VPN IP assignment

Many organizations use VPN concentrators to allow remote clients to access the office network from their house or on the road. This configuration typically requires the remote PC to establish an encrypted tunnel and the PC's side of the encrypted tunnel is assigned its own IP address. The tunnel address is usually on the office's subnet but there are many ways to assign the address.

The most common methods for assigning the address are

  • by username, where the VPN administrator assigns each user ID a specific IP address. This method isn't scalable because you need an address for each user. For instance, if you have 500 users, you need 500 addresses, even if only 50 of them are ever logged on at a time. It's also a big pain to keep track of addresses.
  • via a pool, where the VPN administrator sets a range of addresses (called a pool) and then the VPN device handles assigning them dynamically as users log in. This method works well for most organizations.
  • via DHCP relay, where the VPN device obtains an IP address from a DHCP server. This is the most scalable and is the least difficult to configure and maintain. It will also be important when Dynamic DNS and similar protocols are used for IP Telephony connectivity.

Given these choices, many organizations choose the third option, but there is a tiny problem: the most common reason system administrators log into the office network is to fix network problems. If there is a problem on the internal

    Requires Free Membership to View

network that prevents access to the DHCP server, the administrator will not get an IP address, and the VPN negotiation will fail, forcing the administrator to drive into the office to fix the problem.

A better way to configure IP address assignment is to configure the DHCP relay option, but to give your administrators static IP addresses. Keep in mind that in most VPN devices, these three methods aren't exclusive, but you can't have pools and DHCP using overlapping addresses. In this case, the statically assigned administrator IP would take precedence over the DHCP address, which would permit the VPN tunnel connection.

If you have a group of administrators, consider creating two groups: a user group and an administrator group. Assign the DHCP method to the user group, and a non-overlapping pool to the administrator group.

Thomas Alexander Lancaster IV is a consultant and author with over ten years experience in the networking industry, focused on Internet infrastructure.

This was first published in July 2002

There are Comments. Add yours.

TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.