Where should a sensor sit to see what VPN users do?

Behind the VPN gateway, on the internal side, where the tunnel has ended and remote users' traffic is ordinary internal traffic again. A sensor in front of the gateway, on the internet side, sees only encrypted tunnels and learns little from them. In practice, mirror the switch port that connects the VPN gateway or firewall to the internal network, or the link between it and the server segment, to a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it. or TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. port. Give VPN users addresses from their own pool, so that their traffic is easy to recognise. With NetSenX, one agent on that SPAN or TAP port counts as one device and watches every VPN session that passes it: scanning, lateral movement, beaconing and unusual outbound volume are flagged on every plan, and the VPN view lists the tunnels and gateway sessions it sees. Traffic that a split-tunnelled laptop sends straight to the internet never reaches that sensor.

← All 40 questions on Remote work and exposed servicesAll topics