Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Back Story:

I work in the IT Department for a company that got its start by being given space to work out of from a warehouse when my company first got its start about a decade ago. Ever since then, the owners of my company have provided "favors" to the owners of the warehouse.

The Problem

The warehouse has an old, poorly designed Microsoft Access 2003 application that has been hosted on my company's servers for a very long time. They connect to it via RDP.

We are in the process of upgrading our servers (and software) and want them completely off of our network due to the major pain it has been to support their lack of tech-savvy-ness, their old Windows Vista computers, and the fact that network printing kept breaking for them.

I am working on a solution to move their Access database in house for them. One of the needs is that the warehouse owner can connect to it from her house (the outside).

Our owners still don't want to abandon them, so here is our solution: Provide the Warehouse with a new desktop computer that will host the Microsoft Access database. Take out their home-grade router, and put in a Cisco ASA 5505 (on a free extended loan). Use File Sharing (so each of the other computers will also need Access 2003) so that everyone can get to it.

However, I'm still trying to figure out the best way to allow the user from the outside connect to the Access resource.

I have already built the local interface, complete with working DHCP and pointing to OpenDNS' servers for DNS. I don't have their public IP address yet (although I know its Static), so I will build out the public int as well.

I have built the Access List to allow traffic from the Warehouse owner's home (which is on Static IP), as well as traffic from my company, as we will continue to support them.

I'm not very familiar with Cisco, but have been studying (thinking about taking the CCNA soon), and have played around with the ASA we will eventually deploy to their location. My understanding is that the ASA can support VPN, is this correct?

In order for the external user to connect inside, would it make the most sense to build in VPN functionality into the ASA? Are there any caveats I should think about?

Or can you think of any better solution?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

If you are looking to avoid VPN or RDP, you could isolate their network (if not done so already, for security), then use something like LogMeIn. If it's only for one person, a simple solution that's easy to support is what I'd be after. You'd be able to have them log in to the site, and securely connect to the hosting PC. No extra hardware needed.

share|improve this answer
    
This was what we ultimately decided to do. –  David W Jan 12 '13 at 21:00

Another solution is to publish the access app via Remote Desktop RemoteApp. This requires terminal severs (windows server, standard edition will do) and licenses to match.

However, the end result is:

  • no vpns
  • simple port forwarding
  • a single icon on the desktop
  • far less stuff to support
  • works from virtually any network without issue
share|improve this answer
    
I'd certainly recommend using RDP to access the MSAccess database rather than running it off a shared filesystem unless you can migrate the backend to a proper multi-user DBMS. But I strongly disagree that RDP is adequately secure on its own really a VPN is the way to go - OTOH A Cisco 5505 is overkill for this type of installation. –  symcbean May 27 '12 at 22:21
    
@symcbean - what are your major concerns with RDP? With NLA and SSL it's no less secure than your online banking... With non-technical people I try to avoid VPNs like the plague, because they are just too inept to figure it out. It sounds simple, but they just screw it up too often. Simple Stupid is the way to go –  Mark Henderson May 27 '12 at 22:53
    
Unfortunately, they don't have any server onsite - otherwise, I would have done just that (that's exactly what they are doing to connect to our network / hosted app). My concern is also with multi-use. There's only 2, MAYBE 3 people who ever access the application to begin with, so I don't think that scenario would happen too often, but you never know... –  David W May 28 '12 at 1:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.