Tailscale for securing access to on-prem legacy ERP - any pitfalls?

Securing a legacy ERP with the latest mesh VPN flavor? Brave. Tailscale's magic auth is slick, but you're adding a new moving part to a system that probably predates Node.js.

Have you mapped the actual traffic flows? The ERP client-server chatter, any batch job servers, admin ports. Tailscale's ACLs are fine, but debugging why a 20-year-old client can't see its server over a WireGuard tunnel is a special kind of fun. Latency can be a killer for those old, chatty protocols. Test that first.

And remember, you now own the "why is the VPN down" calls. Instead of a boring firewall rule, you've got a control plane in the cloud. Hope their uptime is better than your ERP vendor's.