Setting up a new company network

Question

My company has about 20 employees and is growing quickly. We are moving to a new office in a few months, and I would like to setup the network there to be able to handle the growth.
Specifically, I would like to buy a router that can handle around a dozen ipsec tunnels at whatever our connection speed ends up being (at least 50Mbps) and also L2TP for those travelling. The remote end of the ipsec tunnels would be the homes of engineers, so we would also want some relatively cheap routers that we can setup in those homes.
Additionally, we already have a 2504 wireless controller and a dozen aironet 1042N APs. Part of the goal here is that the APs in peoples' home offices can still be managed by the wireless controller.
What are my options here for both the main office router, and then the small routers for remote locations? Our CEO is pretty stingy, so I'm looking to do this a cheaply as possible, while still doing it 'right.'
Thanks.

Answer 1

Aaron Solochek wrote:We actually applied for a Meraki small business startup kit, but I'm guessing we were rejected since I never heard back from them. I even emailed a friend of mine who I discovered was an engineer there to ask him about it, and he had no information. Their stuff seems pretty cool, and IOS isn't the easiest thing in the world to deal with, but once I got the wireless controller dealing with the network became much much nicer.
Doesn't sound like Meraki did themselves any favours there. It's not all a bed of roses our side either. They seem to be struggling to meet demand and the admin for their partner training is a bit of a mess at the moment.
Aaron Solochek wrote:My question regarding wireless is in reading through lots and lots of literature about aironets, I read something about a mode where they can be deployed in a remote location and continue to route their traffic through the ap controller. This is what I'm looking to do, because the stuff we work on at my company relies on mdns, so if its possible to have the wifi network appear on the same subnet regardless of the physical location, that would be very handy.
You're probably thinking of FlexConnect (using H-REAP protocol). It has various modes as I understand it and lots of caveats to watch out for. Probably one for the wireless section.
http://www.cisco.com/en/US/docs/wireless/controller/7.4/configuration/guides/flexconnect/config_flexconnect_chapter_01.html
However, you might think about whether or not you want centralised authentication (i.e. HQ) or local authentication (i.e. branch). And whether you want centralised switching or local switching of data packets: -
Centralised authentication and centralised switching requires 'connected' mode. Your HQ controller will handle both the authentication and switching of data packets. If the WAN link fails, then the branch office is dead, unless you have a DR site with second controller.
Centralised authentication and local switching means your HQ controller handles authentication and the branch AP switches data packets locally. Again, this is only available in 'connected' mode. If the WAN link fails, then any authenticated clients can continue to operate. Any re-authentication of existing clients or authentication of new clients is not possible without the WAN link.
Local authentication and local switching means the branch AP has local access to an authentication server and switches data packets locally. There are two modes available, 'standalone' and 'connected' mode. Of course, they vary slightly in operation
Simple isn't it Are you sure you don't want to try Meraki once more...