I am interested in knowing what the best practice is for dynamically issuing addresses to clients on a VPN. I have a Windows 2003 AD network where a DHCP server has already been configured with a pool of addresses (we're a small company so only one subnet). I was just going to let DCHP issue addresses to the VPN clients from the pool that's already set up. However in another post a comment was made that a separate address pool should be set up for VPN clients. So - if it is best to set up a different address pool, why? I don't mind reading if you have an article to reference - I just can't seem to find any on my own. Is it better to let the DHCP server on the network issue the addresses or should I let my firewall (which has it's own DHCP server and is where the client VPN connection terminates) issue the addresses? Thanks for the help. MJ

If you have a vpn firewall, dhcp from your server will never make it to the vpn client because of the firewall. If you were using RRAS as your vpn it does require a seperate dhcp scope. Given your situation you should only use the vpn firewall for vpn client dhcp. Configure it will a segment of your existing lan scope and remove that segment of ips from your servers dhcp scope so you don't have conflicts.