The following points should be taken into consideration when planning a Remote Access VPN configuration:

• Dedicated subnet - At least one dedicated subnet should be used for remote access VPN users. This subnet should not overlap with existing subnets on the private network.
• Address pools must not overlap - As it is possible to define multiple address pools, care must be taken to not overlap the address ranges in these pools. In addition, the address pool ranges must be unique with the router configuration.
• Routes to VPN clients are required - In addition to configuring the remote access VPN server and clients, routers on the corporate network must be made aware of the VPN client subnet so that they know to forward traffic destined for clients through the VPN server. This can be done using static routes and route redistribution in local routing protocols.
• Concurrent use of site-to-site and L2TP remote access VPN - The L2TP remote access server must not be configured if an IPsec site-to-site peer address is set to 0.0.0.0. Neither protocol will function properly in this scenario. This is a problem because it is unclear whether the incoming IKE connection requests are from a site-to-site client with a dynamic IP address, or an L2TP remote access client.
• Full Tunneling vs. Split Tunneling - Full Tunneling means that all traffic from the remote access VPN client (that is, traffic destined for the corporate network and traffic destined for the Internet) flows across the VPN. Split Tunneling means that only traffic destined for the corporate network flows across the VPN. Internet traffic goes directly from the client to the Internet. The advantage of Full Tunneling is that Internet access can be controlled centrally. The disadvantage is that it consumes more corporate bandwidth and VPN server resources to service the additional traffic. The advantage of Split Tunneling is that it it makes better use of network resources. The disadvantage is that Internet access control must be provided and maintained on the client. In addition, the routing configuration on the client becomes complicated and must be performed manually each time the client connects if the default classful route added by the client software (that is, a route to 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16) is insufficient (for example, if you need to reach both 10.1.0.0/24 and 172.16.1.0/24). If this is the case, and Split Tunneling is desired, OpenVPN is a better solution as it provides better Split Tunnel support. For more information on OpenVPN, see the Ciena Vyatta Network OS OpenVPN Configuration Guide.

  Full Tunneling is the default with Windows (L2TP) clients. Split Tunneling is the default with OpenVPN clients.