Managing outbound Remote-Access VPN to other organizations

[Ricky Sandhu]

We are increasingly seeing requests where an employee is working with a client who wants them to connect with them using remote-access VPN to access resources relevant to their active projects.  Are there any suggestions or best practice guidelines we can follow to allow this type of engagement to proceed yet ensuring safety and security of our our own network from malware breaches etc?

[balaji.bandi · Accepted solution]

best is to segment the network based on the resources ( IP address or device) working on the project.

So they will be contacting remote VPN and Locally you can allow what required those resources need to contact LAN side.

so IP address planning, VLAN, FW ACL

is this what you looking?

[Ricky Sandhu]

Hello BB, yes we are on the right path here.  Your suggestions got me thinking, although creating a separate network zone for a single client would be a nightmare, I could probably use ISE policies to either push an ACL when they connect to Wired or Wireless LAN or change their VLAN membership (and ultimately segregate them).  I do need to check if changing VLAN membership is supported on a wireless network. 

Thank you!

[Ricky Sandhu]

I was able to get this working.  Basically created a VLAN called RED-VLAN. This VLAN is segregated and we can apply security access control.  Created a policy in ISE to push an Authorization profile that uses Airspace ACL which matches a Meraki Wireless Group Policy.  On the Meraki APs, created a group policy to change the VLAN tag to 88 (RED-VLAN).  Also configured the Access control settings on Meraki to respond to CoA from ISE.  This worked perfectly.  Client associated to the corporate SSID, then CoA occured and they were moved to VLAN88.  

Unless anyone else has any other alternative suggestions, I think I will run with this solution and present it the management.

Thanks again @balaji.bandi for pointing me in the right direction.

[balaji.bandi]

appreciate your input. since we do not know, your environment, so I have suggested a high level, good you picked up nicely and deploy. ISE is a very good place to the segment.

Thank you for marking it as a solution.

[Dinesh Moudgil]

Hi Ricky,

In terms of prioritizing security over accessibility, you could tunnel-all the traffic from clients over to the ASA and then restrict the traffic based on resources required (either using split tunnel or to make it more specific VPN filter as well).

Please note that this will require ASA to process more traffic than usual from clients and could be resource intensive.

Thank you,

Dinesh Moudgil

P.S. Please rate helpful posts.

[Ricky Sandhu]

Hi Dinesh, thank you for your reply but we don't have any control over the third-party's ASA.  This is merely outbound VPN access to environment beyond our control.