The VPN. Its like the leaky, clanky dirty boiler room of the corporate world. (Or is that Excel?). No one loves it, no one knows how to not have it.
Today many of you were working from home via the VPN. More than usual. And it was not a speedy experience. A lot of that is due to the inherent properties of a VPN (its a stateful device, scaling by user rather than by bandwidth). But, you may not be aware, there is another cause: you. Yes you. When you are using the VPN all your traffic (likely) goes through it. Listening to spotify? Watching YouTube? Skyping that team member? Even though the endpoint is not inside your corporate network, the nature of a VPN is that it usually takes all traffic.
The ‘split-horizon’ VPN (sometimes called the split-tunnel) is an alternative. Its not necessarily a good alternative, merely different. You see, when you set up a VPN you are presenting with two fairly tough choices: make things work (and be slow), or allow things to be efficient (but maybe break).
Consider, you have a small home network. A PC. A printer. A Chromecast. You have the PC going, you print something over the network, you are streaming YouTube to the Chromecast, all is good. Then you start your corporate network, those things break. This is because the VPN takes all traffic, and your PC can no longer reach local things. Your YouTube now streams from the Internet to your corporate network and then to your house over the VPN. Hmm, what’s the alternative? Well. imagine the same house. The subnet allocated by that trusty home router is 192.168.0.0/24. But, your corporate IT people use that for the Wiki. If you enable split-horizon you can’t edit the Wiki. Argh.
So what do you do? You send an email to all your co-workers reminding them not to use spotify/youtube/… while on the VPN? You ask your IT team to enable split-horizon and argue about security and reliability? Or you work on getting these applications available, Zero Trust style, directly on the Internet, and toss the VPN to the curb? Door number three sounds pretty sweet if you ask me.