Site to Site VPN: Do you need one?

Imagine a multinational corporation sharing confidential data between its headquarters in New York and its research facility in Tokyo. Sending this data across the world safely, hidden from prying eyes and protected from snoops, is possible when you use a site-to-site VPN. Keep reading as we explain what it is, how it works, and its benefits and limitations. We’ll also go over how it’s different from other types of VPNs, its real-life applications, and who should use one. 

What is a Site-to-Site VPN?

A site-to-site virtual private network (VPN) is a way to connect local area networks (LANs) in multiple locations across the public internet. It allows employees on different sites to securely share resources and information. This technology is often used by businesses or government agencies with multiple offices.

Site-to-site VPNs are essentially systems for creating secure wide area networks, or WANs. A WAN is any network of connected LANs, and most site-to-site VPNs are classed as WANs. Unlike other types of WAN, however, a site-to-site VPN connects multiple LANs with a secure VPN tunnel.

How does it work?

A site-to-site VPN provides access from one network to another over the internet. It works by creating a secure, encrypted tunnel between two networks located at different sites. The tunnel acts as a direct link through which data can be securely transmitted.

The VPN uses routing tables to direct data packets along the correct path within the tunnel. Site-to-site tunnels rely on encryption protocols to ensure data cannot be intercepted or read by unauthorized parties.

The process involves establishing a gateway at each network end, effectively connecting entire networks rather than individual clients to a VPN server. The VPN gateway manages data encryption and decryption as it enters and exits the tunnel.

Data travels through the public internet within this tunnel. Encryption makes the data opaque to outsiders, appearing as unintelligible gibberish. Upon reaching the destination gateway, data is decrypted and transmitted to the receiving internal network.

This secure bridge allows seamless, secure information flow between networks. Resources can be shared as though they are on the same local network.

Benefits of Site-to-Site VPN

Site-to-site VPNs are in use by many organizations. The reason for this is that they provide some benefits to enterprises and their employees, such as:

• Secure Connectivity: All traffic flowing over a site-to-site VPN is encrypted. This means that any business data crossing over the public Internet is encrypted, protecting it against eavesdropping and modification.
• Simplified Network Architecture: Organizations commonly use internal IP address ranges for devices within their LANs. These addresses need to be converted to external IP addresses to be accessible from the public Internet. With site-to-site VPNs, traffic from one LAN to other remains “internal”, meaning that all sites can use internal addresses for each others’ resources.
• Access Control: Some network resources are intended to only be accessible internally, meaning that employees at other sites should have access but not external users. Since site-to-site VPN users are “internal” users, access control rules are simpler to define because any traffic not originating from inside the network or entering via VPN tunnels can be blocked from accessing these resources.

Some limitations

A site-to-site VPN is handy for secure data sharing over large physical distances, but it only makes the cut for some. Here are some reasons it might not be the best solution every time:

• Doesn’t suit remote teams: It only offers protection to employees connected to the office network. Anyone working remotely won’t have access to the VPN gateway, and the data they share won’t be secure. A remote access VPN would better suit businesses with remote workers.
• Only provides point-to-point connectivity: It creates a unique connection for each pair of sites. You’ll have to set up a ton of site-to-site VPN connections if you have many sites to connect.
• Limited security at the LAN level: You will get secure data transmission between two office networks (LANs) with a site-to-site VPN. However, it doesn’t protect the data or devices within each LAN.
• Lacks advanced security features: The VPN tunnel encrypts the data but doesn’t offer other security features like data regulation. Companies can use a hub-and-spoke model where all sites are connected to a central control point that grants or denies data access to different sites. However, this increases the load on the main network, leading to significant lag.
• Lack of visibility and decentralized management: Every site-to-site VPN connection operates independently. This makes it hard to oversee and manage data transfers across multiple connections. Handling the setup, configuration, and monitoring of separate VPN connections is a challenge for most small-to-medium-sized businesses.

Difference between Site-to-Site and Remote Access VPN

With a site-to-site VPN, an encrypted tunnel using IPsec—a suite of protocols that create an encrypted connection between devices—is created to establish a VPN “tunnel” between two servers to traffic data.

With remote access VPN, a secure sockets layer (SSL) VPN—which uses an encryption-based Internet security protocol—is typically used to form connections between the office network and individual endpoints.

Secure access service edge (SASE) is another platform, geared towards companies that house a lot of their data in the cloud. It combines remote access VPNs with the security features that you would expect from a corporate firewall, like threat hunting and detection, next-gen antivirus, and more.

If you’re concerned about company data being handled remotely, then investing in a SASE system is likely the best option for dealing with a remote workforce for now and the future—it’ll allow you to have all the benefits of your office network security but through the cloud instead.

While site-to-site VPNs are best suited to businesses that operate with multiple offices, remote access VPN is best suited to organizations that have remote workers, and a combination of the two is ideal for a company that has both.

Why implement a Site-to-Site VPN

There are several factors to consider when figuring out whether to implement site-to-site VPN services. In some cases, typical IPsec is sufficient for communication between two or more locations. However, there are a few considerations that may drive a company to use VPN connections instead:

• The number of locations
• Business size
• The distance between each location
• The resources the locations have to share with each other

In most cases, It is a good solution if your business consists of several locations, each with employees who need to share resources provided by the main office. If you use a site-to-site VPN in this kind of situation, you can ensure that all employees have secure access to the same resources.

For example, suppose you have a company based in New York, but it has several branch offices, one in Shanghai, one in France, and another in Switzerland. Each location has between 15 and 20 employees. The company’s email system is housed on a central server. You also have a data server that holds important marketing collateral and proprietary information.

If you use a site-to-site VPN, not only can every employee access the same resources but the data is also encrypted, keeping it safe from attackers who may want to exploit it.