Always On VPN Gateway server - client IP pools and default route

Question

Hello all, we are in the process of creating the infrastructure for Always On VPN and I have a couple of questions but I'll just detail our setup first:

3 x Windows Server 2019 Network Policy (RADIUS) servers
3 x Windows Server 2019 RRAS VPN Gateway servers

1. My first question concerns the allocation of IP addresses for clients; if I have a 600 address IP range, presumably I'd carve that up amongst the 3 gateway servers so they are each handing out 200 addresses i.e. I wouldn't define the same 600-address pool on each server, right?
2. Related to the above, I've seen documentation provided by a consultant that says the client IP addresses should use the VPN Gateways as their default roouter - is this correct? I can't seem to find this requirement anywhere else.

Thanks for any help, much appreciated.

Answer 1

Hi ,

My first question concerns the allocation of IP addresses for clients; if I have a 600 address IP range, presumably I'd carve that up amongst the 3 gateway servers so they are each handing out 200 addresses i.e. I wouldn't define the same 600-address pool on each server, right?

Yes, you are right. You need to define different range on each 3 VPN server instead of defining the same 600-address pool on each server.

Related to the above, I've seen documentation provided by a consultant that says the client IP addresses should use the VPN Gateways as their default router - is this correct?

For the VPN Adapter, the VPN server is used as the router by default. There is no problem with VPN server route in the routing table.

Best Regards,

Candy

--------------------------------------------------------------

If the Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Thankyou Candy, I have one last question; the reason we have 3 VPN servers is for redundancy and resilience, If I lose one of the VPN servers then does that mean I've lost a block of 200 client IP addresses? - and in that case would it be better to use DHCP rather than the VPN servers for handing out addresses?

Answer 3

Hi ,

Sorry for de delayed response.

the reason we have 3 VPN servers is for redundancy and resilience, If I lose one of the VPN servers then does that mean I've lost a block of 200 client IP addresses? - and in that case would it be better to use DHCP rather than the VPN servers for handing out addresses?

Yes, you are right. You would better use DHCP to assign IP address. If you worried to cover enough IP address in one single pool, you could create DHCP Superscope.

Here is a thread discussed before, you could have a look:

AOVPN Client IP Pool from multiple Subnet

Best Regards,
Candy

--------------------------------------------------------------

If the Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 4

Hello Candy, thanks for your help, I do have one more question - If we use DHCP should we specify the VPN Gateway servers as the default router in the DHCP scope options?