New work VPN system - horrendous

[johnridley]

They've switched to Juniper VPN at work - so that they can have ONE VPN system run from one central data center for all who-knows-how-many employees - it was about 45,000 BEFORE we merged with Reuters.

It doesn't allow partial routing at all - with it turned on, I can't even get to my network printer or any other device, all network activity is forced through the VPN, and the box up by the TV can't get to the torrents share on my machine so nobody can watch anything I've just downloaded in the last few weeks.

The VPN software they install is very intrusive; I really wouldn't want to allow it on my personal machine.

Moreover, since it goes into the data center in Eagan, local name resolution doesn't work - they put in all our desktop machines but none of the DNS for web servers etc, even those hosted in the same data center as the VPN. And routing is horrendous.

Luckily, it's trivial to set this up under a virtual XP install, and that also allows me to back it up and to replicate it across multiple machines - something they went to GREAT extents to keep people from doing - they require you to allow an active-x control in order to fingerprint your machine, send the fingerprint to an authentication server where it makes a public/private key pair just for your machine.

With the virtual machine, they can install whatever the hell they want, because it can't get out and wreck my machine, and I can copy the install to my laptop or whatever. They probably don't like it but I don't plan on hiding it. I'm in a position where if they decide they don't like what I'm doing, I'll require them to provide me with a company-issue laptop for working from home. I think they'll just roll with what I've already done.

Comments

[backrubbear.livejournal.com]

Their configuration is certainly excessively anal and not required by the software. Split networks are very common, but I certainly understand the reasoning they may have for trying to lock things down. It makes any vpn'd machine a potential infection vector on a real-time basis.

[johnridley.livejournal.com]

Well, we've had a fully locked down VPN before, this is our 4th VPN and the 2nd one that's fully routed. I'm just back to using a VM as before. I'd be doing it anyway in this case since it uses a key that's locked to the machine, so I'd have to get multiple keys anyway.

It accomplishes their security goal either way. The VM should also certainly be proof against infection from the host, unless that's a damn smart infection.