--- title: "Zero trust based" slug: "zero-trust-based-v6-5" description: "Secure your networks with Appgate SDP's Zero Trust Network Access, ensuring real-time, context-aware control over user access and protecting sensitive data." updated: 2025-10-31T18:25:03Z published: 2025-10-31T18:25:03Z canonical: "support.appgate.com/zero-trust-based-v6-5" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.appgate.com/llms.txt > Use this file to discover all available pages before exploring further. # Zero trust based Appgate SDP uses a direct-routed Zero Trust Network Access (ZTNA) model. This model allows systems to be hidden from unauthorized users, and then requires detailed contextual information to establish trust before any access is authorized to the protected networks. The Software Defined Perimeter (SDP) is a concept that aims to deliver ZTNA with appliances that protect themselves using Single Packet Authorization (SPA). Connection attempts to port 443 are denied unless a pre-determined and mutually agreed, cryptographically signed SPA packet is received first. - Clients (and appliances) use SPA prior to establishing any TLS connection to an Appliance. - Controllers authenticate and authorize new user/device sessions and provide the required tokens that the Gateway will consume. - Gateways render the protected networks invisible and provide users/devices access via their own micro-firewall instances each started on a separate thread. The individualized firewall rules are defined by the payload within the tokens. ### Establishing trust using the 6 layer model Appgate SDP uses a multi-layer authorization model to provide real-time, context-aware control over all user access attempts. The numbers below correspond to the process layers in the diagram that follows. 1. [Single Packet Authorization](/v1/docs/spa) cloaks the Appgate SDP system, allowing only Clients with the pre-shared key to open a communications channel. The Appgate SDP system will accept one or more SPA keys that are included in the [Client profile](/v1/docs/client-profiles). 2. [MFA at sign-in](/v1/docs/multi-stage-authorization) registers a user's device, turning it into a second, trusted authentication factor, thus blocking authentication when stolen credentials are tried. Any configured [multi-factor authentication (MFA)](/v1/docs/multi-factor-authentication) can be used, and once a device or browser is registered this removes the need for users to perform MFA at every sign-in. 3. [Authentication](/v1/docs/authentication-services) validates the user's or device's credentials against defined trusted sources such as a local database or LDAP. 4. Authorization. [Policy assignment criteria](/v1/docs/using-policies) evaluate the user's or device's Claims data. Based on this, a specific set of is assigned to each user or device. 5. [Access controls](/v1/docs/applying-access-controls) monitor Entitlements to see if the risk model or Conditions require any additional access criteria be checked in real-time before granting access. The Gateway dynamically manages the access rights for each user or device based on any actions defined in Entitlements (such as , , etc). 6. [Alert actions](/v1/docs/configure-entitlements) trigger a system response as a result of bad behaviors, for example, such as performing unauthorized port scans. ![A diagram displaying the six layer trust model.](https://cdn.us.document360.io/e7482ce5-acfa-4c3b-b76c-b6c32472644a/Images/Documentation/hmfile_hash_37dbb28f.png?sv=2026-02-06&spr=https&st=2026-10-27T12%3A29%3A17Z&se=2026-10-27T13%3A29%3A17Z&sr=c&sp=r&sig=2JqthDcOVOAqnsZwdAR9Fv1Bu%2Bl8lDDQtCAyDHLntO4%3D) Once the Client has been seeded with the profile link and the device has been on-boarded, then the user can select "keep me signed-in". This makes the 6-layer mode transparent to the user who will now require fewer interactions than with a normal VPN. The only point at which the user may be required to interact with the system is if a Condition requires a user interaction. Appgate SDP (Software Defined Perimeter) is a security solution that provides secure access to resources based on user identity and context, leveraging a zero trust security model. The virtual or physical instance on which the system is running. Each appliance is a stateless, configurable machine that can operate as a single function or a combination of functions. An appliance that acts as an enforcement point, controlling user access to protected resources. A Policy is a set of rules that govern access control and permissions for users and devices within the Appgate ZTNA system. Policies determine what resources users can access based on their entitlements. Key-value pairs related to the identity and content of the user or device and are specific to each session.