Secure Remote Access for UAE Teams: What to Buy and What to Configure

For a UAE business in 2026, secure remote access means a supported firewall at the office edge running IPsec IKEv2 with a managed client such as Cisco Secure Client, FortiClient or SonicWall NetExtender, multi-factor authentication on every login, management interfaces closed to the internet, and a patch routine that one named person owns. A business VPN is legal here. The TDRA stated on 31 July 2016 that no regulations prevent companies, institutions and banks from using VPN technology to reach their internal networks. What gets UAE firms breached is an old SSL VPN portal left on the internet unpatched, and in 2025 Fortinet and SonicWall both moved to retire that kind of portal.

Is a VPN legal for a UAE business?

Yes, for its intended purpose. The TDRA press release of 31 July 2016 says "there are no regulations which prevent the use of VPN technology by companies, institutions and banks", adds that "business users can be held accountable, like the use of any other technology, if it has been misused", and describes the offence as using a false IP address or a third-party address for the purpose of committing a crime or preventing its discovery. The UAE government portal lists Federal Decree-Law 34 of 2021 on Combatting Rumours and Cybercrimes as the law now in force. A company in Business Bay tunnelling staff laptops into its own ERP is the permitted case. Routing office traffic through a consumer VPN to reach blocked calling apps is the case the law targets.

The four ways in, and which one to buy

NIST Special Publication 800-46 Revision 2, published July 2016, divides remote access into four architectures: tunneling, portals, remote desktop access and direct application access. For a Dubai company of 20 to 200 staff, tunneling, meaning a VPN client on a managed laptop, is still the default because every internal application works through it unchanged. Portals and direct application access, today usually a browser-based zero trust product, suit contractors and personal devices because they expose one app rather than the whole LAN. Remote desktop access, meaning RDP to a PC left on in the office, must never face the internet directly.

The same NIST guide opens with the instruction to assume "that external facilities, networks, and devices contain hostile threats" and recommends tiered access: organisation-owned PCs get broad access, personally owned PCs a limited set, and personal phones "only one or two lower-risk resources, such as webmail". In practice a sales team on personal phones around JLT gets email and the CRM through a browser, while the accounts team on company laptops gets the IPsec tunnel to the ERP and nothing else.

What to buy: the headend and its licences

The headend is your edge firewall, so the remote access decision is really the firewall decision. Sizing is about concurrent tunnels, not headcount. Cisco's Firewall Device Manager configuration guide for version 7.6 states that each model has a maximum number of concurrent VPN sessions and that "the limit is a combination of remote access VPN users plus site-to-site VPN peers". A 60-person office with three branch tunnels and a cloud tunnel needs a model rated comfortably above 64 sessions. Throughput falls further once inspection runs on tunnel traffic, which our post on sizing a firewall for a UAE SME covers.

Licensing is where quotations go wrong. On Cisco Secure Firewall Threat Defense, the 7.6 guide requires a Smart Software Manager account "enabled for export-controlled features" before remote access VPN can be configured, plus one of Secure Client Advantage, Premier or VPN Only, which it says "are treated the same for Firewall Threat Defense devices". Fortinet and SonicWall bundle a client entitlement with the appliance, and the count and basis differ by model. Ask three questions in writing with every quote: how many remote users the licence covers, whether that is per named user or per concurrent session, and what the renewal term is. Our comparison of Fortinet, SonicWall and Cisco at the UAE office edge walks through the platforms.

SSL VPN is being retired. Plan around it, not after it.

Fortinet's release notes for FortiOS 7.6.3 carry a special notice titled "SSL VPN tunnel mode replaced with IPsec VPN". Starting in 7.6.3, SSL VPN tunnel mode "is no longer available in the GUI and CLI", "this applies to all FortiGate models", and "settings will not be upgraded from previous versions". Fortinet notes that IPsec "can be configured to use TCP port 443", which matters in practice: hotel and coworking Wi-Fi in Jebel Ali or Dubai Marina often blocks UDP 500 and 4500, and TCP 443 gets through. A separate notice in the same release states that agentless VPN, the former SSL VPN web mode, is not supported on the FortiGate 40F, 60F and 90G series.

