> Even for WFH: just set up a damn openvpn in front of the vcenter server, if you don't have the money for a Cisco Anyconnect appliance. It's not that hard If

> Even for WFH: just set up a damn openvpn in front of the vcenter server, if you don't have the money for a Cisco Anyconnect appliance. It's not that hard If your business depends on employees that are working remotely, and you have critical services behind a VPN, your VPN solution is now a critical service too, and should be built and managed accordingly. Just throwing an OpenVPN host up isn’t enough. If you’re going down that road, you need multiple OpenVPN hosts, each one “hardened” (since they’re internet facing), and a mechanism to deploy the VPN clients (and certificates) to the users. You then need to do this a second time too for an entirely different VPN solution (OpenConnect? WireGuard? StrongSWAN?), in case the first one suffers a vulnerability that you can’t immediately mitigate and instead just needs to be shutdown. Like most technology solutions, this is only trivial to resolve if you’re operating at a really small scale, all your users are tech savvy, and you don’t treat it as a business critical service. The moment your business depends on it, it either ceases to be trivial, or becomes a large source of operational risk.