This has been a problem to figure out for some time! We have 4 locations (hq & 3 branch's), with a netware 3.12 at each, ipx only enabled, and some winmachines that logon to each respective server.No win servers.Broadband at each loc. Necessity: Management want to see each 3.12 server from HQ, (from 10 to 300 miles). We are told to set up a VPN. Some say a win2k adv svr at each location to act both as a vpn endpoint and as gateway to each novell server (also as setting policies for the win machines,backup, centralized management,etc). some others say to get 4 vpn routers alone, and some others say both the (4)win adv svr machines AND the (4)vpn routers. None has static IP, but the hq has the same wan ip everytime, even if it is restarted (it's a microwave), but the real need is connect to each location, not from each to hq (but be nicer, though). No problem if we have to change ip conf daily, there is a staff person at each location that could do that. Can we go with the win adv svr machines as vpn routers and gateways and keep ipx only at the netware machines? could be better a vpn routers solution and enable IP along with ipx at the server machines? (we prefer to keep ipx only because of the intrusion security it provides) Should be better to get both vpn routers And the win servers? Is is mandatory to get a static ip scheme on all four loc's? which one could work better : pptp, l2tp, ipsec, pptp/l2tp, ipsec over pptp, or other? The owner also wants to access the four locations from his home with his broadband access. Should we get a fifth router and/or a fifth machine with win adv svr also? If we need another vpn router to connect from his home to each location, could it work a 2-tunnel router here, changing settings to each connection, or should be better another vpn router with more than 2 tunnels? I call it reverse vpn, because the connection is not to a centralized location, but instead is from it to branches. Thanks to you all in advance. We will be much obliged.