Tailscale - all in
Sharing my experience -
Just wrapped up a full migration away from Cisco ASA SSL VPN over to Tailscale.
Quick rundown:
200 remote users, all on Tailscale
Two offices running as subnet routers
All office staff have laptops with Tailscale installed, so I’ve redesigned the office network to basically just provide internet access — no more relying on the LAN for resource access
Per-user ACLs give me much finer-grained control over who can reach what compared to the old VPN setup.
I use the SSH feature on a few AWS EC2 instances which I love.
Overall it’s worked out great — simpler architecture, better visibility, and way less overhead than managing ASA VPN profiles.
I do worry about the subnet routers and lack of decent HA. I have some static routes heading to these boxes and need to think about that some more. Our tolerance for network interruption is pretty good so a manual failover is ok unless I’m on vacation.
I wrote an internal tool to manage the ACL’s and add new users to Entra etc. Quite happy with it.
This is all great until it’s not. I’ve not experienced an outage yet but I think wire guard should tick along for some time if proper point to point connections are established. Our Manila site was relaying through HK but fixed that with a firewall tweak.
Anyway. Anything I’ve not thought about ? Anything gonna bite me ? I am fully trusting wireguard and tailscale here.
Thanks for listening