Transcript for "Modernize Remote Access: Replace Legacy VPNs":
Hello, and welcome to today's webinar. My name is Vinay, and I will be helping support today's live session. Before we begin the session, a little bit of housekeeping. On the top right corner of the screen, you will see the live chat option that you can use to interact with your fellow attendees. We have also attached a white paper on VPN replacement in the docs section that is located next to the chat. On the extreme right, you will also find the q and a box. We encourage you to leave all your questions in that q and a box as we progress through this webinar. We'll make sure to address all your questions towards the end of this presentation. A quick reminder, this session is being recorded, and we will share the recording with you within forty eight hours. Now please join me in welcoming today's speaker, Adam Boyce, senior solutions engineer at Cloudflare. Hey, Hi, go. how's it going? Yeah. Alright. I think I'll I'll kick off. So welcome. Thanks everyone for making the time out of their busy day to be able to attend. Very thankful and and and really looking forward to interacting with you guys on the on the call. Yeah. I'll I'll if you've got any questions or anything you'd like to you'd like to ask, feel free to put it as as mentioned just into the q and a section. And I'll try to keep my eye on on the chat, and Vinay will also help prompt me as well. So without further ado, we'll just launch into our modernizing remote access with the replacement of VPNs. So just if we move on to this one, Why replace VPNs? So typically, VPNs, if we do look at the technologies, are very old technology in the ten plus years old. one. Yes? Yeah. I think you're not sharing your screen. Oh, it's not happening. Okay. Yeah. Can you click on screen share? I think then we can see it. Oh, my mistake. It's still stuck there. Just a moment. I'll do it. Yep. There you go. Hang on. I've done the wrong screen, so let me just do the right one. What a, great. stunt. It's all good, try. that again. Take two. Is that better, Vinay? Yes. Thank you very much. you. Why replace a VPN? So as I was saying is that VPNs are a very old technology in the context of, you know, ten plus years old now. They were built for a different time where we had a lot of infrastructure centric types of data centers and so on, where a lot of the resources were locators, you know, web servers, application servers, whatever whatever the use case was. Now, typically, it's typically slow and clunky. So it didn't really scale to as the business grew. So in order to support more and more users and more and more, you know, more and more throughput, it had a heavy reliance on the infrastructure that was deployed at that particular location. So it it ended up being a poor user experience over time as as adoption grew. It it can be very complex to manage as well. So deploying configurations and security policies, Typically, this was handled by using IP based access lists or IP based controls, where coupling with applications was very difficult to keep on top of access. So most of the customers that we do speak to when we are around the SASE platform typically have very loose IP based rules when allowing staff connecting through the VPN, all the accessing services. So that opens up a whole bunch of potential security risks as well. So a big way that an adversary might leverage a a VPN that's compromised, we start leveraging the account, connecting in, or some sort of vulnerability on the on the VPN head end to then get access or initial access to the network. From there, because the controls are typically IP based, it might be user to a particular subnet, lateral movement between services a real possibility to have happen. So it's very difficult to control with just basic IP accesses. Some of the replacement outcomes. So what we want to try to provide as part of replacing it is a slick user experience and accelerate onboarding or up to 60%. So typically today, when we are talking to customers, there is a lot of legacy configuration that typically needs to be decoupled or understood before rolling into a more slick user experience through our SASE platform. So once we do have users migrating across, it's typically a much cleaner and more secure experience. So with that, there's quite a significant reduction in tickets from that. So questions from users saying, can't get access to this, and why can't I get access to this is a real burden for IT support teams to be able to unravel and also can be quite complex depending on the size of the organization. The other side, as I just mentioned, which was strengthening the security policy. So being able to lean into zero trust controls where we identify users and applications that they can access on prem or in the cloud becomes a lot better outcome rather than traditional IP based controls. That coupled with modern authentication platforms, so think Entra ID, Okta as examples, to be able to lean into those identity platforms to provide policy around connectivity. Alright. So security risks. So let's have a look at some of the different issues associated with your typical VPN solution. So as I mentioned or touched on before, there's a large chunk of of being compromised is around credentials. So typically, you know, VPNs might be using, say, username and passwords through a traditional, like, AD based system to get access, or in maybe some more sophisticated customers might be using certificates as well. But overwhelming