I have been asked to setup a vpn so amungst other things our users can

access groupwise via their client from home.
I have 6 sites but only one of them has internet access via BM 3.7 on
nw6
sp2.

1.
Do i just enable VPN on bm 3.7 and setup a client to site VPN. If i
do can
the client then access the other sites via the internal wan links ?

2.
When the client connects to the bm 3.7 vpn from their isp I assume
they will
be connecting to an IP address i make available to bm 3.7. Once theyconnect do they get an internal ip address to access the internal
services ?

3.
Any good reads on how to go about this solution would be appreciated.
Thanks
Gary