A remote-access concentrator lands its inside leg on the core VLAN — what filters the decrypted traffic?

## What "terminating inside the boundary" actually means A remote-access tunnel carries encrypted payload — with IPsec, an ESP-encapsulated packet — from a client to a head-end appliance. The head-end decapsulates it. **The point of decapsulation is the first place in your estate where that traffic exists as plaintext, and therefore the first place any policy can be written about it.** Everything upstream of that point sees an opaque blob addressed to the head-end; everything downstream sees ordinary routed packets. So the physical question "which VLAN does the inside leg plug into?" is really the policy question "what is the first device other than the head-end that gets a vote on this traffic?" If the inside leg lands on the core VLAN, the answer is: **none**. Remote traffic is born inside, adjacent to whatever the core routes. ## "But the concentrator has a policy" It does, and it is a real control — per-user or per-group rules deciding which internal destinations a tunnel session may address. What it is not is a *second* layer, because it shares a failure domain with the tunnel termination itself. One box holds the outside leg exposed to the internet, the credential check, the policy, and the inside leg. An adversary who owns that box owns the policy that was supposed to bound them. A control cannot constrain the thing that can rewrite it. That is the whole argument for landing outside the estate: not that the appliance is bad, but that the blast radius of owning it should be decided by something the appliance's own compromise cannot reach. ## The two positions, side by side | Inside leg lands on | First device other than the head-end that sees plaintext | What a fully-owned head-end can originate unaided | | --- | --- | --- | | The core VLAN | none | anything the core will route for it | | A screened tier behind a second enforcement device | that device | only what its rule base permits from the head-end's own address | The second row is only true while the second device's rule base does not contain a broad allow for the head-end. The usual way this boundary is quietly voided is a management, backup or high-availability exception written as "any from the head-end" — after which the two rows are the same picture with an extra hop. ## What the outside position costs This is the half candidates skip, and interviewers are listening for it: - **Money.** A second enforcement device sized for peak remote-access load, not average — and licences are usually sold by throughput, so the peak is what you buy. - **A second configuration.** Two rule bases now describe the same intent, and they drift. Every new internal service a remote user needs is two changes in two systems, often owned by two teams. - **Latency and MTU.** An extra hop on both directions of every remote flow, on top of the tunnel's own encapsulation overhead. - **A new failure domain.** That device can take remote access down on its own. Somebody has to decide and sign the failure posture — for remote access, failing closed is usually the defensible answer, but it is a decision, not a default. - **Exception pressure.** The first "temporary any/any while we migrate" is the moment the second hop stops meaning anything, so it needs a review cadence with an owner. ## The cheap version of the right answer The outside position does not always mean buying a box. If the estate already has a screened tier with an enforcement point in front of it, moving the inside leg into that tier costs a routing change and an outage window rather than a purchase. That is frequently the design that actually gets built, and proposing it is a stronger answer than demanding new hardware. ## Proving it, rather than asserting it A diagram is not evidence. What demonstrates the position is traffic sourced from the head-end's inside address toward a destination the policy denies, and the corresponding deny record from the second device — repeated after each change window, because the claim decays every time either rule base is edited. ## What to say in an interview Name the decapsulation point as the enforcement point; say that the head-end's own policy shares a failure domain with the head-end; describe the two candidate landing zones and what an owned appliance reaches from each; and state the price of the outside position without being asked. Candidates who stop at "we terminate in the DMZ, it's best practice" have given a slogan; candidates who can say what the second hop costs and who signs for it have given an architecture.