Replace the VPN

For a room that runs a VPN concentrator and is tired of it.

~27 minutes · needs the lab - at least one chapter reaches the private estate

Who are our people, and what are they allowed to reach? One sign-in, groups that come from the identity provider rather than being typed into Cloudflare, and an application that simply does not exist for someone not entitled to it. · ~4 min · Lab and laptop
Retire the VPN concentrator. An internal ticketing app on a server with no open ports, reached by name through the Cloudflare One client - and with the client off, the address does not answer at all. · ~8 min · Lab only
Admins reach servers without standing credentials. SSH to the apps server with a certificate Cloudflare issues for the session - no key on the laptop, no password on the account - and the database console behind the same group. · ~10 min · Lab only
Only healthy, managed devices reach production. pgAdmin requires a device with its firewall on; switch it off and access ends, with the failing check in the log. And Backlog's experience measured from every device. · ~5 min · Lab and laptop