Lollipop architecture is a non-inline overlay deployment model used by Trout's Access Gate. An appliance connects at a single point on the existing LAN (the "stick") and creates a zero-trust overlay network (the "head") in the 100.64.0.0/16 CGNAT address range, adjacent to but logically separate from the physical network. Because it never sits in the traffic path, it adds no single point of failure to production.
How does lollipop architecture work?
The Access Gate appliance plugs into a single switch port on the existing network. It does not sit inline between devices and their upstream gateway. Instead it advertises overlay routes and handles DNS-based or routing-based traffic steering, so enrolled devices communicate through the overlay rather than directly across the physical LAN.
The overlay uses the 100.64.0.0/16 CGNAT (Carrier-Grade NAT) range, reserved by IANA for shared address space, so it does not collide with the RFC 1918 private ranges already in use on the production network. Each enrolled device gets an overlay IP in that range. Traffic between enrolled devices is encrypted and authenticated through the overlay; traffic to non-enrolled devices keeps flowing over the physical network exactly as before.
The name describes the topology. The single physical connection to the LAN switch is the stick. The overlay, a mesh of encrypted tunnels between enrolled devices, is the head. From the physical network's point of view, all overlay traffic enters and exits through that one point, which keeps firewall rules and network monitoring simple.
Why is non-inline deployment important in OT environments?
In OT, inline security devices are an operational liability. Drop a firewall or NAC appliance into the path between a PLC and its HMI and you introduce a failure point in a safety-critical control loop. If that device reboots, drops packets during a firmware update, or fails outright, the loop breaks and production can stop. Most OT sites enforce strict change freezes that forbid inline deployments during production hours, and many forbid them entirely.
Lollipop architecture sidesteps all of that. A plant can deploy an appliance on a spare switch port during a maintenance window without touching cable runs, IP addresses, VLAN configs, or firewall rules. Enrolled devices start using the overlay immediately; non-enrolled devices are unaffected. If the appliance is powered off or unplugged, devices revert to the physical network exactly as before, with zero residual configuration. That reversibility is what makes it viable in brownfield facilities where the network grew organically over decades and the documentation is incomplete.
How is lollipop architecture different from inline security?
An inline device carries live production traffic and enforces policy by sitting in the path, which means its failure is the network's failure. A lollipop deployment enforces policy on a parallel overlay that devices opt into, so the physical path is never at risk. Inline gear also usually enforces on IP and port; the overlay enforces on authenticated identity, which is the zero-trust distinction.
How does lollipop architecture support compliance?
The overlay supports segmentation requirements across CMMC (enclave isolation for CUI), IEC 62443 (zones and conduits), and NERC CIP-005 (Electronic Security Perimeters). Because it enforces identity-based access instead of VLAN membership or IP range, it produces auditable evidence of who reached what and when, which satisfies the logging and monitoring controls in each framework.
Related terms
- Overlay Networking (OT context)
- Network Segmentation
- Zero Trust Architecture
- Firewall
- Access Control
How Access Gate helps
Access Gate uses lollipop architecture as its standard deployment model, connecting non-inline to the LAN and creating an identity-enforced overlay without disrupting production traffic. See What is overlay networking.