majority of customers that we speak to is are just using username and passwords. So as we know, username and passwords are a very, very weak way of securing an environment. So think about all the password dumps that are from all different breaches. Have I been pawned? For example, go and check out your email there, and most likely, you'll find your address has been identified within a security breach somewhere. And what that means is that a lot of users will reuse the same username and password even for their corporate environment, and this is how credentials are used or leveraged to get access to VPN type services. Once access has been made available, then the lateral movement within the network happens from there. So it's a nice, way to get in. Looking at exploits as well, it seems to be a weekly occurrence these days where a number of the VPN providers tend to have very high CVS based vulnerabilities being reported. So this opens up, you know, a whole bunch of issues associated with initial access through some sort of exploit. Okay? Alright. So, again, just leaning into some examples of those security risks. So we can see on the right here, we've got a number of different vendors around, say, Cisco. We've got, as you can see, the AnyConnect and Meraki based OpenVPN. I've I've also seen a lot of customers leveraging OpenVPN, which has had a lot of big vulnerabilities associated with it, and it becomes something you've got to ongoingly manage, patch, and update all the time. Okay. The other side as well with VPNs, typically be coupled with a whole bunch of bespoke solutions for all sorts of things. So, for example, you might have an office users that will have direct internet access, maybe an MPLS connection, where there's some sort of firewall as a service as part of that provider, through some sort of legacy WAN that might provide some DDoS of protection when accessing some of the applications on the right hand side. So as we talk to customers and start to understand their technology stack, a lot of customers still have lots of bespoke solutions throughout their environment. So that is a very difficult thing to manage from an operational perspective, being able to make sure everything's patched, making visibility across all the platforms centralized. It's a real challenge. So having that infrastructure spread on all different technologies makes it very tricky to secure users and manage users. Alright. So breaking that down into specifically VPNs. So this is, I guess, a typical type of VPN deployment. So there'll be some sort of VPN heading, whether that be something hosted on a router, firewall, maybe a proxy or even some dedicated VPN appliance that performs the protection or the termination endpoint for all of the remote users. So you can have users anywhere across the globe being able to connect directly to your head end to be able to then access those private services, whether they be, you know, inside or as part of a data center or potentially a remote office. We also find a number of, you know, a number of customers leverage the data center with proxy services to be able to filter outbound traffic to the internet as well. So not only is it just for protecting those private applications, but also access controls to internet applications or websites as well. Now, it can be very difficult to protect a VPN point because you can't simply do it based upon, say, geographical based IP address filtering. So if you say in Australia, putting IP access lists associated with Australian IPs can be a very frivolous based control because a number of threat actors will just simply bypass Australian IP addresses by using either proxy services, AWS, Azure, any of those sort of jump hosts that might live in the Australian IP address. So therefore, protecting based on IP can be very, very difficult to do. Okay? So most customers, as part of that VPN head end, will just have it open to the Internet. And having it open to the Internet allows allows a lot of threat actors to scan, do some reconnaissance, and maybe even identify vulnerabilities that could be exploited in order to move further into the network. Alright. So looking at it as part of the modernizing that remote access process. So we do see customers taking different approaches for migrating to the Cloudflare platform. They might start off with a pure ZTNA type of approach when accessing private applications. So this is where, as part of the prioritization, it might be connecting your internal apps to the Cloudflare network, integrate identity and endpoint protection, and then start defining some of the zero trust rules for those applications. Once that's defined, testing potentially some client less access as part of that as well. A very common use case is that, you know, a customer might come to us and say, hey, I want contractors to be able to access my internal application because they need to be able to do some work, but I can't get them to install our VPN client because their their IT teams are not allowing those sorts of, you know, configurations to be done on their computer. So this is a starting use case that we do see a lot of customers kicking off from. And then as those use cases expand to a full SASE type solution, you'll start to see, you know, a full replacement of those applications and of replacement of access to those applications, I should say. And then also, using gateway based controls of being able to filter internet based traffic as well. Alright. So what does that look like all pulled together