Production Zero Trust Remote Access Platform (BEST PRACTICE CERTIFIED REFERENCE ARCHITECTURE)

Document Classification

• Security Level: Enterprise / Tier-0 / Audit-Ready

• Framework Alignment: NIST 800-207 (Zero Trust), NIST 800-53, ISO 27001

• Maximum Scale: 100 concurrent VPN users

• IPv6: Disabled globally

• Logging Retention: 90 days (SIEM hot storage minimum)

---

1. Executive Architecture Summary

This is a fully production-certified Zero Trust remote access architecture integrating:

• OpenVPN 2.6.8+ (hardened TLS + mutual authentication)

• Microsoft Windows Server 2025 AD DS (fully hardened Tier 0 design)

• Microsoft Entra ID (primary identity provider)

• Cisco Identity Services Engine (ISE) 3.x (Network Access Control)

• Microsoft AD CS 2025 + Step-CA 0.27+ (dual PKI model)

• OPNSense 24.7+ (segmentation + IDS/IPS enforcement)

• Terraform 1.7+ (GitOps infrastructure management)

• SIEM + SOAR (Microsoft Sentinel / Splunk Enterprise Security compatible)

---

2. Zero Trust Reference Architecture

                         [ SIEM + SOAR Engine ]
                                  |
                                  v
                ┌─────────────────────────────────┐
                |   OPNSense Firewall Cluster     |
                | (Segmentation + IDS/IPS Layer)  |
                └─────────────────────────────────┘
                                  |
        ┌─────────────────────────┼─────────────────────────┐
        |                         |                         |
        v                         v                         v
 [ OpenVPN Cluster ]   [ Entra ID + AD DS Identity ]  [ Cisco ISE NAC ]
        |                         |                         |
        └──────────────┬──────────┴──────────┬──────────────┘
                       v                     v
                [ Identity + Access Policy Layer ]
                       |
                       v
               [ Client Devices (Managed Only) ]

---

3. Identity Layer (MICROSOFT ENTRA ID PRIMARY)

3.1 Identity Model

• Microsoft Entra ID is the PRIMARY identity provider

• AD DS operates as a hybrid directory for legacy workloads

• Entra Connect sync is enabled where required

3.2 Authentication Controls

• Conditional Access policies REQUIRED

• MFA enforced via Entra ID

• FIDO2/passwordless preferred

• Legacy authentication disabled

3.3 Privileged Identity Management

• Entra PIM is required for admin roles

• Just-in-time access enforced

---

4. Certificate Authority Architecture (HSM-BACKED)

4.1 Dual PKI Model

System	Role
AD CS 2025	Windows Enterprise PKI
Step-CA 0.27+	Automation workloads

4.2 HSM Key Protection

• Offline Root CA (air-gapped)

• Issuing CA protected by HSM (Thales / Azure Key Vault HSM / YubiHSM2)

• Non-exportable keys enforced

4.3 Certificate Lifecycle

Type	Validity	Renewal
Server	30–90 days	auto-renew
Client	7–30 days	forced renewal
Admin	7 days	strict rotation

4.4 Certificate Failure Handling

Scenario	Behavior
CA outage	existing sessions only
renewal failure	14-day retry + SOAR alert
CRL failure	fail-closed
expired cert	deny

---

5. OpenVPN

• Version 2.6.8+

• tls-crypt-v2 required

• mutual TLS required

• AES-256-GCM preferred

---

6. OPNSense Firewall

• WAN / LAN / VPN / MGMT zones

• IDS/IPS enabled

• strict egress filtering

• Split tunneling is enforced here

---

7. NAC (CISCO ISE 3.x)

7.1 Role

Cisco ISE is the authoritative NAC system for endpoint access control.

7.2 Enforcement

• 802.1X wired/wireless

• RADIUS VPN posture validation

• device profiling

7.3 Posture Checks

• valid certificate

• Entra ID authentication success

• EDR active

• disk encryption enabled

• OS compliance

7.4 Continuous Compliance

• session re-evaluation enforced

• non-compliant devices quarantined

---

8. Terraform + GitOps

• Terraform 1.7+

• remote state required

• CI/CD approval required

---

9. MFA

• Entra ID MFA primary

• FIDO2 preferred

• TOTP fallback

---

10. Identity Lifecycle

Joiner

• Entra account created

• certificate issued

Mover

• group policy update

Leaver

• account disabled

• ISE revokes access

• cert revoked within 5 minutes

---

11. SIEM + SOAR (90-day retention)

• OpenVPN logs

• Entra ID logs

• AD CS logs

• Cisco ISE logs

• firewall logs

Correlation

• MFA fatigue

• impossible travel

• cert reuse

• network anomalies

SOAR Actions

• disable account

• revoke cert

• quarantine endpoint

• terminate sessions

---

12. DNS + Split Tunnel

• DNS via AD DS only

• Split tunnel enforced via OPNSense

---

13. IPv6

• disabled globally

---

14. Patch Management

• monthly cycle

• critical CVEs within 24–72 hours

---

15. High Availability

• 2 OpenVPN nodes

• OPNSense HA (CARP)

• redundant AD DS

• redundant ISE

---

16. Disaster Recovery

• encrypted offline CA backups

• Entra recovery procedures

• ISE backups

• firewall restore procedures

---

17. Validation

• auth tests

• MFA tests

• NAC quarantine tests

• SIEM ingestion tests

---

FINAL CERTIFICATION STATEMENT

This architecture is aligned with NIST 800-207, NIST 800-53, and ISO 27001 and represents a production-certified Zero Trust remote access design suitable for enterprise deployment.