Choose your setup
Seven questions that name the one guide you should follow. No networking knowledge needed to answer them.
Every guide in this section builds the same four things: the agent on the machines that join, groups, something to reach and an access rule that allows it. What differs is how much of it you need, and that follows from what you are trying to reach rather than from how SXAccess is built.
Answer these in order. The first question you answer yes to is your guide - stop there and follow it.
Looking for SSH, contractors or offboarding? Those are tasks rather than setups: see SSH access, contractors and third-party access and offboarding someone.
Start here
The same thing in words
The diagram in words, in the same order. The first question you answer yes to names your guide; each one comes with what people in that situation tend to say.
| Question | If yes, follow | Roughly how long |
|---|---|---|
| Are you replacing a VPN or an appliance? We pay for a VPN and want rid of it. | Replace a VPN | A pilot in an afternoon, the full move over weeks |
| Must internet traffic leave from one address you control? A partner only accepts connections from our own address, wherever we work. | Internet gateway | About 45 minutes |
| Do people need one application on a server you can install on? My team needs our internal wiki from home. | Reach internal services | About 30 minutes |
| Do they need devices in one office or data centre, such as a NAS or a printer? Everything in our office should be reachable from outside. | On-premises sites | About an hour |
| Do two or more locations need to reach each other? Our Munich and Frankfurt offices need to talk. | Sites reaching each other | About an hour per site |
| Is it inside a cloud VPC on AWS, Azure or GCP? Our database is in AWS and nobody can reach it. | AWS EC2 and cloud VPCs | About an hour |
| Is it a Kubernetes cluster or a CI runner? Developers need the cluster; CI needs three services. | Kubernetes and CI | About an hour |
| Still unsure? Start with the smallest setup; everything else builds on it. | Reach internal services | About 30 minutes |
What every guide has in common
Whichever one you land on, the shape underneath is the same, and it is worth recognising once:
- Put the agent on the machines that should join.
- Put those machines in groups, because access rules name groups (or one resource), never a single laptop.
- Name what should be reachable: a device, a resource inside a network or, for internet traffic, an Internet gateway.
- Write an access rule, because nothing reaches anything until a rule allows it.
When what you reach sits behind a routing device, the dashboard walks you through the same parts in its own order: network, resource, access rule, routing device. Each step opens the next, and the routing-device step can create the enrollment key for the machine that carries the traffic.
If these words are new, read SXAccess in five words first. It takes a few minutes, and every guide assumes it.
