When a company has several branches, everyone needs access to the financial software, files and central systems. A site-to-site VPN builds an encrypted tunnel between two offices over the internet, so the networks on both ends work together as one, without the need for an expensive dedicated line.
How Is Site-to-Site VPN Different from Remote Access VPN?
With remote access VPN, each user connects using software on their own laptop or phone. With site-to-site VPN, the connection runs between two devices (firewalls or routers) in two offices, and branch users can reach central resources without any special software. The most common protocol for this is IPsec.
Step 1: Addressing Without Overlap
The most important and most common mistake is overlapping addresses. If headquarters and a branch both use the default 192.168.1.0/24 range, the tunnel comes up but traffic does not flow. Before anything else, assign a unique range to each office, for example:
- Headquarters: 10.10.0.0/16
- Branch 1: 10.11.0.0/16
- Branch 2: 10.12.0.0/16
This pattern is easy to read and leaves room for adding more branches later.
Step 2: Architecture: Star or Full Mesh?
- Star (Hub-and-Spoke): each branch connects only to headquarters. Simple, and suitable when most traffic goes to central servers.
- Full Mesh: each branch also connects to every other branch. Useful when branches work directly with each other a lot, but management becomes more complex.
For most companies, the star model is sufficient and easier to manage.
Step 3: Secure Tunnel Settings
- Use modern encryption algorithms, such as AES with a 256-bit key and SHA-256 or higher, along with IKEv2, and retire old algorithms such as DES and MD5.
- Choose a long, random Pre-Shared Key, or use digital certificates.
- Allow only the traffic that is needed; not every branch needs full access to every central server.
Step 4: Backup Link and Automatic Failover
An internet outage at a branch means that branch stops working entirely. With a second internet link from a different provider and automatic failover, the tunnel comes up over the second path if the primary link goes down. Technologies such as SD-WAN do this more intelligently and can shift traffic based on the real-time quality of each link.
Step 5: Prioritize Business Traffic
When a large file download fills a branch’s bandwidth, the financial software and phone calls slow down. With traffic prioritization (QoS), important business traffic always goes ahead of less important traffic.
Common Mistakes and Their Symptoms
- Address overlap: the tunnel is up, but nothing works across it.
- MTU problems: web pages or file shares sometimes fail to open or load only partially; usually fixed by configuring MSS Clamping on the tunnel.
- Tunnel drops after a while: mismatched Lifetime values or DPD settings between the two ends.
- DNS: branch users cannot resolve server names because headquarters’ internal DNS is not in the branch settings.
Monitoring: Before the Branch Calls
Monitor tunnel status, latency and packet loss so that outages or quality issues are spotted before users complain. An automatic alert when a tunnel goes down gives you a chance to fix the problem before the workday starts.
If a new branch is on the way or your current branch connections are unstable, ITPlus724 engineers can design and deploy secure inter-branch connectivity for your company.