Connect office to multiple customer VPNs

Question

First time post here so if this is off topic please let me know where to ask this question.

A company that provides outsource billing services to multiple client companies using VPNs to each remote company location has asked me if there is a way for each individual biller to connect to more than one company's VPN simultaneously.

I've researched multiple site to site VPN's. The routing and WAN overhead seems to make that a bad solution. I've considered multiple ISP connections for each VPN and then routing the local network between them, but that would probably not be cost effective.

I thought about a hub and spoke VPN, but these clients are seperate companies and I can't connect their networks together through mine. A remote support type solution would require the client companies to allow us to install our own gateway at their location. They generally won't agree to that. And we tried internet based remote support/desktop apps.

Can anyone suggest a solution? Right now the VPN clients are installed on the billers individual computers.

Answer 1

Hub and spoke only describes the general topology. You use firewall rules or ACLs to permit and deny the traffic you want/don't want.

Hub and spoke is a good choice when there's little traffic between spokes or you require central control over all traffic. If there's a lot of traffic between spokes you might need fat uplinks.

The general approach to your problem is to establish a VPN link with each customer and use firewall rules to limit the link to only expose the services you want them to see or use. That way, each customer has total control over their security - by not allowing inbound connections - and can securely use otherwise unsecured/unhardened applications.

Many VPN connections don't generate more overhead than fewer VPN connections, so the only question is how many connections and how much traffic your routers and your WAN link can support.