VPN Security: Going Beyond Basic Remote Access for MSP Clients

VPNs have been a staple of remote access for decades, but the post-pandemic world has exposed their limitations and security weaknesses. Many MSP clients still rely on VPN appliances that haven't been updated in years, with split-tunnel configurations that create security blind spots and shared credentials that make accountability impossible. While zero-trust network access is the future, the reality is that most SMBs still depend on VPNs today, and securing those VPNs is a critical MSP responsibility.

Hardening VPN Infrastructure

Start with the basics: update VPN appliance firmware to the latest version, as VPN vulnerabilities have been among the most exploited in recent years — Fortinet, Pulse Secure, and Citrix have all had critical zero-days that were weaponized rapidly. Disable legacy protocols like PPTP and L2TP in favor of IKEv2/IPsec or WireGuard. Enforce certificate-based authentication alongside MFA rather than relying on username and password alone. Implement full-tunnel configurations to ensure all traffic is inspected, and deploy always-on VPN profiles on managed devices to prevent users from accessing corporate resources without the VPN active.

Monitoring and Zero-Trust Transition

Monitor VPN connections for anomalies: logins from unusual geographic locations, simultaneous sessions from different IPs, connections at unusual hours, and excessive bandwidth consumption that could indicate data exfiltration. Log every VPN session with full connection metadata and retain those logs for at least 90 days. As clients mature, begin transitioning them toward zero-trust network access solutions that verify identity, device health, and context for every connection rather than granting broad network access through a VPN tunnel. The transition doesn't have to be all-or-nothing — start by moving web-based applications to identity-aware proxy access while keeping the VPN for legacy applications that require network-level connectivity.