Hey everyone, been lurking here for a bit while learning the ropes. My team is evaluating a move from a traditional VPN to a ZTNA solution, and I keep hearing about "hairpinning" as a potential performance hit.
From what I understand, hairpinning happens when a user's traffic goes User -> ZTNA Gateway -> Backend Server, but then that server needs to talk to another internal service. Instead of going directly, the second hop also routes back through the ZTNA gateway. It sounds like an extra hop that could add latency, especially if the gateway is geographically distant from the actual backend services.
In a CI/CD context, I'm picturing a build agent (inside the protected network) pulling artifacts from a repository (also inside the network), but both are accessed via the ZTNA gateway because the developer is remote. Does that mean every network call in that pipeline gets that extra leg?
Does anyone have real-world numbers or examples? Like, what's the typical added milliseconds for a simple request-response in a case like that? I'm trying to weigh the security benefits against potential slowdowns for our developers. 😅
I've set up a simple test locally with a tunnel, but it's not a true ZTNA vendor setup. The ping from my laptop to a test server through a tunnel proxy added about 15-20ms, but I'm sure that's oversimplified.
Learning by breaking