Choosing Your Secure Twin Deployment

Five ways to deploy the Secure Twin, and how to pick one: a decision tree by network shape, and an effort/maintenance map from recommended to best-effort.

2 min read · Last updated 2026-07-17

The Secure Twin is the overlay Access Gate lays alongside your existing network, so it can authenticate, encrypt, and enforce policy on traffic without renumbering or rewiring anything. There are five ways to steer traffic onto it, and they differ only in where the redirection happens, on the asset, in DNS, on the router, or on the switch.

The rule that never changes: the assets keep their own IPs. Nothing on the device is touched. That is the Access Gate's way, whichever method you choose.

This page helps you pick. Start from the shape of your network in the decision tree, then sanity-check the choice against the effort it takes to run.

Pick by network shape

Pick by network shapeSelect an outcome to trace its path

I want to deploy a Secure Twin
- My clients (assets) use a DNS?
  - Yes
  - No
    Migrate a full subnet or VLAN?
    - Yes
    - No
      Can I modify the destination IPs?
      - Yes
      - No
        Is traffic routed?
        Yes
        No

Weigh the effort

The three green options are Trout-recommended and fully supported: low configuration, low ongoing maintenance. The two red options rely on external system configuration (router or switch NAT) and are supported on a best-effort or premium basis, expect higher setup and upkeep.

Weigh the effortConfiguration vs maintenance effort

HighMaintenance effortsLow

Trout RecommendedFully supported

External System ConfigurationSupported best-effort or premium

Source-based Routing Secure Twin DNS Secure Twin IPs IP NAT (L3)ARP NAT (L2)

LowConfiguration effortsHigh

The five options

Secure Twin DNS — when your assets are reached by name. Delegate a subdomain to Access Gate and every name resolves to its overlay address. Low effort; covers North/South, Inter- and Intra-VLAN. The simplest path when DNS is in play.
Source-Based Routing — when you want to bring a whole subnet or VLAN under the Secure Twin at once. One source-based rule on the router routes the entire origin network through Access Gate. Low effort; covers North/South and Inter-VLAN.
Secure Twin IPs — when you can point the asset at its peer's overlay address. Explicit and visible, no DNS or router tricks. Medium effort; covers North/South, Inter- and Intra-VLAN.
IP NAT (L3) — when traffic is routed and you can configure the L3 gateway to destination-NAT selected flows onto the overlay. External configuration; best-effort/premium support.
ARP NAT (L2) — when two devices share a segment with no L3 hop between them, and you cannot touch the router at all. Interception happens on the switch/bridge. External configuration; best-effort/premium support.

Once you have picked, follow the linked guide for the step-by-step. If you are unsure between two, prefer the one higher up the decision tree, it is the less intrusive fit for your network.