Aviatrix Blog

Enterprise Multi-Cloud Networking

Archive

Aviatrix Blog

Aviatrix Multi-Cloud Smart SAML Remote User VPN – Secure User Access to Cloud Resources

Aviatrix Multi-Cloud Networking Platform provides an end-to-end secure network solution for multiple cloud enterprises. Smart SAML Remote User VPN is a cost effective, easy to deploy service enabled by the Aviatrix AVX Platform. A feature-rich client VPN solution, the Aviatrix client is based on OpenVPN® and supports SAML authentication. If SAML authentication is not required, the solution is compatible with any OpenVPN client.

KEY HIGHLIGHTS
Aviatrix Smart SAML Remote User VPN is designed for the cloud and delivers the following benefits:

  • Centrally managed VPN – Visibility of all users, their connection history, and all certificates across your multi-cloud network.
  • Multiple authentication options – LDAP/AD, DUO, MFA, Okta, Client SAML, and other integrations.
  • Profile-based Access Control – Each VPN user is assigned to a unique profile that defines network, host, protocol, and port access privileges. The access control is dynamically enforced when a VPN user connects to the public cloud through an Aviatrix AVX Service Gateway.
  • Broad Client Support – Compatible with Aviatrix VPN SAML client or any OpenVPN® clients.
  • Scale-Out Performance – Aviatrix AVX Service Gateway instances can be placed behind a network load balancer and scale to thousands of users.
  • Logging – Sessions, connection history, and bandwidth usage are logged and can be directly integrated with Splunk, SumoLogic, ELK, Remote Syslog, and DataDog.
  • Cost-effective – Low, connections-per-hour pricing. Optionally added to your AWS bill.

Secure user access to VPCs/VNets/VCNs is often overlooked by organizations when it comes to safeguarding their cloud environment. Allowing uncontrolled access by users will lead to data breaches. Users with unrestricted privileges can easily, even unintentionally, gain access to resources or data that they should not have access to. This creates business risks and violates regulatory compliance. Organizations under corporate and regulatory complince must demonstrate that they have controls in place to restrict access and provide accurate logging and reporting that documents enforcement. A policy-driven, scale-out, and geo-aware VPN solution with encrypted peering and central management console,  the Aviatrix Smart SAML Remote User VPN provides a secure network access solution for your enterprise admins, developers, and employees.

Why Aviatrix Smart SAML Remote User VPN?

Aviatrix Smart SAML Remote User VPN approach provides secure user access to the public cloud resources and has several advantages over traditional solutions such as a Jump host or Bastion host approaches.

Automated Network Load Balancer (NLB)

By default, a NLB is automatically launched by Aviatrix Controller. This NLB load balances the connection requests across multiple Aviatrix VPN Service Nodes. Depending on the scale, several Aviatrix AVX Service Gateways can be added to handle additional volume of requests. When deployed with the NLB, only one certificate is required and is shared by all AVX Service Gateways.

 

 

Profile-based Access Control Policies

Remote access administrators create profiles based on access requirements; for example, an employee may have more access than a contractor. Each profile applies security policies based on access control rules for IP address or address ranges, protocols, ports, VPCs or VNETs and more. A default “deny all” or “allow all” policy can be applied during profile creation. Profile-based access control enables flexible policies based on the users and user types, instead of a source IP address. The access control policy is dynamically applied to the the AVX Service Gateway (VPN attach-point) when a VPN user connects. The access controls for that user are only active when a user is connected. When a user disconnects, the security policy is deleted from the AVX Service Gateway and re-applied at next access.

SSO and Multi-factor Authentication

Aviatrix provides seamless integration with OKTA, DUO, Active Directory and other enterprise Identity Providers, and is the only OpenVPN client that supports SAML from the client software.

SUMMARY

Aviatrix Smart SAML Remote User VPN secures user access to cloud resources and provides centralized visibility into all users, connection history, certificates across your multi-cloud network. Seamless integration with AWS Route 53 and Azure DNS for geolocation optimizes user experience for traveling employees.

Technical Benefits

  • Highly Available; Fault Tolerant
  • Profile-based access control; Multi-Factor Authentication (MFA)
  • Supports split or full tunnel
  • Supports TCP/UDP protocols
  • Simple end-user certificate management
  • Supports NLB to load balance and scale-out user requests
  • Centralized management
  • Integrated audit logging (view in AVX console or integration with Splunk, Sumologic, Datadog, and other tools)
  • Supports Geolocation, allowing VPN users to connect to their nearest VPN gateway

For more details, check out docs.aviatrix.com or connect with our technical solution engineer through aviatrix.com online chat.

DOWNLOAD .PDF