (so anyone can contact anyone) if I have Cisco devices? Should I make Multi site VPN with ASA and include GRE tunneling with routers? What are my options? If someone has configuration example it would be great.
If your only connection between the office is over the internet then you have no choice but to run a VPN. It would be much simpler if you had a fiber or Ethernet connection to interconnect them.
Unless you have a security reason, for instance a central internet content filter or something, I would let the branch offices directly access the internet and only run the office to office traffic thought a VPN.
A VPN requires a router or a gateway with built-in VPN functionality. You'll find most VPN solutions also support remote access to users outside of the office; for example, when your employees use WiFi hotspots at hotels, airports, or even their home. This requires that their computer or mobile device supports the same VPN method as your company's VPN solution.
Here are the main VPN protocols or methods you'll find:
PPTP: Generally the least secure method. However for providing remote access to users outside of your offices, PPTP is natively supported on Windows and most other operating systems and mobile devices. But there can be connection issues when employees connect from networks that don't allow VPN pass-through.
L2TP/IPsec: Better security than PPTP, but usually more complicated to setup. For providing remote access to users outside of your offices, it's natively supported on most computers and mobile devices but also has similar connection issues to PPTP.
SSL: Typically designed for providing remote VPN access to users outside of your offices, not connecting entire networks. The connection is made via a Web browser and doesn't require a VPN client on the computer or device.
OpenVPN: Typically only included on routers with an open source firmware or operating system. To provide remote access to users outside of your offices, users would have to have an OpenVPN client installed on their device, since it's not natively supported by Windows, Mac OS X, or mobile devices. But it doesn't suffer from the connection issues PPTP and L2TP/IPsec do.
Cisco EasyVPN: Easy VPN is a hub-and-spoke VPN topology that can be used with a variety of routers, PIX, and ASA devices. Policies are defined mostly on the hub and pushed to remote spoke VPN devices, ensuring that clients have up-to-date policies in place before establishing a secure connection. Easy VPN simplifies VPN deployment for remote offices. With Easy VPN, security policies defined at the head end are pushed to remote VPN devices, ensuring that clients have up-to-date policies in place before establishing a secure connection.
There are many network routers (wired and wireless) that have VPN functionality built-in, which can also be called VPN gateways or VPN firewalls. These are great for long-term reliable use, and they require minimal effort. They usually also support remote connections for employees who want VPN access when out of the offices.
Cisco configuration examples.