Dan HeathandRobin Beck
5ce6515156
* docs: IA reorganization * docs: Updates * docs: Updates * docs: Fix links * docs: Updates * docs: Fix a typo * docs: Fix client agent topic * docs: Update Client Agent nav * docs: Fix conflict * docs: Fix a typo in Client Agent docs (#5853) * docs: Fix client agent topic * docs: Updates * docs: Updates * docs: Updates * docs: Updates * docs: Fixes get started and operations links * docs: Update nav * docs: Partials * docs: Unix partials * docs: Worker partials * docs: Updates * docs: Update workers and targets * docs: Updates * docs: Updates * docs: Fixes link * docs: Updates after sync review * docs: Updates from review feedback * docs: Move worker filter examples * docs: Fix links * docs: Updates for filters based on working session * docs: Fixes broken links * docs: Add links to other filter topics * docs: Update list intro * docs: Adds link * docs: Fixes redirects * docs: Fixes redirects * docs: Deleted mysql page from TOC * docs: Add versioned redirect * docs: Adds versioned redirects * docs: Adds versioned redirects * docs: Update redirects * docs: Update redirects * docs: Redirect fixes * docs: Update redirect format * docs: Fix a typo * docs: Fixes redirects * docs: Fixes redirect * docs: Adds links out to client agent troubleshooting * uses /etc/boundary.d/ as recommended installation directory (#6003) * docs: Updates legacy io links * docs: Fixes redirects * docs: Fix redirect * docs: Restoring deleted file --------- Co-authored-by: Robin Beck <stellarsquall@users.noreply.github.com>
30 lines
2.2 KiB
Plaintext
30 lines
2.2 KiB
Plaintext
---
|
|
layout: docs
|
|
page_title: Boundary vs. VPNs
|
|
description: >-
|
|
Learn how Boundary compares to VPNs by using an Identity Provider (IdP) to grant users remote access to specific permitted services, but not the entire network.
|
|
---
|
|
|
|
# Boundary vs. VPNs
|
|
|
|
Virtually every company today uses network firewalls to enforce perimeter security.
|
|
To establish a remote connection within the perimeter, organizations often use some form of virtual private network (VPN) to authenticate users, establish a secure tunnel to the private network (such as a corporate or data center network), and allow users to enter the gated walls.
|
|
|
|
VPNs enable the remote access architecture that is most often used to allow identities on unsecured networks to gain access to key internal organizational services in a secure fashion.
|
|
Data is encrypted in transit, a network connection is established, and the user's access on the network is now predicated on the granularity of 802.1x authentication to the appropriate VLANs and network and application layer firewall rules.
|
|
In practice, this often means that once users log in to a network using a VPN, they have access to far more than they should.
|
|
|
|
While Boundary can establish remote connections to services within an organization's perimeter, Boundary is **not** a VPN.
|
|
Instead, Boundary proposes an improvement to the current remote access model, where remote access is granted granularly and established to specific permitted services, but **not** the entire network.
|
|
Boundary uses a non-repudiable user identity that is established by your integrated Identity Provider (IdP) of choice, as opposed to relying on network layer concepts such as IP address for access management.
|
|
|
|
A traditional VPN provides users with **network access**.
|
|
Boundary provides users with **delegated access to services within the network**.
|
|
|
|
**Can Boundary replace a VPN?**
|
|
|
|
For many organizations, Boundary's granular network access will be a security improvement from traditional data center VPN solutions that lack granular controls.
|
|
|
|
**Can Boundary work with a VPN?**
|
|
|
|
Boundary can work with existing corporate VPNs to provide heightened security when accessing privileged networks such as data centers and cloud VPCs. |