Migration

Switch without the big-bang cutover

Run OpenVLAN alongside whatever you have today, move team by team, then decommission on your schedule.

The phased playbook

Connect your identity provider, enable a pilot tailnet, and install clients for one friendly team. Nothing existing changes.

Deploy subnet routers in each VPC and office. Publish internal apps with MagicDNS names. Keep the old VPN running.

Move departments in waves. Each wave: enroll devices, verify access, update bookmarks to MagicDNS names, then disable their VPN group.

When VPN usage hits zero, switch off concentrators, reclaim IPs, delete the shared VPN accounts. Celebrate visibly.

Replaced by the mesh itself — clients connect from anywhere, no appliance to babysit.

Replaced by OpenVLAN SSH with SSO, recording, and ACLs per host. Delete the bastion.

Replaced by identity-based grants and session recording. Keep the vault for secrets if you like.

Replaced by subnet routers advertising each site into the tailnet.

Gone entirely — the mesh only carries tailnet traffic by default.

Close them. Clients need only outbound 443.

Can both systems run at once?

Yes — the standard approach. Users on either system reach the same resources while you migrate wave by wave.

What about our existing IP ranges?

Subnet routers advertise your real ranges into the tailnet; clients keep using existing addresses and hostnames.

How long does a typical mid-size company take?

Six weeks end-to-end is typical for a 200–1,000 person org, mostly waiting on human scheduling rather than technology.

Do we need professional services?

No — the playbook above is what our solutions engineers walk customers through on regular plans.

Create your tailnet, connect your IdP, enroll two devices. That's the whole kickoff.