Choosing Your Secure Twin Deployment

Five ways to deploy the Secure Twin, and how to pick one: a decision tree by network shape, and an effort/maintenance map from recommended to best-effort.

This page helps you choose one of five Secure Twin deployment methods, Secure Twin DNS, Source-Based Routing, Secure Twin IPs, IP NAT (L3), and ARP NAT (L2), by comparing them on network shape, setup effort, and support level.

The Secure Twin is the overlay Access Gate lays alongside your existing network, so it can authenticate, encrypt, and enforce policy on traffic without renumbering or rewiring anything. There are five ways to steer traffic onto it, and they differ only in where the redirection happens, on the asset, in DNS, on the router, or on the switch.

The rule that never changes: the assets keep their own IPs. Nothing on the device is touched. That is the Access Gate's way, whichever method you choose.

This page helps you pick. Start from the shape of your network in the decision tree, then sanity-check the choice against the effort it takes to run.

Pick by network shape

Pick by network shapeSelect an outcome to trace its path

I want to deploy a Secure Twin
- My clients (assets) use a DNS?
  - Yes
  - No
    Migrate a full subnet or VLAN?
    - Yes
    - No
      Can I modify the destination IPs?
      - Yes
      - No
        Is traffic routed?
        Yes
        No

I want to deploy a Secure Twin

My clients (assets) use a DNS?

Weigh the effort

The three green options are Trout-recommended and fully supported: low configuration, low ongoing maintenance. The two red options rely on external system configuration (router or switch NAT) and are supported on a best-effort or premium basis, expect higher setup and upkeep.

Weigh the effortConfiguration vs maintenance effort

HighMaintenance effortsLow

Trout RecommendedFully supported

External System ConfigurationSupported best-effort or premium

Source-based Routing Secure Twin DNS Secure Twin IPs IP NAT (L3)ARP NAT (L2)

LowConfiguration effortsHigh

The five options

Method	When to use it	Effort	VLAN coverage	Support
Secure Twin DNS	Assets are reached by name. Delegate a subdomain to Access Gate and every name resolves to its overlay address.	Low	North/South, Inter- and Intra-VLAN	Trout-recommended, fully supported
Source-Based Routing	Bring a whole subnet or VLAN under the Secure Twin at once. One source-based rule on the router routes the entire origin network through Access Gate.	Low	North/South, Inter-VLAN	Trout-recommended, fully supported
Secure Twin IPs	You can point the asset at its peer's overlay address. Explicit and visible, no DNS or router changes.	Medium	North/South, Inter- and Intra-VLAN	Trout-recommended, fully supported
IP NAT (L3)	Traffic is routed and you can configure the L3 gateway to destination-NAT selected flows onto the overlay.	External configuration	Not specified	Best-effort/premium
ARP NAT (L2)	Two devices share a segment with no L3 hop between them, and you cannot touch the router at all. Interception happens on the switch/bridge.	External configuration	Not specified	Best-effort/premium

Once you have picked, follow the linked guide for the step-by-step. If you are unsure between two, prefer the one higher up the decision tree, it is the less intrusive fit for your network.