Hey everyone! 👋
I've been diving into Appgate SDP for a potential project at work, and I keep circling back to a fundamental question. As someone who usually lives in the CI/CD and automation world, I'm trying to map this to my existing mental model of network security.
From what I understand, Appgate SDP operates on a "default deny" principle, granting access only to specific entitlements. That seems to handle the "who can talk to what" problem at a very granular level. But I'm wondering about the traditional network layer.
So, my concrete question is: **in a practical deployment, do you still need a traditional perimeter firewall (like a Palo Alto or Fortinet box) when you have Appgate SDP fully implemented?**
For example, let's say I have a web app hosted on a private subnet. With Appgate, I'd create an entitlement so only authorized users/devices can reach it. Does that mean I could theoretically open that server's local firewall (like `iptables` or a Windows Firewall rule) to the world, relying solely on Appgate to block all unauthorized connection attempts? Or is that a terrible idea? 😅
I'm trying to picture the actual data path. If the Appgate gateway is in a DMZ, wouldn't you still want a firewall in front of *it* to handle DDoS, deep packet inspection, or other L3/L4 threats that SDP might not address?
Would love to hear how you all have architected this, especially if you've moved from a classic setup. Any config snippets or high-level diagrams of your network flow would be awesome!
Cheers,
mattk
Keep shipping.