External consultant needs access to internal server

Talleyrand

 External consultant needs access to internal server.

We have a 2700, that is connected to the internet via x1 and has a range of 4 ip addresses allocated.

currently we have IPSEC VPN for our staff

(NOT SSL VPN, extended network , due to the security issues Sonicwall has experienced) ,

This VPN puts the VPN staff into our internal address space.

Ideally, we DO NOT want the consultants, to come into the same address space as other users.

1. it's a security risk for the other users & the address space.
2. it allows any machine in that address range to cross probe other machines (we need this for It diagnostics.)
3. It gives full access to other business areas.
4. Who knows what these external non-corporate types have on their computers.

So

We require that:

1. We can setup another "pool" of VPN address space with relevant IP / another L2TP server.
2. this Can be accessed via a DIFFERENT external IP address (we have 4 available)
3. We can then keep this address space completely isolated from all our other assets and just have it that address space mapped to this server.
4. We can have extra controls for security for this single user, like blocking internet browsing for porn etc whilst under the company network

You can laugh.... but consider if the user has page refresh set on the browser.... as soon as the browser is active , it goes and prefetches every recent site the user has visited... over the VPN via our ntetwork

Which puts the company in the position of having to report any illegal activity... (since it's our network.)

Ajishlal

@Talleyrand,

If the external consultant want access only the internal server, Create the GVC user account and assign to him only the particular Server IP address.

Talleyrand

But that still puts them inside the same subnet and subject to the monitoring associated with it.

Then there are issues related to DHCP & DNS.... since the server FQDN has to be resolved internally by the DNS.

which means including internal DNS servers or setting up a shed load of "special" rules to resolve external DNS addresses...

but... only for some addresses..... (since for a given subnet you cannot have 2 sets of DNS)

Ajishlal

@Talleyrand

Then you can create Relay DHCP server where you can create different virtual subnet for the GVC.

Follow the below KB for configuring the Relay DHCP server for the GVC.

https://www.sonicwall.com/support/knowledge-base/what-are-different-options-to-assign-ip-address-to-the-global-vpn-client-gvc-virtual-adapter/170503310702059/