Virtual Private Networks create protected communication paths across untrusted networks. IPsec is commonly used for site-to-site connectivity, while client VPN technologies provide remote access for users and devices. Encryption protects traffic in transit, but a VPN does not automatically make an endpoint trustworthy or grant appropriate application access.
Site-to-site IPsec concepts
An IPsec tunnel commonly negotiates an authenticated security association, encryption and integrity parameters, peer identity and traffic selectors. IKE manages negotiation; IPsec protects selected traffic. Both peers must agree on compatible proposals, authentication and phase settings. Modern deployments should use strong, currently supported cryptographic suites and avoid obsolete algorithms.
Routing and traffic selectors
A tunnel can be established while applications remain unreachable because of route selection, overlapping subnets, selectors, firewall policies, NAT or asymmetric return traffic. Document local and remote networks, routing ownership and permitted services. Test application ports and DNS resolution in addition to basic reachability.
Remote-access protection
Require MFA, managed-device posture where possible and role-based access. Restrict users to required subnets and applications rather than granting broad internal reachability. Disable stale accounts and review VPN groups. Keep clients and gateways patched, and monitor unusual login locations, impossible travel signals and repeated authentication failures.
Troubleshooting method
Check peer reachability, time synchronisation, IKE negotiation, authentication, phase parameters, selectors, routes, NAT and firewall policies in a consistent order. Compare both peers’ configurations and inspect logs on each side. Change one variable at a time and preserve a rollback path.
Operational safeguards
Use unique credentials or certificates, protect pre-shared secrets, rotate credentials according to policy and restrict administrative access to VPN appliances. Review tunnel utilisation and failover behaviour. Document ownership, support contacts and the expected recovery procedure.
- Confirm the control has a named owner and documented business purpose.
- Validate configuration against current vendor guidance and organisational policy.
- Test expected and denied access paths; retain evidence of the result.
- Monitor exceptions, failures and configuration changes.
- Review the control after material infrastructure or business changes.
A VPN is a transport security control. Identity, endpoint health, least privilege and application-level policy remain essential.