as part of the Cloudflare solution? So here essentially Cloudflare being in the middle of this Cloudflare with over 300 pops located globally within 300 cities. Each of those cities having multiple locations as well. So you can see the presence of Cloudflare is very large compared to other vendors. And the idea is that wherever these entities are globally, they will connect to the closest Cloudflare edge. Okay? So here's an example here where you may have a branch office that's using what we call a WAN connector to then connect to the Cloudflare network. So this could be a physical appliance that can just be plugged in at that branch office to be able to get access to Cloudflare. Then once once the on ramping to Cloudflare is done, then all the controls around access to private applications, PaaS services or internet bound applications are all controlled within Cloudflare. Some other on ramping options is that if there's an existing, say, firewall that exists at the headquarters, then we can leverage, say, IPsec connections to then on ramp to Cloudflare and then centralize those controls as well. In the case of a remote employee, there's a device agent that can be installed onto that device, which will then provide on ramping to the Cloudflare platform as well. And last, I just want to touch on these two use cases as well. In the case of a data center or in the case of your PaaS environment, say AWS, Azure, that are hosting subnets and infrastructure as a service, then we can provide connectivity by using a tunnel agent. And what this does is that it's a service that runs on either on prem or in your past environments that then creates a tunnel out the Cloudflare by via an outbound connection. So the idea is that you just simply install the agent. It connects to the local Cloudflare pop to provide the on ramp services, and then all your policy controls are all centralized within Cloudflare. Okay. So that's a bit of an overview there. So, I'm just looking at some of the questions there. So I can see one that says keen to understand the availability, stability of using Cloudflare ZTNA as a I'm just gonna expand that a bit more. As a replacement to VPNs currently, we have firewall to virtual, firewall into the cloud environment using IPsec VPN. It's great as we're limiting third party vendors, not so great is the security risk when you have mentioned. Correct. That's spot on. Spot on there, mate. Now introducing a third party to the link would add a level of risk if Cloudflare network goes down. That's true. I mean, like, with any with any platform, it's always like a trade off. Like, it is possible for Cloudflare to go down. It is you know, we we do our best like every other infrastructure to, you know, minimize the outages that that will happen. It's pretty much a a foregone conclusion with anything in IT. It will break. So but the advantages typically will significantly outweigh the the the risks associated with it. So looking at a traditional VPN solution, it might be okay for a very narrow use case, but as it scales out and being able to manage it a bit more holistically, it becomes a difficult thing to scale out using a VPN technology. So moving to a SASE platform and aligning to those zero trust principles, which typically is, you know, looking at the user, looking at the application they're trying to access, and also in the case of the device agent, looking at what type of device they're using to access the application. So think of things like, you know, what we can do on this side is look at things like, is your operating system patched to the latest version? Or if you're running some sort of EDR platform, is that currently running as expected? Or has the EDR platform identified risk that needs to be inputted into the policy to adjust access? So, for example, let's say that there's a risk score or some sort of malware detected by that EDR platform, let's just cut off access to some of the private applications that are sensitive, say, let's say, a Salesforce or, let's say, HR systems or anything that might be mission critical to business. Did that answer your question there, Matt? I think I'll hope that he hits that thumbs up. Alright. So what I'll do now is I'll go on to the demo, and what I'll do now is I'll just scroll over and just give a little bit of an idea of how it would be configured. The first thing we'll look at is the zero trust network access. What I'll do is I'll just come back to the diagram and I'll toggle backwards and forwards between the diagram and give a bit of an explanation. So on the left hand side here, well, let's actually look at say the tunnel agent here. What I'll do now is to show what it looks like to get access to a private network from Cloudflare by looking at the tunnel agent. Okay? So from the dashboard, if I go down to networks, you can actually spin this up on a free account. A lot of this stuff I'm talking about today is available to try out. It's really great for home networks. If you've got some sort of lab at home and if you're exposing your lab environment, say, via, like, a WireGuard or OpenVPN today, then this is something that you can spin up and replace relatively quick. And what I'll be walking through today is exactly aligning to that. So with your free account, you can click on networking or networks, and then click on the connectors themselves. Here, I've got a whole bunch of connectors in here. So what I'll do here is just show what I do in order to provision the Cloudflare d or the tunnel agent, which