How do you justify a second enforcement hop behind the VPN head-end when cost and a peer argue for one box?

## Why the technical argument loses this room At a design review, "defence in depth" is a value statement and the peer's "one box, half the cost, half the operational burden" is a number. Numbers beat values. The way to win — or to lose honestly — is to convert your position into something with the same shape as theirs: **a written claim about consequence, and a price**. ## The artefact: a blast-radius statement per position For each candidate landing zone, state in writing what a fully compromised head-end could originate. Not what it is *expected* to do; what it *could* do. - **Inside leg on the core VLAN:** everything the core routes, sourced as ordinary internal traffic, with no device other than the compromised appliance in a position to deny it. - **Inside leg in a screened tier behind a separately administered device:** an enumerable list — the authentication flow to the identity store, logging and time, plus whatever else that rule base permits from the head-end's address. It is a list you can print and hand over. That difference is the whole decision, and stating it as two paragraphs someone must sign changes the conversation from architecture taste to accepted risk. **You write the claim; the risk owner accepts or rejects it.** An architect who tries to own the decision as well as the claim usually gets neither. ## The price, stated by you before it is used against you Credibility here comes from being the person who names the cost first: - **Licence and sizing** for peak remote-access load, not average. - **A second rule base** describing the same intent, which drifts; every new internal service is two changes, often in two teams. - **Dual change windows** and a slower path for routine requests, which is what people actually feel. - **A new failure domain.** The extra device can take remote access down alone. Declare the failure posture — for remote access, failing closed is normally defensible because it is an optional path with a known alternative — and get that signed too, because at 3 a.m. someone will want to bypass it. - **Latency and MTU** on both directions of every remote flow, on top of tunnel overhead. - **Exception pressure.** The first broad allow for the head-end's address, requested for backup or clustering or a migration, converts the second position back into the first. Without a named owner and a review cadence for that rule base, the design has a shelf life. ## The move that usually wins Offer the variant that delivers the same consequence claim without the purchase: relocate the inside leg into a screened tier that **already** has an enforcement point in front of it. You pay a routing change, an outage window, and the negotiation to remove any leftover adjacency that would let return traffic skip the device. You still inherit the second rule base and its drift, but not the licence and not a new failure domain. Proposing this makes you the person solving the peer's problem rather than the person spending their budget. ## What to concede Concede that if both devices are administered by the same team with the same credentials, the second hop bounds a network-level compromise but not a full administrative takeover — so if the budget only stretches to the hop and not to separating administration, say what the hop does and does not buy. Concede that the enumerable list is not empty. Conceding the weak parts is what makes the strong parts believable, and a peer who cannot get you to overclaim generally stops trying. ## The decision record Whatever is chosen, the output is a record: the two statements, the chosen position, the accepted residual, the failure posture, the owner of the second rule base, and the review cadence for exceptions to it. That record is what someone reads in two years when a request arrives to add a broad allow, and it is the only thing that makes the answer "no" survivable by the person who has to say it. ## Interview framing The interviewer is checking whether you can operate where the money is. Lead with the written claim and who signs it, price your own proposal before the peer does, offer the cheaper variant, name what you concede, and finish with the review cadence. A candidate who only says "terminate outside, it is best practice" has not been in this room.