A remote-access VPN authenticates a user with MFA and hands out a pool address - what does that session then reach?

## Two decisions, one box A remote-access concentrator makes two decisions that people hear as one. 1. **Admission.** Is this credential accepted, is the second factor accepted, does the device present the certificate or posture the policy demands? If yes, the session comes up and the client is given an address out of a **pool** - a block of internal address space reserved for remote sessions. 2. **Routing.** Once that address exists, what can it talk to? That is answered entirely by the routing table on the inside of the concentrator and by whatever filtering sits between the pool and the estate. The credential plays no further part. The leaf's whole point lives in the gap between them: **authenticated means routed, not authorised.** ## Why the default answer is "everything" A concentrator is normally deployed so remote staff can work, and "work" is not a list anybody has. The pool is therefore routed into the core the same way any other internal subnet is, and the estate's internal routing happily carries a pool address to every zone that has a route back. No policy is written down anywhere that says the pool may reach the backup network, the hypervisor management plane, the directory servers, the out-of-band console network or the finance segment - and none is needed, because reachability is the default and denial is the exception you must build. | What the edge control does | What it does not do | | --- | --- | | Decides whether a session is admitted | Decides which destinations that session may open | | Proves a credential and a factor were accepted | Proves a person was present or the device is clean | | Encrypts traffic in transit to the concentrator | Confers any authority on the traffic after it lands | | Produces a login record | Produces a record of what the session reached | ## The adversary's view An adversary who phishes an account and gets one push approved does not have to defeat anything after the edge. Their session is not an anomaly to any device in the path - it is a *permitted flow* from a pool address, indistinguishable on the wire from the same person's legitimate session an hour earlier. Every internal control they meet is one that was designed on the assumption that internal traffic is broadly fine. The interesting number is therefore not "how strong is the login" but "how many destinations did one accepted login just open". The same is true with no adversary at all: a contractor account issued for one application, a service account with a tunnel profile that nobody has reviewed in four years, or an acquired company's staff pointed at the same service after a merger, all inherit the same reach. ## Expressing it as a count The useful answer in an interview - and to a risk officer - is measurable. From a pool address, walk the routing table and the filters between the pool and each zone, and produce a destination count: *this pool can currently open 41 internal subnets and roughly 9,000 listening services, including the hypervisor management network and the backup control plane*. That sentence ends the argument that MFA is containment, because it is a number that MFA does not change. ## What it costs to shrink it This is the part candidates skip, and it is why the problem persists. Turning the pool into a default-deny position requires knowing what the remote population legitimately needs, application by application. In most estates nobody knows: application owners can name the front door of their own service but not the callers it makes, the flows are not documented, and a wrong deny is not an alert on someone's queue - it is a broken business flow at nine in the morning with a name attached to it. That discovery burden is the real reason the pool stays flat, and saying so is a better answer than pretending the design was an oversight. A competent answer therefore has three parts: name the two decisions, state that the second one is unowned by default, and price the fix honestly rather than promising an allow list nobody can staff.