I'm talking about here. K? So clicking on that, I hit select Cloudflare v. Oops. If we can hit it. And then we give it a name. So we'll call it, you know, webinar connector. We'll just call it webinar webinar connect. K? Next, I'll hit save tunnel. Whoops. K. Yep. And now we're into the install and run the connector. So depending on the operating system that you're going to be hosting the connector on, it can be anything from Windows, Mac, Debian. It can even be a Docker container. Typically, in my home lab, I've I've spun up all of my connectors as a docker container, and it's just a matter of simply copy and paste in for the platform that you select in order to stand up the connector. So what I'll do here is to show you what it looks like from a docker perspective. By copying this docker command into the command line. Okay. Then it will show up. So once I've copied that across. Okay. Just connect back over here. It'll start showing up. I'm just gonna go back here because I've already got one created already or a number of them created already. You'll start to see it show up here. Okay? And once that's set up, then this is where this is where the on ramping that I was talking about here to Cloudflare takes place. Okay? Likewise with the WAN connector, so if it's a physical appliance, it's something that we physically ship as a solution. So think about those branch offices that don't have any infrastructure. You can just simply acquire the WAN connector that we do sell, plug one side of it into your LAN, one side of it into your Internet, and then that secured access from the branch office to Cloudflare is secured. All traffic will go through the tunnel in order to, you know, access private applications or public Internet. Okay. Alright. So what I'll do now is to move across to the the traffic policies. So this will give you an indication of, you know, what I can do for public and private apps. So the first thing I'll click on again, you can do this on the free plan where it is allowed. So when I do click on the firewall policies, I've got three enforcements controls that I can that I can enforce, which is DNS, which is basic DNS just by looking at the requests that come through to Cloudflare and then saying yes or no. If there's IP based connectivity, so if there's any applications that are are non HTTP, so think about the use case of accessing some sort of RDP service internally, or accessing some sort of SSH service. This is where you can start defining control around IP addresses. So very similar to the to, say, you know, what might be set up as as your VPN today. The overwhelming majority of applications today for internal and external is really around HTTP. Okay? So this is where I can where most customers spend time when configuring the policy, and as part of that policy, we can see here that there's a whole bunch of if connections. So if the traffic type is, in this case, HTTP, then I can start putting in some matching clauses around the application. So here, there's a whole bunch of match capability that we can get very technical on what we want to match in order to apply policy, but the easiest one to understand is something around content categories. So I can define a content category, which is inside of, let's say, newly seen domains and new as part of it, because newly seen domains may be nefarious an example, I may want to apply it selectively to different groups within the business. So as part of the identity, because the whole platform integrates with the identity providers I mentioned before, whether it be EnterID or Okta or one of those platforms, we can then start defining specific attributes associated with the identity. So whether that be a user email, a group ID, a group name, and any other attribute associated with the identity platform. Okay? So what I'm gonna do here is I'll just choose I think I've got some group names set up here where I can say k. K. So in this case here, I've got a integration with Okta, and as part of that integration, I have the groups within Okta pushed down to Cloudflare, and I can then just simply select the identity group that that particular, you know, group of users are part of. So in this case, teachers. And then the third item, which is where I was touching on in the use case of the remote employee that has a device agent connected to it. K? We're able to do some pretty granular controls around the posture of that endpoint. So in here, I'm gonna put in add a condition, and then I'm gonna select a posture policy around around things like updated or a particular version of Windows, whether it's AD joined, the EDR platform is configured and up and running. And when I select that, so in this case here, here's a predefined posture policy I've created. So this policy is is checking for Windows 11 and CrowdStrike installed as part of it. Okay? So you can get very, very granular with access around what applications, who can access it, and whatnot. Okay. Alright. So the networking, as you can imagine, is a little bit less granular because, again, the nature of IP based filtering is not as granular when we're looking at, say, HTTP. We've got a lot more controls with HTTP as part of that. Okay? So but very similar policy items around when the traffic matches the destination, so they're gonna be slightly different with regards to some of the selectors for that. Okay. Alright. So that's how the policy would look for controlling, you know, within the Cloudflare environment for all these entities and access to the