What is a Remote Access VPN (RAV)?

Remote Access VPN (RAV) is a VPN service that lets an individual remote user establish a secure, encrypted tunnel from their own device into an enterprise network, rather than connecting two networks together. The service authenticates the user, encrypts all traffic in transit, and gives the device access to internal resources as if it were locally connected.

Key takeaways

• RAV connects one remote user’s device, not two sites, to the enterprise.
• The client authenticates, then tunnels traffic to a gateway or branch device.
• IPsec and DTLS/SSL are the two common tunnel protocols in use today.
• A gateway needs a public static IP and certificates to terminate sessions.
• ZTNA increasingly replaces flat RAV access with per-application policy.

On this page: Why it matters · How it works · Types · RAV & Versa · FAQ

Why is RAV important?

Before remote access VPNs existed, reaching internal applications from outside the office meant dial-up lines or no access at all. RAV solved this by letting any authenticated user, anywhere on the internet, open an encrypted tunnel straight to the corporate network – the technology that made remote work operationally viable long before it became a mainstream expectation.

It remains important because it is still the default way many organizations extend network-level access to laptops, contractors, and field devices. A properly configured RAV service protects data in transit over untrusted networks and centralizes authentication. The trade-off – and why newer architectures are displacing it – is that classic RAV typically grants broad network-level reachability once connected, more access than most sessions actually need.

What is RAV?

A remote access VPN has two ends: a client on the user’s laptop, phone, or tablet, and a gateway at the edge of the enterprise network. The client authenticates the user – with a local password, an LDAP/Active Directory bind, a SAML identity provider, or a certificate – and negotiates a tunnel with the gateway. Once the tunnel is up, the client’s traffic is encrypted and carried to the gateway, which decrypts it and forwards it onto the internal network as if the device were plugged in locally.

Two policy models control non-corporate traffic. Full tunnel sends everything, including general internet browsing, through the tunnel to the gateway. Split tunnel sends only traffic destined for internal resources through the tunnel, while internet traffic exits locally – reducing gateway load at the cost of centralized inspection of that traffic.

Types of RAV

Two tunnel technologies dominate. IPsec remote access VPN builds an IP-layer tunnel authenticated and encrypted with IKE and ESP; it is efficient and well suited to always-on, full-tunnel client software. SSL/TLS VPN (including DTLS-based variants) tunnels over the same ports web traffic already uses, which traverses restrictive firewalls more reliably and supports both installed clients and, in some products, browser-only clientless access.

A third pattern is increasingly displacing both: ZTNA-based remote access, which drops the network-level tunnel entirely and instead brokers per-application access after continuously verifying user identity and device posture. Where classic RAV places a remote device on the network, ZTNA never extends network-level trust – it authorizes one application connection at a time.

RAV & Versa

Versa delivers remote access VPN as a licensed add-on service on VOS devices, configured through a remote access server (RAS) template and a Versa endpoint client profile. Enabling it requires one WAN port with a static public IP and FQDN, plus uploaded public CA certificates – configured in Configure an Endpoint Client Service (Remote Access VPN). The endpoint client template defines authentication (local, LDAP, or SAML), DNS settings pushed to clients, and client security rules matched on location, address, device, or user group.

The Versa Secure Access (VSA) client connects over IPsec or a DTLS tunnel, full tunnel only, and supports two-factor authentication through an authenticator app or email OTP. An IPsec tunnel address pool assigns each client an IP address, and a default firewall rule governs VSA client traffic entering the network. See the Titan release notes for version-specific RAV behavior and limitations.

Frequently asked questions

What is the difference between a remote access VPN and a site-to-site VPN?

A remote access VPN connects one user’s device to an enterprise network. A site-to-site VPN connects two networks – such as a branch and a data center – to each other, carrying traffic for every device behind each end.

What is the difference between split tunnel and full tunnel?

Full tunnel sends all client traffic, including general internet browsing, through the VPN gateway. Split tunnel sends only traffic bound for internal resources through the tunnel and lets other traffic exit locally, reducing load but skipping centralized inspection of that traffic.

Does ZTNA replace remote access VPN?

Increasingly, yes. ZTNA grants per-application access after continuously verifying identity and device posture, instead of placing the remote device on the network the way a classic VPN does, which removes the lateral-movement risk a flat network-level tunnel creates.

What authentication methods does a remote access VPN support?

Common options include a local username and password, LDAP or Active Directory binds, and SAML single sign-on through an identity provider. Many deployments add two-factor authentication, such as a one-time password or an authenticator app, on top of the primary method.

What does a gateway need to terminate remote access VPN connections?

It needs a reachable, typically static, public IP address and an FQDN that clients connect to, plus a valid public certificate chain so clients can establish a trusted, authenticated tunnel before any traffic flows.

More on RAV

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about RAV, these are worth looking at next.