Time for a bit of a rant. Can't help it. Please note that the following is not directed at anyone in particular, but the misconception in general:
By allowing general browsing it is a huge security risk for the network.
The question of the day is HOW?
Several security vendors (Cisco and Nortel are big offenders, others follow suit) promote the idea that their VPN clients offer a bit of security because they can force all client traffic over the VPN. What exactly does this protect the host network from? Is there some virus, worm, or other undesireable that broadcasts itself over the internet or any other network?
Nope. Doesn't work that way. TCP/IP broadcasts are not forwarded across networks. If they were, the internet would be so clogged with broadcast traffic that it would be useless. There certainly is the misconfigured router here and there that may broadcast, but the problem is not nearly widespread enough to allow a virus to take advantage of it. A virus infection generally requires that a user opens an email or visits a particular website. The virus is never "pushed" onto the computer.
Once a computer has a virus, it is theoretically possible for it to infect or more likely disrupt other computers on the local network. Even transmitting an infection across the local network would be difficult, as there simply are not many avenues to push a file to another computer on the network and execute it.
In theory, it MAY be possible to convice a computer running a VPN client to route traffic between the VPN host network and the internet. In order for this to be effective, internet routing tables would need to be modified. Not going to happen. It is possible for a computer to route traffic between the VPN host network and the local network. If a computer were connected to two VPNs at the same time, it would also be possible to route between the two, but it would take a bit of work and specific knowlege of the topology of both networks.
Unless a client is forced to stay connected to the VPN constantly, the client may still become infected while not connected to the VPN. If a virus were to broadcast across the network, it would still be on the client and able to do its business regardless of the fact that it did not aquire the virus while connected.
The short version of this would be:
Routing ALL client traffic over a VPN connection
A) does nothing to secure the VPN host network
B) increases the load on the VPN tunnel. Even if browsing is not allowed over the connection, you still have the requests floating that must be denied.
C) may provide a false sense of security.
A good VPN gateway configuration should
A) block all traffic not originating from the VPN client. This is sufficient in most cases to eliminate traffic from the internet or another private network reaching the host network.
B) enforce a policy that IP forwarding on the VPN client is disabled. This also will eliminate unwanted traffic from non-trusted networks.
C) ensure that anti-virus software is installed, active and current before allowing the connection. This is problematic, because it does require that the client purchases or at least installs additional software on their machine.
D) implement some basic firewall rules for the VPN client to further ensure that unwanted traffic does not route through the connection.
Most of the vendors that promote the traffic restrictions support all or most of the better security measures. It is a bit more complicated to implement, but it offers a bit of real security.
The other idea behind forcing all network traffic over the VPN is to monitor employee activity. This is also useless, as it is possible (as was pointed out earlier) to connect from one computer and surf on another. For that matter, one could have the TV on, be chatting on the phone, or any other number activies that is not productive. At the end of the day, it does nothing more than increase bandwidth usage and create ill will.
Rant over, sorry.
Now for the question that was posted. No, it is not possible to bypass the restrictions that the Cisco (or many other) clients place on the client machine. A second network interface will do no good, as the client software handles network traffic before it ever hits the hardware. Even if a second card could bypass the restrictions, you generally cannot use two interfaces on the same network (exception being load balancing on a server).