The reason is on the public record. FortiGuard advisory FG-IR-24-015, published 8 February 2024, describes CVE-2024-21762, an out-of-bound write in sslvpnd scored CVSSv3 9.6 that lets a remote unauthenticated attacker execute code on FortiOS 6.0.0 through 7.4.2. Fortinet's own workaround reads "disable SSL VPN (disable webmode is NOT a valid workaround)". A FortiGate 60F in a Business Bay comms room still on FortiOS 7.0 with the SSL portal enabled has been exposed to that advisory for over two and a half years.

SonicWall has gone further with its dedicated remote access appliances. The SMA 100 series product page now carries the notice "SMA100 is now End of Sale and End of Support" and directs customers to Cloud Secure Edge. A SonicWall blog post dated 1 August 2025 announced a trade-in promotion toward that product. For a DIFC office with an SMA 210 or 410 on the shelf, that is unsupported hardware on the internet edge, and the firewall's own VPN has to take its job.

The NSA and CISA information sheet of 28 September 2021, "Selecting and Hardening Standards-based Remote Access VPN Solutions", warns that nation-state actors "have weaponized common vulnerabilities and exposures (CVEs) to gain access to vulnerable VPN devices". Its top recommendations are NIAP-listed products, multi-factor authentication, prompt patching, and "reducing the VPN's attack surface by disabling non-VPN-related features".

What to configure on day one

1. IKEv2 IPsec as the primary tunnel. Keep an SSL mode only where a client platform cannot do IPsec, and on FortiGate finish the IPsec migration before the 7.6.3 upgrade.
2. Multi-factor authentication on every remote login. NIST, NSA and CISA all put it first. Tie the VPN to your identity provider or a RADIUS server so a leaver's account closes in one place.
3. No management from the WAN. NIST 800-46 says remote access servers must be "managed from trusted hosts by authorized administrators". Bind the admin interface to a management VLAN reached through the tunnel. Our guide to segmenting a small office with VLANs shows where that VLAN sits.
4. Decide split tunnelling deliberately. A full tunnel sends every remote user's internet traffic into the office line and back out, so a Microsoft 365 download crosses your Dubai fibre twice. Split tunnelling keeps Microsoft 365 direct and tunnels only private address ranges.
5. Land remote users in their own zone. NIST recommends that "a server should be placed at an organization's network perimeter". Give the VPN pool its own interface and write rules from that zone to the server VLAN only.
6. A separate network for personal devices on site. NIST's final recommendation is to "strongly consider establishing a separate, external, dedicated network" for BYOD and third-party devices inside the building. That is the guest SSID with internet only, which also fits the rules in our TDRA wireless rules post.
7. A fixed public address and a second line. Point tunnels and client profiles at a static public IP or a DNS hostname, never at an address copied from the router status page, because business circuits get renumbered. Where the office has two ISPs the VPN must fail over with them, the subject of our post on dual ISP failover in Dubai.
8. Patching with an owner and a calendar. Subscribe to the vendor's PSIRT feed the day the device goes live, fix a monthly window, and record the firmware version after each cycle.

What goes wrong in practice

The same failures repeat across sites of every size. The migration that never finishes: a company moves to IPsec, leaves the old SSL portal enabled for two users on Macs, and that portal is the one that gets exploited. The admin account exempted from MFA during a 2023 fit-out that nobody revisited. The 2020 shortcut, where port 3389 was forwarded to a desktop so one manager could work from Sharjah during the lockdown, and the rule is still in the firewall six years later. These are configuration and ownership faults, not hardware faults, which is why the checklist above is longer than the shopping list.

Where Codeeo Tech fits

Codeeo Tech is a hardware supplier at IFZA Business Park in Dubai Silicon Oasis. We stock the Cisco Secure Firewall range, FortiGate appliances, SonicWall TZ and NSa models and Juniper SRX, all quoted rather than list-priced. The quote is more accurate when the request includes four numbers: total staff, the peak of concurrent remote users, the number of sites and cloud tunnels, and the speed of each ISP circuit. Browse the Fortinet range or contact us with those figures. Configuration is the job of your IT team or a licensed integrator, and we can supply the equipment list and licence SKUs they will ask for.

Cover photo: Typing on a mac (Unsplash), via Wikimedia Commons (CC0).