A business VPN connects approved users or sites across a network. A useful design starts with the resources people need and the boundaries they must respect. Broadband supplies the underlying connection; routing, authentication, security policy and support determine whether the business task works.
Choose the relationship you need
A site-to-site arrangement connects networks through gateways. Remote access connects an individual device or user to approved resources. An application-specific access service may be enough when users need only a few applications. Have an administrator map the requirement before selecting a product.
NIST’s Guide to IPsec VPNs explains IPsec deployment choices and their security considerations. The IPsec architecture defines policy and security associations, while IKEv2 provides negotiation and authentication mechanisms. Use current vendor-supported configurations and organisational security requirements when implementing them.
The term “IP VPN” also appears in managed carrier services. Ask exactly how traffic is separated and encrypted and where protection begins and ends. The MPLS guide explains a related carrier architecture.
Prepare an inventory the installer can use
- People and devices: approved groups, managed endpoints, authentication, recovery and offboarding.
- Resources: application names, server networks, required protocols and who owns each service.
- Addressing: local networks at every site, remote-client pools and any overlaps.
- Routing and DNS: which destinations use the tunnel, how replies return and which resolver handles internal names.
- Connectivity: provider, public-address or NAT constraints, upload capacity, gateway support and backup path.
- Operations: patching, certificate renewal, logging, alert recipients, escalation and rollback.
Keep credentials out of the planning worksheet. Restrict diagrams and configuration records to the people who need them. Have the administrator confirm that permitted access matches the stated role rather than granting an entire network by default.
Work through a branch-office example
A fictional two-site design
A branch uses 10.20.0.0/24 and headquarters uses 10.30.0.0/24. Branch staff need one headquarters application and its internal DNS service. The administrator plans the relevant routes, return path and scoped access rules, then checks both an authorised task and an unrelated resource that should remain inaccessible.
If both offices initially used 192.168.1.0/24, the overlapping addresses would need an explicit design solution before relying on a tunnel. Renumbering or a vendor-supported translation design is a planned network change, not a checkbox that the VPN automatically fixes.
These private addresses illustrate the reasoning. They are not a configuration to paste into a production device. Document the real subnets and dependencies, including IPv6 where present, before a change window.
Test the task and the recovery path
- Establish that the ordinary Internet connection works through the approved security controls.
- Connect with an authorised test identity and inspect tunnel and authentication status.
- Test internal name resolution and the required application, including a representative upload or transaction.
- Confirm that an unauthorised identity or out-of-scope resource is denied as designed.
- During an approved test window, exercise backup connectivity, reconnection and return to the preferred path.
- Record the result, logs, configuration version and person accepting the service.
A connected indicator proves only one stage. If the tunnel is established but the application fails, investigate DNS, routes, return traffic and policy. If small requests work but transfers stall, the administrator should inspect path-MTU and related gateway handling using the product’s diagnostics.
Make ongoing support part of the design
Identify who receives alerts and who can act if the Internet provider, gateway, authentication service or certificate fails. Keep an approved management and rollback path available during changes. A second connection helps only when the design and application have been tested across it.
Review accounts, updates and certificate expiry on an agreed schedule. For a support ticket, supply the affected task, time, device/client version and sanitised error or log excerpt. Keep required endpoint protection enabled while troubleshooting; broad firewall exceptions can obscure the original problem and expand access.
Explore the Internet library
Internet: Connections, Networks and Online Life brings together connection choices, network explanations, travel connectivity and practical online tasks.