How to deal with multiple client VPNs

Question

So, previously I used a management server where I had access to all my client's different VPN connections using site-to-site connections to the firewall on the network. Unfortunately, due to security upgrades, they have now decided to switch to (10+) client VPN connections only.

As I am already using several other client VPN connections to other networks with conflicting IP configurations and subnets, it's almost undoable to install these connections on my PC locally. As a temporary solution I now run a few virtual machines that each have a VPN connection set up in the guest's Windows OS. However, as the number of needed connections grow, using all these resources for each VM seems almost ridiculous.

Is there anyone who has any experience with this kind of situation and/or has any suggestions on how to deal with this more effectively?

Answer 1

Your question seems fabulous and I'm sorry it didn't get enough attention earlier. Unfortunately, it's lacking some of the details that would make this easier to answer. I hereby try a bit to answer it anyway.

First, I will get this information request out of the way.

You mention your "client's" VPN connections. There client refers to a customer. Then you say "client VPN connections", but I'm wondering if, at that point, you're not referring to a customer, but an end user workstation in a client/server model.

It would help if your question had more details about what your current subnet map looks like (with proper fictitiousizing of sensitive information, of course).

For instance, are we talking about 3 sites, or 13, or 73? Who are the sites owned by? It seems like you're in a role of supporting your client's network, but then the client imposed technical networking rules on you. So, who is in control? (In multiple small MSP businesses where I worked, the company supplying the technicians was in nearly full control of all details, and certainly in full control over more specific details like how VPNs were implemented.)

Without these details, a perfectly good answer for one environment may be very unsuitable for another environment.

But now, instead of just imposing questions, let me try to address this with some suggestions.

One of the keys to making such scenarios work easier is to have a clean and well-working network design. If the current layout of various subnets isn't working, that may need to be re-designed. Unfortunately, "renumbering" is notorious for being expensive and challenging. (Even though the act would seemingly be free, it takes time to design the scheme and can take more time to implement it.)

It can often be helpful to think about: "What is working for people who may be in similar situations?" I don't mean the situation of having lots of VPNs. I mean, more broadly, a situation like having multiple computers on different sites.

Typically the goal is to have your own internal network working well. As for connecting to remote networks owned by other companies, there is some risk of IP subnet overlapping. If people do a fairly decent job of trying to somewhat randomize the third IPv4 octet, that can reduce the chances of overlapping, but with enough networks, it certainly can still happen (especially with 192.168.low-number or 192.168.168, which are popular).

The typical solution for handling multiple clients is to not need to connect to both of them simultaneously.

Ultimately, sometimes there are conflicts, and that leads to pain.

Of course, renumbering subnets willy-nilly is not a suitable alternative. What is often a bit more reasonable to implement is NAT.

Edit 1: Before going into NAT, let me though out another possible approach. If you're using IPv4 and can adopt IPv6, but haven't yet, then using that technology can introduce another set of numbers while also feeling rather productive, as your solution provides more benefit than just moving an IPv4 subnet around to try to avoid a conflict.

As a brief overview of various methods on how you could implement NAT, one method is using PNAT, Port-based Network Address Translation, sometimes called PAT or NAT, which is often implemented by having just one IP address being "overloaded", used for multiple types of connections by just using different port numbers. However, you can also have "1-to-1 NAT" where a block of X addresses at one location corresponds to a block of X addresses at another location. (This may be the approach that is easiest to use and maintain, if you can just identify available network address blocks to pull this off.) Using a 1-to-1 style of NAT may be easier to set up than the possibility of a "Dynamic NAT" solution where the address blocks may be inequal in size, perhaps acting similar to PNAT but using multiple addresses in a subnet, rather than multiple ports with an IP address. If you map multiple ports with PNAT then you could also map multiple addresses, but that flexibility is often of unnecessary layer of additional complexity.

Implementing such NAT often takes a bit of time thinking about what addresses should be used, and may take more considerable time and skill implementing rules on infrastructure devices (routers/firewalls/etc.) That may be painful. However, once set up on the infrastructure devices, the experience may be painless for the end user workstations.

That may sound a bit painful. As I stated before, "Ultimately, sometimes there are conflicts, and that leads to pain." I've seen official Cisco training material, designed for colleges training network professionals, admit to that. So, if the world's largest organizations are not able to completely avoid pain, you may not be able to either.

For more specific details about the technical design, I wonder if you might be better off asking questions on NetworkEngineering.StackExchange.com

If you feel like you're struggling with having your client's requirements not mesh well with what you are trying to accomplish, an effective route to seek more advice on that front may be to think of your client as an employer, and ask a question on how to handle such a conflict at Workplace.StackExchange.com

Answer 2

We only connect to one remote network at a time, using mainly Cisco Anyconnect so conflicting IP addresses/ranges is not an issue. Our local-laptop gets assigned a new IP address on the remote network and all traffic is routed through the VPN tunnel. No local traffic is permitted , although this is configurable. Multiple local-machines can connect at the same time each is an independent connection.

We did at times use other VPN-Clients, although we did have issues with multiple Clients on the same machine.

The other clients we use authenticate us and then establish a RDP connection to the remote network. All management and support is performed on the remote sessions.