4

I want to use my home computer (a Mac with nice big thunderbolt monitor) to remote desktop into my work laptop, which is on my home network. I want to do this because the screen on my work laptop is terrible and small.

I am able to remote desktop into my work laptop so long as I am not connected to VPN on my work laptop. But as soon as I connect to my work laptop via corporate network via Cisco VPN client, my remote desktop connection from my home computer is discounted and I'm no longer able to connect.

It may help to point out that when the corporate laptop is not connected to VPN, I have a local network IP address (192.x.x.x) only. When connected to VPN, I have an additional IP (10.x.x.x) representing the VPN connection. This may not be surprising or helpful information, but thought I put that out there just in case.

closed as off-topic by Wesley, MadHatter, HBruijn, TheCleaner, kasperd Nov 14 '14 at 17:50

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions must be relevant to professional system administration. Server Fault is dedicated to professional system and network administrators. End user and enthusiast questions are off-topic (contact your system administrator or hire a professional to help you out). Please see the Help Center for more information." – Wesley, MadHatter, HBruijn, kasperd
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    See if there is an option in the VPN client to route all traffic through the VPN interface, and make sure that is disabled. – jbsmith Nov 14 '14 at 15:52
  • Why not just connect the laptop to an external monitor and use it directly? – joeqwerty Nov 14 '14 at 15:59
6

With a Cisco AnyConnect VPN there is an option on the client side to allow this IF the VPN admin is allowing split-tunneling.

You can see the option here:

enter image description here

As far as on the firewall itself, if you are the VPN/firewall admin (I'm guessing you aren't) then the setting is similar to this here:

enter image description here

3

I suspect your corporate laptop VPN has been set up and configured a mode to tunnel ALL traffic down it and not just corporate traffic. In order for you to remote desktop, you will need to have it set up in a split mode.

I am unfamiliar with the Cisco VPN but, for example on Sonicwall SRA devices the option is "Tunnel all mode".

Many sysadmins setup their VPN like yours to avoid laptops like yours effectively being able to "bridge" between the internet and the corporate network.

  • It is unclear how much of a difference it really does to security. In case the laptop was compromised there are many other ways it potentially could bridge into the corporate network. Having compromised the laptop malware could bypass the IP stack and access the LAN anyway. Alternatively it could run an SSL connection through the VPN to a server controlled by the adversary. Certain attack patterns work quite well with alternating access to target and attacker. And finally in some configurations you end up with IPv6 routed through the VPN and IPv4 to the LAN or vice versa. – kasperd Nov 14 '14 at 17:50

Not the answer you're looking for? Browse other questions tagged or ask your own question.