VPN- Netgear vs. Linksys

[CNS]

I wanted to get an opinion on VPN router preference. I am setting up a small business with 25 users and I would need to setup 4 VPN tunnels, possibly more.Currently, they are all setup on Netgear devices and I prefer working with Cisco/Linksys. Has anyone worked with Netgear VPN routers, any recommendations,or devices.
I personally am looking at JGS524E.

 

[14049752]

You're looking at a switch for VPN set up?

Personally, I prefer a good DD-WRT based router. I've never been fond of the Netgear or Linksys routers I've set up, because they require a license and their own VPN software. Maybe I just set up the wrong ones, though.

I like DD-WRT because you can do PPTP vpn if you don't care too much about security, or you can do OpenVPN with decent encryption and authentication. It's also pretty good at site-to-site VPN setups, too.

 

[teksquad]

I deal with cisco pretty much all the time so thats what I prefer. Depending on the type of VPN would determine what device I go with. For L2L and remote access vpn's I prefer the ASA's but they can be setup with the IOS routers as well. I prefer the ASA as not only is it a good Vpn termination device but a excellent statefull firewall/ALG for your network edge. How many sites are we dealing with? Do these sites need to connect to each other. If so a DMVPN may be the way to go. DMVPN is only supported on routers with the appropriate feature set. As with anything cisco you need to check the licensing requirements and vpn throughput for each device. Both the IOS routers and ASA's support SSL Vpn as well with the appropriate IOS and licensing. The anyconnect client is a great alternative for users that are comfortable with a vpn client (like the cisco ipsec vpn client) but using an SSL vpn.

 

[krtechsolutions]

Cyberoam or sonicwall

Or maybe untangle

 

[Aescaepulus]

ASA 5500 series. I usually purchase a second license on an ASA 5505 to run VLAN as well. Kinda pricey for licenses, but I like the ASA's due to their flexibility and strong edge security applications.

 

[YeOldeStonecat]

Are you looking for "site to site" VPN tunnels to make a WAN?
Or are you looking for road warrior VPN to allow remote users to connect?

Site to site...doesn't matter, IPSec or OpenVPN.
I see you mentioned PPTP VPN...so I'll guess you mean for road warriors. Go with SSL VPN. MUCH easier for you to support. Browser based....no clunky thick VPN client to have to fix every now and then. SSL VPN is soooo dang easy and reliable for the end user.

I've worked with many different netgear and Stinksys/Cisco units...I tend to not be overly fond of Netgear units because of years of slower prosafe models...but they do have a good little SSL unit. As does Cisco (formerly Stinksys).

For a couple of remote connections...using an all in one built into the router is OK. But if they plan on growing and have more than several at once connect....going with a dedicated VPN appliance is the smart approach...have it sit behind the router.

My favorite SSL VPN appliance is a Juniper SA model....expensive, but rock solid and brutally fast.

 

[teksquad]

As long as the ASA you get has the specs you need and supports the the required vpn connections, total connections and offers the appropriate throughput then you don't really need a dedicated vpn device. Cisco use to have the vpn concentrators that where a vpn only termination point but they have been end of life for some time now as the current ASA's can work just fine as a statefull firewall, ALG and vpn termination point. Whether you want to put the ASA on the edge of your network thats another thing. I usually put a router upstream that is directly connected to the service provider and the ASA behind that. This will allow for some pre-filtering at the edge and may be required depending on how the service provider hands off the circuit to you.This may not be an option though for all business's.

Another benefit of the ASA is the ability to have multiple contexts or virtual firewalls (similar to VRF's in the router IOS). Very handy if you doing any kind of shared hosting or need separate firewall polices for certain organizations. You do however loose some functionality with multiple context mode. No Vpn, dynamic routing being the big two.

If your remote offices need direct connectivity to each other then DMVPN is the way to go (Dynamic Multipoint VPN) This is only supported on IOS routers though. Basically on the head end device its a multipoint GRE tunnel with IPSEC protection. Uses NHRP to dynamically register the remote sites so your remotes can have dynamic ip's.