application. So whether they be within a headquarters environment, data center, AWS, all of this is typically done from that panel. The other use case I wanted to sort of show off is around the clientless access. So this is essentially where users that are not able to install the agent fully can be installed. So if I click on access controls over here, this takes us into the application configuration. So what I'm going do here is just click on applications, and I've got one private application internally. Oops. Can't type. K. Where I've got an e s s ESXI device. So this is an internal application sitting in my lab, and what I can do is I can publish these applications as part of a landing page. And then from here, I can then just simply access it, whoops, through a tile. Okay? Now as part of that log on, remember this will actually, I'll just re show what that looks like if I do a log out. K. And then I'll log back in. You're presented with a log on endpoints or a log on selection. So in this example, I've got a number of integrations with, say, Google. There's an Azure ID or Enter ID as it's now known, or Opta. So if you've got a multi identity provider environment, the user can select it. If you've only got one, this page becomes redundant, essentially. We can also support other identity mechanisms by putting in the user's email and then sending a code to the email as well. And this would be defined in that policy we saw before around an identity. So you can put the contractors email address or maybe the domain in there as part of the identity to then access the application. So what I'll do here is just show what that looks like. I'm just going through a normal identity flow. Okay. And then this is when I land here. So here, let's say I'm a contractor wanting to access ESX. So I click on on that. I'm now connected to a private ESX server. So in here, I'll just put in some identity stuff in here. And now I'm now connected via public Internet access to a private application, and it's totally seamless. Okay? The other thing we're able to do is, you know, we do have a number of customers that are wanting to give access to, say, a non web based application. So we do support a capability of delivering, say, RDP through the web browser as well. So rather than having a thick client, which a number of customers do today and sometimes expose RDP directly to the Internet, which I have seen. By putting access in front of that, what we're able to do is to bring in the desktop environment through the browser and interact that way. K. Alright. Okay. So if I just go back to the diagram here. Okay. I'm just gonna do a little bit of a time check on my end. So just bear with me. Okay. So as as part of this, you know, we've covered off, you know, what it looks like to access using the tunnel agent. You know, you can provide that on ramping with IPSec as well, whether it be that WAN connector or the device agent. Now the device agent, it should show you what it looks like on from the user perspective to access those applications. On the top right hand side here, we've got a little icon, which is showing, you know, this is what the agent looks like. Okay? So from a from a perspective of a user interaction, essentially, you can fully configure what they actually see or in most cases, customers just have it silently installed and then have the agent connect anytime the the user fires up their laptop. So that allows where we've got the remote employee, whether they be even on prem or traveling around the world, also, you know, being a 100% of the time pushing it to the Cloudflare edge in order to access any of the applications. The advantage of being within Cloudflare, as I mentioned earlier, was the 330 something. It's growing every month, it seems. I get emails announcing that a new pop location has opened up. The advantage is that if there is any traffic, you know, required to access a data center, it's most most likely there's a Cloudflare pop very close to both of these users. So if these are in the same city, connectivity is lightning fast. With some other vendors, the location of these termination points for the device agent and, you know, the the data center and so on may not necessarily be in the same city. Okay? So from an application access and responsiveness point of view, it's pretty much like lightning fast. Okay? The other advantage as well is that if you do have a global workforce or if a particular user is traveling to different parts of the globe, typically, performance compared to, say, a VPN solution is going to be far superior as well. So let's just take the scenario of where that remote employee may be, let's say, in London, let's say this data center is in LA, and this is in Singapore. In order for that remote employee to access an application on the data center, the only public infrastructure that the employee is going to connect across is essentially the service provider for the internet service providing, and then most likely Cloudflare will have a direct peering with that service provider to then transit the traffic across the globe. Likewise, where the data center lives, it too will have its service provider, which most likely again will have a peering relationship with as well. Some larger customers can also opt to directly connect their infrastructure to a Cloudflare equipment as well. So if you are in, say, an Equinix type data center, then it's just a patching that can be done to our kit, which we don't charge for, in order to get as close as possible