Supplier remote access

SOLVED
JohanPlukon
Getting noticed

Supplier remote access

As a production company we have may external suppliers who deliver machines or software to support our product processes.

Many of these suppliers will always try to bring their own router to be able to support the machine or software.
Often these machines or software also need to exchange data with internal machines or software. 

I need your opnion here. How do you handle situations like this? What kind of policy you have here. And what is the best solution in these situations? Place them behind a separate mx for each supplier? 

1 ACCEPTED SOLUTION
BlakeRichardson
Kind of a big deal
Kind of a big deal

Place them behind a single MX with each on their own VLAN would be my suggestion although how many suppliers at any one time would you have onsite? 

View solution in original post

8 REPLIES 8
PhilipDAth
Kind of a big deal
Kind of a big deal

I wouldn't allow third-party network equipment to be connected to your internal network.

 

I often put them on their own VLAN, for a VLAN separate from the internal network, and provide them with VPN access to their devices.

BlakeRichardson
Kind of a big deal
Kind of a big deal

Place them behind a single MX with each on their own VLAN would be my suggestion although how many suppliers at any one time would you have onsite? 

It can vary, from one to ten or fifteen per location. 

Depends on the level of automation within a location. 

alemabrahao
Kind of a big deal
Kind of a big deal

First time I hear about a supplier installing equipment inside the infrastructure.
 
A network for consultants is usually used and policies are created on what should and should not be accessed.
I am not a Cisco Meraki employee. My suggestions are based on documentation of Meraki best practices and day-to-day experience.

Please, if this post was useful, leave your kudos and mark it as solved.

Then you have the same thought as me. But it is something that has been accepted for years, but in my opnion cant be any more. 

I agree.  The threat landscape has evolved, and security systems and practices must evolve as a result.

van604
Getting noticed

agree with everyone, set up a separate VLAN just for them and if not required, just hand out a static IP.

JohanPlukon
Getting noticed

Thank you all for your answers. This helps me. 

Get notified when there are additional replies to this discussion.
Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.