Skip to main content

LANCOM ZTNA

NAC/ZTNA ZTNA

Overview​

LANCOM Trusted Access (LTA) is LANCOM's cloud-managed remote access and Zero Trust Network Access (ZTNA) platform, combining a classic VPN client mode with per-application "software-defined perimeter" access controlled from the LANCOM Management Cloud (LMC)

LTA consists of three main components: the LTA Client on endpoints, the LTA Controller (implemented in the LANCOM Management Cloud), and one more LTA Gateways, which are LANCOM VPN-capable routers or unified firewalls that terminate the tunnels. The LMC acts as the control plane for identity, policy, and configuration, while user data flows directly between client and gateway as the data plane, without hair-pinning via a third-party cloud service.

From a ZTNA perspective, LTA lets you choose between two operating models on the same platform: a cloud-managed VPN client giving broad network access, or true Zero Trust mode where users only see and reach explicitly assigned applications and services. Access is driven by central identity (e.g. Microsoft Entra ID / AD) and granular policies; coupled with micro-segmentation and per-session verification, this reduces lateral movement and limits the blast radius of a compromise.

LTA is designed for European "digital soverignty" requirements: client and LMC are developed in Germany, cloud data is hosted in German data centres, and only authentication metadata passes through the cloud; application traffic remains under the customer's control. It scales from small businesses with an internal user directory to large enterprises with several thousand users integrated via existing identity providers.

How to position​

Target Customers​

  • Organisations with distributed/hybrid workforces that currently rely on legacy IPsec VPN clients and broad "flat" network access, and want to move incrementally toward Zero Trust without a forklift redesign.
  • Existing LANCOM customers already running LANCOM gateways, SD-WAN, firewalls, switches, or access points under LMC management; for them, LTA is a natural extension of their existing management and security stack
  • Mid-market and public-sector customers in DACH/Benelux/EU that care about GDPR compliance, data residency in Germany, and low dependence on non-EU cloud security brokers
tip

Lancom LTA is one of the few completely EU-sovereign ZTNA solutions on the market

Easy entry-points​

  • "VPN pain" scenarios: companies complaining about complex client rollouts, static profiles, and poor visibility into who is connected from where; LTA offers zero-touch client deployment, central policy, and dashboards in LMC
  • First ZTNA step: start by publishing a few critical internal apps via per-app policies instead of full network access, leveraging their existing LANCOM gateway as LTA Gateway
  • Hardening high-risk user groups: contractors, external partners, or admins can be forced through LTA with device posture checks and MFA before accessing specific management interfaces or OT segments

Cross-sell opportunities​

  • Land with LTA Client plus LMC in front of the customer's existing LANCOM gateway or firewall; once LMC is in place, you can expand into SD-WAN, WiFi and switching because LMC centrally manages all LANCOM network components and security policies
  • Attach LANCOM unified firewalls or SD-WAN gateways as dedicated LTA Gateways for "Trusted Internet Access" (full-tunnel mode), then upsell advanced gateway security functions like AV, content filtering, and web control for all outbound SaaS traffic
  • Over time, introduce micro-segmentation on the LAN side using LANCOM switches managed through LMC to extend Zero Trust from remote access into the internal network

Core Features​

Feature Overview​

  • Zero Trust / software-defined perimeter: Rather than exposing networks, LTA enforces application- or service-level access based on URLs, IPs, ports, and protocols, implementing a software-defined perimeter enforced at the LTA Gateway. Users only see and connect to resources explicitly assigned to them, which greatly reduces attack surface and lateral movement
  • Dual mode: ZTNA and cloud-managed VPN: The same client can work either as a per-app ZTNA client or a classic cloud-managed VPN client with full network access, allowing stepwise migration from legacy VPN to Zero Trust. This duality is a strong sales story for risk-averse customers who want to start with "VPN-but-managed-better" and gradually tighten policies
  • Identity, SSO, and MFA integration: LTA authenticates users via a central identity provider such as Active Directory or Microsoft Entra ID, consuming existing groups for policy decisions. It supports multi-factor authentication (e.g. biometrics or app-based MFA) and an SSO agent for Entra ID, so users get smoother access to cloud and internal apps
  • Endpoint posture checks: Before the tunnel is fully established, the LTA controller can verify device posture (OS version, antivirus status, and locla firewall) which becomes an additional condition for access. This turns each connection attempt into a security evaluation rather than a one-time trust decision
  • Split-tunnel, full-tunnel, and "Trusted Internet Access": LTA supports split tunneling (only corporate traffic via tunnel) and full tunneling (all traffic via gateway). In full-tunnel "Trusted Internet Access" mode, all internet and SaaS traffic is forced through the LTA Gateway where AV, content filtering, and other security services can be applied centrally
  • Central cloud management and monitoring: LMC provides zero-touch deployment and configuration of LTA clients, central management of profiles, and a dedicated dashboard showing connected endpoints and their status. This significantly reduces operational overhead compared to manually managed VPN clients
  • Micro-segmentation and lateral movement protection: With policy enforced at the gateway and optional micro-segmentation (e.g. private VLAN and port isolation on switches), enterprise servers no longer need to form a flat intranet reachable by any authenticated VPN user. This architecture contains ransomware and insider threats by design, because compromising one resource does not automatically open paths to others
  • Data-sovereign architecture: Control and data planes are strictly separated: the LMC only handles control and authentication, while data flows directly between LTA Client and LTA Gateway. Combined with German development and hosting, this is a strong differentiator versus many cloud ZTNA brokers that terminate all traffic in their own PoPs