# Remote access, done right.

Site-to-site tunnels, remote-worker VPN, and zero-trust replacements — designed and deployed for the way your team actually works.

---

## What you get

- Network topology design + documentation
- Fortinet edge devices with HA pairs
- MFA-enforced remote access portals
- Endpoint posture checks before tunnel up
- Split-tunnel + DNS optimization
- Quarterly access review + cleanup

VPN is one of those things that feels simple until you're managing it across 50 remote workers, 4 branch offices, and a partner extranet. The wrong design adds friction and exposes attack surface; the right one is invisible to users and audit-friendly. We build for both.

## The full deliverable.

### Site-to-site IPsec tunnels.

Branch offices, data centers, and partner networks connected over encrypted tunnels with redundancy and monitoring. We design topology to minimize hairpinning and maximize app performance.

### Remote worker SSL VPN.

FortiClient or native OS SSL VPN, with MFA enforcement, posture checks (is the device patched? is EDR running?), and split-tunneling tuned to your traffic patterns.

### Zero-trust network access (ZTNA).

Where it makes sense, we replace flat VPN access with per-application ZTNA — users only get access to specific apps, not the full network. Smaller blast radius if a device is compromised.

## Auth → posture → tunnel.

Every remote-worker connection passes through three checks: identity (MFA), device posture (patches, EDR), and policy (which apps does this user need?). All before the tunnel comes up.

```bash
$c2 vpn connect --user=jdoe@acme.com

✓MFA challenge: passed (Authenticator)

✓Device posture: compliant (patches, EDR active)

✓Policy: ACME-REMOTE-WORKER applied

✓Tunnel up · IKEv2 · AES-256-GCM · 4ms latency

Split-tunnel: corp + M365 only · 12 routes
```

## Common questions.

### How many concurrent VPN users can the firewall handle?

Depends on the appliance and license tier — we size for your peak concurrent + 50% headroom. A FortiGate 100F handles ~500 concurrent SSL VPN users; larger sites use 200F+.

### Should we use VPN or zero-trust?

Both, usually. Site-to-site VPN for branch connectivity is here to stay. For remote workers, ZTNA is the modern direction — smaller attack surface, better performance, easier offboarding.

## Ready to stop fighting your IT?

Tell us what's breaking, what's slowing you down, or what you're trying to build. We'll respond same-day with a real plan — no boilerplate sales sequence.