ALERT: Datto Drive Cloud service is no longer available. For more information, see our end-of-life article. If you'd like to migrate your data to Datto Workplace, see our migration guide.

Configuring Layer 2 and Layer 3 Site-to-Site VPN

Follow

Topic

This article describes configuring Layer 2 and Layer 3 VPN connections for disaster recovery scenarios and disaster recovery testing.

Environment

  • Datto Partner Portal

Description

Layer 2 and Layer 3 site-to-site VPN configurations require virtualization of a full or partial production network in the Datto cloud.

Supported Recovery Scenarios

  • Test Scenarios: Due to the risk of disruption to your production network, Datto can only support Layer 2 and Layer 3 site-to-site VPN testing under specific conditions. See our Preparing For A Cloud Virtualization Test: Policies, Procedures, And Partner Responsibilities article for more information.
  • Disaster Recovery Scenarios: During live disaster recovery scenarios, Datto can provide best-effort support for Layer 2 and Layer 3 site-to-site VPN configurations.

Index

Layer 2 Site-to-Site VPN

Note: Datto is only responsible for the VPN configuration to the off-site server, and cannot make any changes to your network infrastructure. You will also be responsible for configuring static routes on your off-site virtualizations.

Use Cases

  • You need to virtualize one or more systems protected by a Datto appliance in the Datto cloud.
  • You want the virtualizations to continue to communicate as if they are on the production network with the Datto appliance.
  • You do not want to have to create VPN keys for each client computer that needs access to the VLAN.

Prerequisites

  • The production network must be functional.
  • Use this configuration when the off-site VLAN has the same subnet as your client's local LAN.

Procedure

Figure 1: Layer 2 Site-to-Site SSL VPN overview (click for larger image)

Create a Site-to-Site (B2B) Layer 2 tunnel using OpenVPN. The gateway can be hosted on any of your client's on-site hardware capable of running Linux.

The local hardware can be a Datto appliance, or any Ubuntu 10.04, 12.04, 14.04, or 16.04 device with working network drivers, including a device booted into a live CD environment. Datto does not recommend using a Virtual Machine as the local device, because some hypervisors strip traffic between the host and guest.

Start a hybrid virtualization through the Datto appliance GUI, or start an cloud virtualization through the Recovery Launchpad, and then contact Datto Technical Support for assistance with configuring your endpoint device to route traffic between the off-site (VPN) network and your client's local network.

Layer 3 Site-to-Site VPN

Note: Datto is only responsible for the VPN configuration to the local appliance. You will need to configure static routes on all of the off-site VMs, and return routes on the client's network. You will also be responsible for configuring static routes on your off-site virtualizations. Attempt this procedure only if you are skilled in networking. It involves subnetting, static routes, bridging, and gateway services, such as IP forwarding.

Use Cases

  • The production network will be down for an extended period.
  • One or more large remote sites need to be able to communicate with the Datto cloud.

Prerequisites

  • The production network is down.
  • Use this configuration when the off-site VLAN has a different subnet from the client's local LAN.

Requirements

  • For each network, you will need an endpoint. This can be an on-site computer running Ubuntu, or a Datto appliance.
  • At each site, you will need the ability to add static routes to the default gateway or to the individual computers of each site.
  • All sites must have port 5196 open from the endpoint to the off-site server hosting the VLAN.

Procedure

The local device needs to be configured to receive the VPN connection from the off-site server. Contact Datto Technical Support for assistance with this configuration after you have completed the steps in Prerequisites and Requirements.


Was this article helpful?

0 out of 0 found this helpful

You must sign in before voting on this article.

Want to talk about it? Have a feature request?

Head on over to our Community Forum or get live help.