Site-to-site and remote-access VPN

Establish gateways, configure routes and identity, verify tunnels, and revoke remote sessions.

Guard VPN connects approved users or sites to private networks through a managed gateway policy. A connected tunnel establishes transport; route selection and firewall rules separately determine what traffic can pass.

Prepare a gateway and address planCopy link

At Access → Gateways → Add gateway, enroll the signed gateway package at the intended site. Give it a site identity and permitted routes. Ensure gateway management remains reachable without relying exclusively on the tunnel being configured. Check supported tunnel profiles in Gateway → Capabilities before choosing clients or peer settings.

At Access → Sites → Site → Networks, define non-overlapping network prefixes and identify existing upstream routes. Overlapping site subnets require an explicit translated design or renumbering; Guard cannot infer which identically addressed network the user intended.

Connect sitesCopy link

Open Access → VPN → Site-to-site → Create tunnel, select both gateways or the approved external peer profile, define local and remote prefixes, and select the location firewall policy. Exchange peer credentials through the protected configuration workflow. Publish and inspect each side's tunnel, route, and policy acknowledgement.

Test a permitted application flow in both directions and confirm a denied flow is rejected. A healthy handshake alone does not prove return routing or DNS works. Check peer identity, clock synchronization, route overlap, MTU, and upstream firewall restrictions when packets enter but no reply returns.

Configure remote accessCopy link

At Access → VPN → Remote access → Create profile, select the gateway, identity groups, MFA requirement, permitted networks, DNS behavior, split or full tunnel, and posture policy. Distribute the signed client and per-user enrollment through the profile's installation flow. Shared user credentials make individual revocation unreliable and must not be used.

Full tunnel changes the user's default route; split tunnel includes only named destinations. Review local DNS leakage and access to the recovery identity provider before enforcing either mode. At Access → Sessions, inspect the actual user, device, gateway, routes, and expiry.

Revoke and retireCopy link

Use Session → Revoke to request termination and verify the gateway acknowledgement. Disabling a user in Guard does not revoke unrelated VPN profiles outside Guard. For a site tunnel, migrate dependent traffic and remove routes before Tunnel → Retire. A decommissioned gateway's identity must be revoked independently of deleting its console label. For per-application access, use ZTNA instead of granting an entire subnet.