These are the standard deployment models for connecting Access Gate and structuring your network.
Lollipop Mode (Standard Deployment)
Access Gate uses a lollipop topology rather than traditional inline deployment. The appliance connects to your network but doesn't sit in the physical traffic path.
Why Lollipop?
Traditional inline security devices create several problems:
- Single point of failure: Network goes down if device fails
- Performance bottleneck**:** All traffic limited by device throughput
- Complex deployment: Getting inline network changes right the first time is... challenging
- High risk: Misconfiguration can take entire network offline
Lollipop architecture solves these issues:
- Adjacent placement: Appliance sits beside network, not in the path
- Software-defined interception: Traffic redirected via DNS and routing
- Graceful degradation: Network functions normally if appliance offline
- Zero-touch deployment: No physical network changes required
How Traffic Flows
Without Access Gate (Underlay Network):Client → Asset
With Access Gate (Overlay Network Active): Client → Overlay IP → Route to Access Gate (Double NAT) → Underlay IP → Proxy to Asset
In the Access Gate scenario, it is important to note that the Client never access the Asset directly, but always through the proxy. The Access Gate initiate a second communication with the Asset (in red above).
This allows to deploy authentication, access control, monitoring... and all the good stuff.
Lollipop deployment of an Access Gate
How it works:
- Access Gate observes traffic via a netflow connection to the router
- Builds an overlay IP space (commonly 100.64.0.0/16) that maps protected services to proxy-enforced paths
- DNS resolves protected hostnames to overlay IP addresses
- Routing directs overlay traffic through Access Gate
- Assets remain on their original underlay network
Benefits:
- No single point of failure in the traffic path
- No physical network changes required
- Simple to deploy and remove
- The network continues to operate normally if Access Gate is offline
Bastion Mode for Remote Access
What it is: Access Gate becomes the single controlled entry point for users coming from outside the site. Remote users connect via VPN (Tailscale/WireGuard) to Access Gate, and Access Gate brokers access to protected assets through its proxy.
Why this mode exists (the problem it solves): Remote access to OT / sensitive IT usually ends up as one of these patterns:
- Flat VPN into the LAN
- Jump box / RDP server
- Vendor remote tools
What Bastion Mode improves
- Least-privilege remote access
- Stronger boundary
- Auditability
- Operational safety
- Vendor access without permanent exposure
When to choose it
- You need remote access for operators, IT, vendors, or incident response.
- You want to avoid “VPN = inside the LAN.”
- You need consistent logs/evidence for NIS2/CMMC/NIST-style controls.
Access Gate acts as a VPN gateway, enabling remote users to securely reach on-site assets. The network flow looks like:
Remote Users → VPN (Tailscale / WireGuard) → Access Gate → Protected Assets
Bastion deployment of an Access Gate
Multi-Site Mesh
What it is: Multiple Access Gates form an encrypted mesh between sites. Each site keeps its local underlay unchanged, but selected assets/services become reachable across sites through controlled, identity-based policies.
Why this mode exists (the problem it solves) Organizations with multiple sites often end up with:
- Site-to-site VPNs that are flat
- Complex network engineering
- Inconsistent controls per site
What the mesh improves
- Zero-trust across sites (Alice on site A is able to access CNC on Site B)
- Standardized security posture
- Faster rollout
- Unified logging and documentation for auditors
Typical use cases
- Central engineering team needs controlled access to machines across plants.
- Shared services (historians, patch repositories, backup, monitoring) must be reachable securely.
- M&A / multi-entity environments where networks must remain separate but collaboration is required.
- You want “connectivity as policy” instead of “connectivity as routing.”
Multiple Access Gates interconnect over VPN to provide secure, site-to-site connectivity:
Site A Assets ← Access Gate A ←→ Access Gate B → Site B Assets
Access Gate implementation as a Multi-site Mesh
Requires: Site Mesh feature configuration