to that termination point. Comparing that back to the scenario where you've got the VPN, Okay? If the these users are distributed, and data center is, say, within Singapore, the user experience is going to be wildly different and inconsistent. And, again, this is where, a lot of support tickets might be opened up around the performance of the applications that it's accessing as well. There's also an interesting scenario around, let's say, the Seattle user is accessing a resource or accessing a VPN endpoint that's in, say, South Africa, but the AWS resources is, say, in Singapore. So you'll find that there'll be some massive tromboning type of traffic patterns or hairpinning type traffic patterns that will definitely blow out the application responsiveness and what the user expects. Comparing up to this solution, so again, there's no exposure to internet weather events in order to that can be impacted by the the the for the application itself. Okay. I haven't been looking at the the questions there. Very let's have a look. Okay. Does your solution work with network shares? Correct. So there is a network share. So so I just have to understand the question more. So network shares across hosted with Azure file services, Windows and Mac. So in the case of a file share, the device agent would be required in that case. In the clientless access I was talking about before, it really is covers off the the use cases of RDP in browser, SSH in browser, and then, of course, a web application. Okay? Hopefully, that answers your question. There's a couple of buttons I'm just gonna press. Yep. That's cool. Okay. Next question was for the Cloudflare d tunnel, can we have multiple instances for the same intended allocation? Hang on. I've got let me just expand it a bit. Like, setup, and which one does it support active active or active standby? So we do have it as a active standby where you can spin up these Cloudflare D agents as a pair, but you can also scale it out on a per application level if you want as well. So let's say that you've got, you know, 10 applications running in AWS. You can spin up one agent per application if you want. We do have a number of customers, you know, running container workloads, so think about Kubernetes. And as part of their Kubernetes setup, they've got Cloudflare d sitting alongside as a sidecar to the pod to be able to provide connectivity. We don't charge for on ramping of these these agents. You can spin up as many agents as you want. All we we charge on is around the enforcement policy and traffic. Okay? So how you wanna deploy is is completely up to you. And each one of those so let me just close that off. So each one of those 10 applications that you've got, say, 10 connectors, each of those can have can be an arrangement as well. So that'd be a total of, like, 20 connectors as as an example. Alright. So does your solution work for network I've already covered that one off. K. Does your solution compare to Cisco Secure Access? I would say the Cisco Secure Access is is more around the, I guess, a VPN type of technology still today. We don't really come across, at least in in in my endeavors, as a an SC for Cloudflare and seeing seeing a lot of Cisco playing in that SASE space. Yeah. So I can't really say a lot. The the the last the last knowledge around Cisco Secure Access was just a, like, a a VPN type, like, an AnyConnect type thing. I'm I don't know if it's evolved much beyond that, but but it's it'd be very difficult for, say, Cisco to scale this out to the, you know, the the scale that Cloudflare's got and another other number of other vendors as well in in playing that SASE space. I think that's all the questions I've got in the chat there. So Vinay has been helping me through this with the navigating it. So is there anything else there I've missed, Vinay? Hey, Adam. No. I think we have covered all the questions that we received so far. Okay. There's a new one. There's a new one from Kirti. I confused between WARP agent and Cloudflare agent. WARP for end user and Cloudflare for servers, I believe. Can what be used for servers too? I think that's the latest question. Okay. Gotcha. Yeah. So the warp agent so it is more around if you've got client initiate sorry. Yeah. Client initiated traffic is the best way to describe it. So think about like a server initiating traffic out. Very rarely do we have those use cases come up, but the the warp agent is very, like, similar to the tunnel agent, but it allows server initiated traffic to to to go through the connector. Okay? So the tunnel agent or the Cloudflare D is really just for getting access to applications that are that where we have sessions initiated from any of these types of personas. So whether it be a branch office headquarters, remote employee, you know, that's where Cloudflare d is used. Telephony platforms, maybe that's where I've I've seen a use case for the warp agents to handle those, you know, to to handle those server based sessions that are initiated. But but, yeah, overwhelming majority of deployments that whenever we talk to customers like Cloudflare d is is used. I hope that that makes sense. What else we've got? There's. one more, Adam. with due respect, I'd like to better understand how your proposed solution is a value guide against others, specifically what criteria benchmarks are used to determine that is the most effective option. Additionally, if there's any recognized organizational standards such as an ISO that certifies or validates this claim, I'm asking