Start with one route on your router
The recommended way is one route on the router or switch you already have. That route sends traffic through Access Gate. Nothing changes on the machines or on the clients. To roll back, you remove that one line.
The route takes one of two forms, and the logic is the same. A source-based route matches where traffic comes from, so it covers a whole subnet or VLAN. A destination-based route matches where traffic goes, so it covers the machines you name.
At a large manufacturer in North Carolina, a running production line was moved behind Access Gate in under a minute with one route on the existing Cisco switch, after the Secure Twin was built and the enclaves validated. Production kept running.
| Your situation | Your guide |
|---|---|
| You can add one route on your router or switch (recommended) | Protect a whole subnet with one router rule, or the destination-based route on a Cisco Catalyst |
| You want to move one machine you reach by its name | Protect a machine you reach by its name |
| You want to move one machine you reach by its address | Protect a machine you reach by its address |
Not sure? Add one route on your router. If you want to prove the path on a single machine first, use Twin DNS or Twin IPs, then add the route. If your machines have no names yet, give your machines easy names first.
The Secure Twin is the overlay Access Gate lays alongside your existing network. It authenticates, encrypts, and enforces policy on traffic without renumbering or rewiring anything. The methods differ only in where the redirection happens: on the router, in DNS, on the machine's target address, or on the switch.
The rule that never changes: the machines keep their own IPs. Nothing on the device is touched, whichever method you choose.
The three ways
One route on your router
One route on your existing router or switch sends traffic through Access Gate. A source-based route (Source-Based Routing) matches where traffic comes from, a whole subnet or VLAN. A destination-based route matches where it goes, the machines themselves. Nothing on the machines or the clients changes, and you roll back by removing that one line.
This is the default for any migration, from one production line to a whole plant. It also works when the machines cannot be touched at all.
One machine at a time
Use these when you want to move a single machine, or when you cannot add a route on the router. You bring machines under the Secure Twin one at a time and verify each one. Use Twin DNS when machines are reached by name and you control a zone you can delegate. Use Twin IPs when they are reached by address and you can edit the destination the client targets.
Both are fully supported. They are also a good way to prove the path on one machine before you add the route.
Configuration outside the Access Gate
These two methods, IP NAT (L3) and ARP NAT (L2), are Advanced and now live under Router & Switch Integration. They work, but they depend on configuring systems Access Gate does not own: NAT rules on your router, or port isolation and proxy ARP on your switches. That configuration is yours to build, maintain, and document, and support for it is best-effort or premium rather than standard.
Use them when the first two ways are genuinely closed to you: you cannot add a routing policy on the router, and you cannot change what the clients target.
Pick by what you can change
- I want to deploy a Secure Twin
- Can you add one route on your switch or router?
- Yes
- NoCan you change what the asset talks to?
- YesAre the assets reached by name?
- Yes
- No
- NoIs there an L3 hop between the two devices?
- Yes
- No
- Yes
Weigh the effort
One route on your router, Twin DNS and Twin IPs are fully supported, with low configuration and low ongoing maintenance. The route has the lowest of both. The Advanced pair relies on external system configuration, so expect higher setup and upkeep.
Once you have picked, follow the linked guide for the step-by-step.