How do I configure a VPN Site and Subnets in Lync when clients have /32 Addresses?

Question

Hello,
I've found a few people asking this question out in the "interwebs" but no one seems to quite answer their question (Those poor souls).
In most occasions that I've seen, my customers have configured their VPN networks with a /24 (255.255.255.0) ip address.  However, when those clients connect to the VPN they are actually getting a /32 (255.255.255.255) address. 
This seems to pose an issue for Lync reporting when it comes to configuring a VPN site and VPN subnets.
(NOTE:You might ask why these customers are not going about best practice and using split-tunneling?  In this case, they absolutely CANNOT institute split-tunneling so all traffic MUST flow through the VPN tunnel.)
For example sake, here is how I would imagine to setup a VPN site with subnets in Lync Network Configuration:
VPN (Site)
    -172.16.33.0  /24 (Subnet)
    -172.16.34.0  /24 (Subnet)
    -172.16.35.0  /24 (Subnet)
The problem is that when I run a Location Report in Lync to look at call data to/from the VPN site, it's not there. Reason being, the VPN client was given a /32 address which doesn't match up to the /24 I configured in Lync. 
So, in my mind my options are:
Create a /32 subnet for each single address corresponding to a VPN client and attach them to the VPN site (What a mess).
Change the subnet mask for the 3 subnets I've defined to /32 instead of /24 and see what happens even though putting an IP address of 172.16.33.0 /32 doesn't make much sense.
Remove the subnets and site from Lync because CAC and Bandwidth control are actually useless over VPN.
Any thoughts on this?
John K. Boslooper | Lync Technical Specialist | Project Leadership Associates
Phone: [phone] | www.projectleadership.net

Answer 1

Jin,
/32 addresses are a valid subnet mask, however that means that a host with a IP Address of 192.168.23.4 and a subnet mask of 255.255.255.255 (/32) is the ONLY host on that subnet.
The VPN configuration is correct.  The /32 mask is common with a Juniper VPN  (which is what they are using) and the DHCP server that is handing out the addresses is the Juniper VPN appliance. 
They have already started working out a plan to use a different internal DHCP relay which should hand out the addresses correctly. 
There has to be someone else out there with this issue or that can point out that i'm overlooking one key principal with VPN subnets.
Anyone? 
John K. Boslooper | Lync Technical Specialist | Project Leadership Associates Phone: [phone] | www.projectleadership.net