There are three ways to deploy the Secure Twin: migrate asset by asset, migrate a whole subnet at once, or fall back to configuration on systems you already own. Pick the way first, by how much you are migrating, then pick the method inside it.
The Secure Twin is the overlay Access Gate lays alongside your existing network, so it can authenticate, encrypt, and enforce policy on traffic without renumbering or rewiring anything. They differ only in where the redirection happens: on the asset, in DNS, on the router, or on the switch.
The rule that never changes: the assets keep their own IPs. Nothing on the device is touched. That is the Access Gate's way, whichever method you choose.
The three ways
One asset at a time
Low risk and precise. You bring assets under the Secure Twin one at a time, verify each one, and stop or roll back at any point. Use Twin DNS when assets are reached by name and you control a zone you can delegate; use Twin IPs when they are reached by address and you can edit the destination the asset targets.
This is the way to start. Migrating one asset proves the path before you commit anything else to it.
A whole subnet at once
For a larger migration, where the unit of change is a network rather than a device. One policy route on the router sends everything sourced from a subnet or VLAN through the Access Gate. Nothing on the endpoints changes, and it stages and rolls back like any routing change.
Reach for this when moving assets one by one would take too long, or when the devices genuinely cannot be touched at all.
Configuration outside the Access Gate
These work, and they are documented here, but they depend on configuring systems Access Gate does not own: NAT rules on your router, or port isolation and proxy ARP on your switches. That configuration is yours to build, maintain, and document, and support for it is best-effort or premium rather than standard.
Use them when the first two ways are genuinely closed to you: you cannot change the assets, and you cannot add a routing policy on the router.
Pick by what you are migrating
- I want to deploy a Secure Twin
- Migrating a whole subnet or VLAN at once?
- Yes
- NoCan you change what the asset talks to?
- YesAre the assets reached by name?
- Yes
- No
- NoIs there an L3 hop between the two devices?
- Yes
- No
- Yes
Weigh the effort
The two recommended ways are fully supported, with low configuration and low ongoing maintenance. The best-effort pair relies on external system configuration, so expect higher setup and upkeep.
Once you have picked, follow the linked guide for the step-by-step. If a way holds two methods and you are unsure between them, start with the one that changes the fewest systems you do not already own.