In addition to local services such as those illustrated previously with our IPCop deployment, we may also be using the IPSec software in IPCop to configure a 'site-to-site' VPN to a branch or parent office, business partner, support company, or second site. In such situations, topology planning can become important as a network grows.

It is important, if we have more than one site, to consider exactly how we configure our VPN tunnels in order to provide a balance of service and stability to our clients. In a situation in which two branch offices attached to a main office both contain fileservers synchronizing content with each other, for instance, it would make little or no sense to setup two VPN tunnels from the branch offices to the main office in a 'spoke' topology. The extra hop would, during file transfers, slow down internet connectivity at the main site, and make for slow transfers.

Conversely, if we have many smaller offices with minimal requirements...