Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I work at a mid-sized organization that is set up on a domain. We have a hardware firewall set up for VPN access and a client on each user's computer for network access outside of the office. We have a new customer who would like us to share data with them by connecting to their VPN. Is there any information I should be aware of when considering this situation? Could it cause more harm than good? The customer's IT department is making it seem like we shouldn't have any issues, but I think it is a bad idea. Opinions please.

share|improve this question
    
Why do you think it's a bad idea? –  John Gardeniers Oct 5 '11 at 1:30
    
Just thought it might mess up routing or be a security problem –  advis12 Oct 5 '11 at 1:47
    
That's fine. If people know what your concerns are they can address those points in their answers. –  John Gardeniers Oct 5 '11 at 3:12

2 Answers 2

up vote 1 down vote accepted

Do a quick audit of the RFC 1918 (private) IP addresses in place in both LANs. This can cause quite a headache if you both use, for example, the ubiquitous 192.168.1.0/24 network.

Aside from the potential networking snafu, carefully consider what servers will be exposed by the VPN on your end and how you will protect them against traffic routed through the tunnel.

share|improve this answer

We do it with important partners/customers, but apply ACLs to what each side can access. It's pretty much the same concept of least privileges that is commonly applied.

For instance, if the customer needs to get to a web service in my network, his network is allowed only port 80 access to the 1 server. In reverse their side won't allow any traffic originating from my network.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.