Skip to content

CONCEPT Cited by 1 source

VPN-to-ZTA migration

VPN-to-ZTA migration is the motion of transitioning a corporate network from a perimeter VPN (broad network access behind a single authenticator) toward Zero Trust Architecture (per-application, per-user, per-device access decisions). The destination is fewer-and-smaller VPN tunnels + more-and-finer application-scoped access gates, not a single-cutover replacement.

Why it's a motion, not a flip

At any realistic engineering-org scale, the assumption that "a single new access substrate can replace the VPN instantly" does not hold. Yelp's 2025-04-15 disclosure is the canonical worked example on the wiki:

"Work was already underway to shift less sensitive applications to alternate access methods like our MTLS based Edge Gateway. However, this was not an immediate solution for all employees and required significant effort for widespread implementation. This led us to understand that we needed a solution that could support all Yelpers today, with the goal of reducing its use to more granular use cases in the future." (Source: sources/2025-04-15-yelp-journey-to-zero-trust-access)

The resulting architecture is a cohabitation of:

  • A faster, more observable, more flexible broad-network- access path (Netbird replacing Pulse Secure) — still a VPN-shape primitive but with per-peer policies and mesh fault tolerance.
  • A per-application access path (Yelp's MTLS-based Edge Gateway) for less-sensitive web applications that don't require broad network access.

Over time the balance shifts: more applications move to the per-application gate, VPN utilisation shrinks, policies on "broad, binary policies on huge subnets and network segments" become "more fine grained access control structures."

Why pure-VPN substrates hit a wall

Yelp names the structural limits of their Pulse deployment:

  • Throughput ceiling (low-tens-of-Mbps downloads, materially below modern engineering-workflow demands).
  • Authentication UX friction (SAML-via-Ivanti "cumbersome browser-to-VPN client handoff").
  • Coarse-grained access (broad binary policies on subnets, no per-user-per-application decisions).
  • HA model (single-tunnel-per-session; no transparent failover).

Each of these limits can be chipped away by a modern VPN replacement (like Netbird) without fully adopting ZTA — but the long-run destination remains ZTA because the coarse-grained- access limit is architectural, not implementation-detail.

The OIDC + device posture component

During migration, authentication protocol ladder moves:

  • LDAP → SAML → OIDC

with each step unlocking stronger verification signals. The canonical pattern Yelp describes is OIDC + device posture: user identity + managed-device signal + security posture are all required before access is granted. This is a strictly richer access decision than a raw credential check, and it can be adopted during VPN-to-ZTA migration (Yelp does so at the Netbird/Okta integration point, not only at a future Edge Gateway). (Source: sources/2025-04-15-yelp-journey-to-zero-trust-access)

Seen in

Last updated · 476 distilled / 1,218 read