Looking at SASE for a 500-user company already on AWS. Need something that integrates cleanly with our existing VPCs and doesn't create a performance bottleneck. Perimeter 81 gets mentioned a lot, but is it the right fit for a cloud-heavy shop, or just good for remote access?
Primary requirements:
* Agent-based ZTNA for the user base.
* Traffic inspection (we'll likely keep some on-prem hardware for this).
* Direct cloud service access (like S3 buckets) without hairpinning.
* Must be manageable by a team of two.
Heard P81's network-as-a-service model can simplify things, but concerned about:
* Cost scaling at 500 seats.
* Real-world latency for East Coast users hitting `us-west-2`.
* Their AWS backbone vs. native AWS PrivateLink.
Anyone running a similar stack? What are the actual gotchas?
metrics not myths
We run a 300-person SaaS shop, all on AWS, and have been using Perimeter 81 for the last two years to manage remote and contractor access. Our core setup is their ZTNA agent routing to VPC gateways.
**1. Perimeter 81 vs. "Big Cloud" SASE for AWS Shops**
* **Cost Scaling at 500 Users:** You're entering their mid-market band. For agent-only ZTNA with basic inspection, expect $6-8/user/month. Adding their full FWaaS stack pushes it toward $12/user/month. The surprise cost is gateway compute for VPC egress, which is billed hourly per node. Two nodes in us-east-1 and us-west-2 cost us about $400/month extra.
* **Performance & Hairpinning:** For accessing AWS services, their "Direct Cloud Access" feature does prevent hairpinning through their data centers. However, it's not native PrivateLink. It routes traffic from the user agent to a gateway in your VPC, then out to AWS public endpoints. Latency from East Coast users to our us-west-2 VPC was 15-20ms higher than a pure AWS-native solution.
* **Deployment & Management:** The setup wins for a small team. Connecting VPCs took under an hour. The admin dashboard is unified. You manage users, gateways, and policies in one place, which is a real time-saver over stitching together separate services.
* **The Real Limitation:** It's primarily a remote access ZTNA tool that grew network features. If your core need is securing east-west traffic *between* AWS services or VPCs, it's not the best fit. Their inspection is focused on user-to-app traffic. We kept an internal NGFW for intra-VPC traffic.
**2. My Pick**
If your primary driver is simple, secure *user access* to cloud resources with minimal overhead, Perimeter 81 is a strong choice. If your architecture requires deep, native integration with AWS services and optimal intra-cloud latency, look at native AWS options like Palo Alto Networks Cloud NGFW or a Zscaler setup directly integrated with AWS Transit Gateway.
Tell me your ratio of user-to-cloud traffic versus cloud-to-cloud traffic, and if you have any compliance needs for data inspection. That would clarify the direction.
> For accessing AWS services, their "Direct Cloud Access" feature does prevent hairpinning through their data centers. However, it's not native PrivateLink
Just to clarify this point for my own understanding, does this mean traffic to, say, an S3 bucket is still inspected by P81 before going directly to AWS? Or does the Direct Cloud Access bypass inspection entirely, which might be a security trade-off?
Also, could that hourly gateway compute cost really jump if our traffic spikes? That's a variable I hadn't considered.