Secure communication and access: VPN, tunnelling and remote work

Objective 3.2 in this course covers enterprise infrastructure. This lesson finishes it with the secure communication and access half of CompTIA's scope note — and it is the applied lab for 3.2, because a VPN's configuration is something you can build, break and measure rather than only describe.

Why this matters

Remote access is where a large share of real intrusions now begin, because it is the one route into the internal network that is deliberately exposed to the internet. Compromised VPN credentials without multifactor, and unpatched VPN appliances, have been the initial access vector in a very large number of significant breaches.

The exam tests the mechanics — which protocol, which mode, which topology — and it tests the judgement, particularly around split tunnelling, which is the clearest availability-versus-visibility trade in the objective.

The lesson

VPN types, and what a tunnel does and does not protect

A virtual private network carries traffic across an untrusted network inside an encrypted tunnel, so that what the intermediate networks can see is that two endpoints are talking and roughly how much.

The types CompTIA distinguishes:

• Remote access VPN — one client to the corporate network. This is the work-from-home case.
• Site-to-site VPN — two networks joined by a permanent tunnel between gateways. Users are unaware of it; it is infrastructure. Branch office to head office, or on-premises to cloud.
• Clientless / SSL VPN — access through a browser using TLS, typically reaching specific applications rather than the whole network. Lower friction, narrower reach, and it avoids installing a client.
• Full tunnel versus split tunnel — the next section.

What a VPN protects: confidentiality and integrity of data in transit between the two tunnel endpoints, and it authenticates those endpoints.

What it does not protect, and each of these is an exam answer:

• Anything before or after the tunnel. Traffic is plaintext on the client before it enters the tunnel and on the corporate network after it leaves. A compromised client is a compromised session.
• The client's health. A VPN grants a malware-infected laptop a network path into the estate. This is precisely why posture checking and NAC exist.
• Who the user really is, beyond the credential presented — which is why MFA on remote access is not optional.
• Anything about the destination's security. A tunnel to a vulnerable internal application delivers the attacker there securely.

IPSec, transport versus tunnel mode, and TLS

IPSec operates at the network layer and secures IP traffic. Two protocols within it:

• AH (Authentication Header) provides integrity and authentication. No encryption — this is the detail the exam tests. AH alone does not give confidentiality.
• ESP (Encapsulating Security Payload) provides encryption, and integrity and authentication for the payload. ESP is what is actually used.

Two modes, and the distinction is genuinely testable:

• Transport mode encrypts the payload and leaves the original IP header visible. Used host-to-host, typically inside a network where the routing information does not need hiding.
• Tunnel mode encrypts the entire original packet, header included, and wraps it in a new IP header addressed to the gateways. Used for site-to-site and for remote access, because the internal addressing is concealed and intermediate networks only see gateway-to-gateway traffic.

IKE (Internet Key Exchange) negotiates the security associations and keys; phase 1 establishes a secure channel between the peers, phase 2 establishes the association for the actual traffic.

TLS-based VPNs operate higher up and use TLS, the same protocol as HTTPS. The practical advantage is that TLS traverses firewalls and NAT easily on port 443, where IPSec often does not. The practical disadvantage is that they are typically application- or session-oriented rather than giving full network-layer reach.

Rule of thumb for the exam: site-to-site → IPSec in tunnel mode; clientless or restrictive-network remote access → TLS.

Remote access, always-on VPN and split tunnelling's trade-off

Always-on VPN establishes the tunnel automatically whenever the device has network connectivity, before or immediately after user login, without the user choosing to connect. Its value is that it removes the decision: every remote session is protected, managed and monitored, and the device is reachable for patching and policy. Its cost is that a device cannot work offline from the corporate perspective, and a VPN outage is a total outage.

Split tunnelling is the real judgement call.

• Full tunnel: all traffic from the client goes through the corporate network, including the user's web browsing. You get complete visibility, all your filtering and inspection apply, and there is no path from the internet straight to the client. You pay in bandwidth, latency, and the cost of backhauling video calls and cloud SaaS traffic through the office.
• Split tunnel: corporate traffic goes through the tunnel, everything else goes direct. Performance is much better and cloud services work properly. You lose visibility of and control over the direct traffic, and the client is simultaneously on the internet and on your internal network — which is a bridge, and it is the security objection.

The exam's framing: split tunnelling trades security visibility for performance. If the scenario stresses monitoring, data loss prevention or content filtering for remote users, the answer is full tunnel. If it stresses bandwidth cost or cloud application performance, split tunnel with endpoint controls compensating is defensible.

The modern compensation is to move the controls to the endpoint or the cloud — DNS filtering, EDR and a cloud security gateway — so that split tunnelling does not mean unmonitored. That is the reasoning behind SASE below.

SD-WAN and SASE, stated at the level CompTIA examines

SD-WAN (software-defined wide area network) abstracts the WAN: a controller sets policy centrally, and edge devices at each site choose among available links — MPLS, broadband, cellular — per application, steering by performance and cost. Security relevance: it typically encrypts site-to-site traffic by default, it centralises policy so configuration is consistent, and it lets branches reach cloud services directly rather than backhauling everything.

That last property is also the security problem it creates: branches now have their own internet egress, so the single inspected exit point you used to have is gone.

SASE (secure access service edge) is the answer to that. It delivers network and security functions from the cloud, at the edge, close to the user — secure web gateway, CASB, DNS filtering, firewall-as-a-service and zero trust network access, applied consistently regardless of where the user is.

The idea to carry: SASE detaches security from location. In the old model protection came from being inside the building or on the VPN. In SASE the controls follow the identity and the device, which is why it pairs with zero trust from Domain 1 and why it makes split tunnelling much less objectionable.

ZTNA (zero trust network access) is the component that replaces the traditional VPN: instead of putting a device on the network, it brokers access to specific applications after evaluating identity, device posture and context, per session. The security improvement is concrete — a compromised client gets the applications that identity is entitled to, not a network path to scan.

Selecting an access method for a scenario with a stated constraint

A decision aid for the exam's scenario questions:

Two constants regardless of method. Multifactor authentication on all remote access, because a credential alone is the single most commonly abused path in. And patch the remote access appliance urgently — it is internet-facing by definition, it is a standing target, and a vulnerability in it is a direct route to the internal network with no user interaction at all.

What to take into the exam

• AH gives integrity and authentication and no encryption; ESP is what provides confidentiality.
• Transport mode encrypts the payload; tunnel mode encrypts the whole original packet including its header, which is why site-to-site uses it.
• A VPN protects data in transit only — not the client, not the destination, and not the question of who is really holding the credential.
• Split tunnelling trades visibility for performance; full tunnel is the answer when monitoring or filtering is the stated requirement.
• ZTNA brokers access to an application; a VPN puts a device on a network. That difference is the point.
• MFA on remote access and urgent patching of the appliance are non-negotiable in any scenario.