How to centrally manage customer site's and users that have access to customer site's

Question

Background information:

We have customers spread over the whole continent. We deliver and install hardware at the customers site and completely set up and configure the network for them. After the installation is done, we want to be able to manage all the customer networks, servers, ip-cameras and other "smart" hardware remotely. The customer needs also be able to "access" their own network(s)/site(s) remotely.

The current requirements are:

• Our internal "office employees" should be able to access all client sites remotely from our office(s)
• Our service employees which are "on the road" need to be able to access all client sites from any location
• Our customers need to be able to access their own sites remotely from any location, including via mobile phone
• We preffer centralized connection / user management
• There should be an option to use MFA to access the VPN
• It should be simple as possible for our employees and customers to setup the remote connection and manage the devices in their network (SSH, HTTP, steams,...)
• Its not required that there are conenctions between customer sites, they operate indivitually from eachother

Currently we achieve this by having OpenVPN clients at the customer sites, from there on we can "hop" further into the network. This works fine for SSH connections but is complicated for customers and our employees to manage applications or devices with web interfaces. We also don't have a device at the customers site where we can install an OpenVPN client on. In this situations so we need to install an extra (Linux) device for this. For this reason we are looking for another solution.

We thought on something like an L2TP/IPSEC site2site between our head office and each customer sites. This is easy to setup, easy in use for our employees/customers and simply to maintain in terms of user/connection management and configuration. We would place an router with L2TP/IPSEC support in "front" of the customers network which manages the VPN connection. We can simply prepare the routes at our office and distribute/install it at the customer site. The issue here is that i have no idea how i can manage that customers have only access to their own sites.

Currently we have an PfSense firewall which support L2TP/IPSEC so it would be great if we can use this for the VPN connections. If a seperated VPN server is recommended for this, we have also the ability to run a VM internally for this.

Questions:

• Are there best practices for situations like this?
• Is L2TP/IPSEC suitable for this scenario or is there a better solution? (in terms of max amount of site's or user management)

• How can i achieve that our employees can access all sites and customers only sites we gave them permission to

• If the VPN "achitecture" i described (independently of L2TP/IPSEC) is the way to go, how should i deal with IP ranges as DHCP should run on the client site in case VPN connection is lost.

  • DHCP on client site, each site in antoher subnet?

I Googled about L2TP, site2site VPN, site2multi-site VPN connections and so on but could not find a clear answer to the questions above. I hope someone can help me or send me in the right direction.

Diagram:

To make my story a bit more visual i tried to make a sketch of the network as we think it should be...

Answer 1

1. Forget L2 VPN, it doesn't scale. Use routed/L3 VPN.
2. Create a global addressing plan, so customer networks are all uniquely addressed. Allow space for future growth. If there's ambiguity, resolve it by renumbering. This actually spares you a great deal of pain later on.
3. You will need a VPN gateway at each location, IPsec preferred.
4. Connect all customers per IPsec VPN - that allows your supporters to directly access remote networks.
5. Set up routes on the customers' routers for the "large" network. At least the head office and the user-VPN subnets are required.
6. Make sure there's sufficient bandwidth in your head office's Internet connection.
7. Run a central user-VPN gateway there (or even multiple, depending on the required features).
8. Most people prefer SSL VPN solutions for users (like OpenVPN) as they're easier to support and maintain.
9. Create appropriate routing filter/firewall rules to allow users access to their respective network and your staff access to the required customer LANs. You could e.g. use distinct VPN client IP ranges/subnets for each customer and use a single firewall rule to allow them access to the appropriate VPN peer.

Specific product recommendations are explicitly off-topic here, sorry.

A key issue here is to establish a global numbering plan. Duplicate or overlapping IPv4 subnets cause a tremendous amount of workarounds. If v4 renumbering is out of the question, you might want to consider using an IPv6 network in parallel.

With IPv4 and a clean plate you could e.g. use 10.x.0.0/16 for each customer LAN (space for 256 subnets of 254 nodes each), if 256 customer/office locations are sufficient.

You could reserve 10.x.254.0/24 for VPN clients, so firewall rules would be very transparent. Avoid common values of x like 0, 1, 10, 255 to best avoid collisions with already existing numbering schemes.

Of course you can adjust that scheme for your needs. To allow more customers/locations with smaller networks you could use /20 prefixes instead of /16 for each one.