SXAccess vs. traditional VPN
A classic VPN concentrates traffic at a gateway and grants access to a subnet. SXAccess connects machines directly and grants access to named resources.
A traditional VPN puts a concentrator in the middle. Every client dials the same public endpoint, traffic is decrypted there, and the client is placed on a network segment. Access is then a property of where you landed, enforced by firewall rules someone wrote by hand.
That design has three costs that grow with the estate. The concentrator is a bottleneck and a single point of failure, and its public endpoint is permanently exposed. The firewall rules also drift out of sync with who actually works where.
Side by side
| Traditional VPN | SXAccess | |
|---|---|---|
| Data path | Client → concentrator → target. Always hairpinned. | Client → target, directly whenever a direct path exists; otherwise through an encrypted relay. |
| Public exposure | The concentrator's port must be open to the internet. | Nothing needs an inbound port. Agents dial out only. |
| Unit of access | A subnet or an IP range. | A named resource or group of devices. |
| Who decides | Firewall rules, maintained separately from the list of people. | Access rules written against the groups a member carries. |
| Adding a site | New tunnel, new routing, new rules. | Install the CLI agent on one machine there, which becomes its routing device. Publish what it should reach as resources, and allow them in an access rule. |
| Failure mode | Concentrator down means everyone is down. | Direct tunnels that are already up keep running while the management service is unreachable. Relayed tunnels need the relay, and new tunnels need Discovery. |
| Encryption | Terminated at the gateway. | End to end between the two devices that run SXAccess, and no middlebox holds keys. Traffic to a resource leaves the tunnel at the routing device and crosses the last stretch of that network unencrypted, unless the application encrypts it itself. |
What "Zero Trust" changes in practice
The practical difference is not the marketing term - it is the size of the blast radius. On a VPN, a compromised laptop can scan the entire segment it was placed on. On SXAccess, that laptop's agent only ever receives a network map containing the devices its access rules allow. Everything else is not merely blocked; it is invisible.
Two more properties follow from that:
- Access follows identity, not location. A contractor whose groups are taken away loses their reach as soon as the new network maps are pushed, wherever they are.
- Device requirements can gate access. An access rule can require a minimum OS version, a running process, or a permitted country before the source device can use that rule. See Device requirements.