Client to VPN tunnel

There are a host of problems that could arise. You're essentially betting that their (the remote sites) security procedures match yours. In other words, you're creating a two way trust. In my Security Solutions newsletter, one of my columns was devoted to just this circumstance. I'll paste the applicable parts.

This is generally a bad practice, because: "This exposes your network to whatever security measures are employed or lacking at the other end of the wire. Also, it allows a direct siphon of your information to an outside source. There is only one safe way to do allow someone to sit behind your network security and communicate with a non-trusted network. Remove the workstation account from your domain. Provide the user with a local logon name and password of their choosing and create a VPN from that host to the network they need to access. Of course, the external company should supply the VPN software. If they?re running a firewall, chances are they have a remote client VPN software solution that should work nicely. Once the ?rogue? workstation is configured with the VPN client, it?s just a matter of allowing the VPN session through your network security devices."

Now, they will have to move information from the rogue machine to your network (I hope you have virus scanning). I have always found it best to NOT trust my security to another administrator that I don't know.

Good luck,
0bytes

Two things, one first find out if their VPN supports NAT traversal. As your internal client will be traversing your firewall you will not be able to use udp port 500 (unless you have a static Public IP address mapped) but will have to use a TCP portinstead (1024 or above). This will have to be set-up in advance on your client and the remote VPN device.
Point two, once connected you will open up your network to theirs, we run a similar approach but always have our VPN server on a separate ethernet segment from the rest of our network.

This question was closed by the author