purely to gain clarity and not to question your expertise. Oh, that's very polite of you. Thank you very much for that. So I would say that whenever we don't have, like, a standard, like, a certification that goes around, you know, comparing, you know, platforms. Typically, when we do engage with customers, we'll ask, you know, what is what is the problem you're trying to solve? And if there's a particular area that they want to test out, we'll run what we call a proof of value. Because, again, there's some similarities between customers, but there's also different problems that they're trying to solve. So, for example, we've got some customers that have a global presence and are struggling with application delivery because the performance of the application think about interactive applications like RDP, you know, where you move a mouse and click here. If that's not processed by the server and then returned back within a timely manner, the RDP capability of it tends to be very difficult from a user perspective. So in that particular customer example, they're wanting to test out whether that use case can be fulfilled with Cloudflare. And we've been very successful with that because of our global network. So again, wherever RDP service sits internally, which is typically going to be in the same city of where that data center is or even in the same data center on a number of occasions, and where the remote employee is, they're not far away from Cloudflare data center. So, typically, if they're using VPNs today, when we do talk to them, you know, they've got a direct connection from one side of the the globe to the other, pretty much traversing the Wild West called the Internet. And it's wildly different depending on time of day, all sorts of sorts of Internet weather goes into this. So when we do stand up that use case, it it it comes out as part of their testing that, you know, it's going to be fixing their problems. So we do see a wild or a massive uplift in application performance when coming from a VPN. As with competitors, we have been in a number of deals where other competitors are in that space as well. And again, with this pop location across the globe, we do dwarf our competitors. So if it's an application delivery, we're very strong in that area. I hope that answers your question, but, yeah, but with regards to, like, ISO based certification and things like that, then around performance or how it operates, we don't really have anything in that space. We just tend to, you know, work with our customers and and and identify problems that they wanna solve. Okay. Yeah. I think, Adam, with that, we are at the end of the list of questions from the audience. This is just for everyone to know here. We still have a couple of minutes before we close this this session. If you have any more questions, please feel free to drop them in the q and a, and, Adam will be able to take them, right away. So we'll wait for a few more minutes. And if there are no more questions, then we'll proceed to close this. And while we wait, I have added a link on the chat. This link is to a page that has all our upcoming webinars. If anyone in the audience is interested to join or sign up for our upcoming sessions, please feel free to go through that and register for whichever topic that interests you the most. I see no more questions coming in. Okay. No one says thanks. So if there are no more questions, let me just thank you, Adam. Thank you, Adam, hosting this insightful session. I'm sure all of the attendees were as engaged as I was throughout the presentation. And on that note, I would also like to thank all the attendees for joining today's session and interacting with us live. Hope you found today's session relevant and valuable. We do look forward to seeing some of you at our upcoming webinars. I have already shared the link in the chat, so please feel free to sign up for whatever topic that interests you. And if you have any further questions, please drop them in the q and a. We will be taking them up right now. And if there is none, then we can actually close. So, Adam, do you have any closing thoughts? No. Actually, I got through that a little bit quicker than I anticipated. I I tend to talk for lengthy periods of time, so I tried to be very disciplined, but it seems like I'm a little bit too disciplined on this one. So, again, yeah, thanks for all the questions. Yeah. And and I hope to I hope to run into to to you guys at some stage at any type of event. There's lots of Cloudflare events that are happening, so by all means, come along and, yeah, learn more. Yeah, even if you're so inclined to, you know, to play around with the technology, as I mentioned before, fire up the free plan. If you've got a lab at home and all this stuff, you can experiment with and and have that connectivity. So, yeah, give it a shot. Get hands on with it. Yeah. Thank you so much. Thank you. Thank you, Adam. And I think this is, a repeated question that I'm getting in chat. Copy of the video recording, copy of this webinar. So this is just for everyone to know, all the attendees who registered for this session. In fact, all the registrants who did not show up for today's session will be receiving a recorded version of this webinar as an on demand video in their email inbox. You will be receiving it in the next forty eight hours, so please look forward to having it in your inbox. With that, thank you, everyone. Hope you have a good day, and see you next time. Thanks, everyone. Bye bye. Bye bye.