Need some VPN insight

Question

I work for a construction company that has anywhere from 20 to 40 remote sites going at any one time. Each of our sites has a construction trailer that has a locally provisioned cable or DSL connection, usually with a dynamic IP address. Each remote site has anywhere from 3 to 10 users. Our main office has a CheckPoint NGX firewall with 2 bonded T-1s serving as our connection to the internet. This is also where all of our file and application servers reside. We are currently kicking around ideas to implement a site to site VPN from all of our remote sites to the main office so that our users can access shared files and printers and we (the IT Department) can more easily support them with tools like VNC and stuff. We originally looked at going the Check Point route with either the Safe @ Office or the newer Edge devices but when we got a quote, we found it to be a lot more money than we were hoping to spend. We then looked at Untangle, a decent looking product that eventually fell short for us and was thus ruled out.
We found that we had a few Linksys WRV54G devices sitting around that weren't being used for anything so I thought I'd see what I could do with them. It does not appear that I can make these things talk to my Check Point firewall directly, so I am wondering what people typically set up at the "Main Office" for the remote WRV54Gs to talk to. I considered using another WRV54G at the main office but I was not sure if the little bugger would be able to handle the traffic from 30 or so odd remote sites at once. I figure whatever I end up using at the main office, I would just NAT it and open the necessary port(s) on the Check Point firewall to allow the VPN traffic in to the main LAN.
I guess I'm just pretty much looking for some opinions on how these little devices are normally set up and configured. I do currently have a WRV54G at the HQ side, behind my firewall with an IP address on my internal LAN and I do have it NAT'd on the firewall. I have been unable to get the remote WRV54G to establish the VPN tunnel with the HQ one, so I'm sure that I've got something wrong somewhere. Does this sound like a configuration that should work?
I appreciate any information.
-Chris

Answer 1

Nah, the Check Point ain't an issue. My test "remote" network is located outside of my firewall in a separate routed range. I have opened up communication through my firewall to allow ANYTHING from the particular external address to the internal address.
I do have this all working now, although I'm not entirely sure how I feel about how it's configured. To just get the basic VPN functionality tested and working, I put both WRV54G's outside of the firewall in different network segments and the configured the VPN. I was able to get this all working fine. I then brought one of the routers into the LAN and tried every combination of settings on its internet interface to get it to work. Eventually, what I ended up doing to make it work was plugging the internet interface into the "raw" internet outside of the firewall and assigning it an address in our routed range. I then plugged one end of a cable into one of the LAN ports on the router and the other end into my HQ LAN. The remote router was configured to hit the external IP (as I've had all along) and the VPN was successfully established. I'm able to ping remote servers and all that stuff.
I'm not completely sure that I'm totally comfortable with the thing configured this way since our super cool Check Point firewall is completely out of the loop here so I'm going to give this more thought. Now that I have the VPN established, I'm also going to have to test how logging on to the domain, internal/external DNS and all that other stuff is going to work. I noticed that I am unable to assign a WINS server in the DHCP scope on the remote router but I can assign a DNS server so I guess I can always go that route.
Thanks for the info.
-Chris