External access to internal vlan

[vinayak-nayak]

Hi All, 

I need to setup a solution where a set of CCTV cameras are within the private vlan (internal) but needs to be accessible by a 3rd party vendor from outside the network over internet. How to achieve this ? 

Is it just by putting an access-list for permitting an ip subnet from which the vendor would access it ? OR does this need some sort of VPN solution ? 

Note : The internet traffic goes through a firewall (which has the typical trust, untrust, dmz zones etc) and vlan falls under trust zone.

Please guide.

[Francesco Molino · Accepted solution]

Hi

You can have a nat solution which exposes these cctv to internet or provide a vpn access with only these cctv IPs.
I would recommend VPN for security reasons but you need to validate what access they need, sometimes they want a direct access from internet to avoid getting VPN for all customers.