Skip to main content

Choosing Anapaya PathGuard components

Each PathGuard deployment has a client side and a server side. The type of traffic decides which client and which gateway you need.

Which client, which server side
 Which client, which server side
Traffic
 Traffic
Client side
 Client side
Server side, in the hidden AS
 Server side, in the hidden AS
HTTP from a native app
mobile or desktop
 HTTP from a native app mobile or desktop
SCION SDK
 SCION SDK
PathGuard Web Gateway
 PathGuard Web Gateway
HTTP from a browser
web application
 HTTP from a browser web application
PathGuard Web SDK
 PathGuard Web SDK
PathGuard Web Gateway
 PathGuard Web Gateway
IP traffic
VPN, SSH, remote desktop
 IP traffic VPN, SSH, remote desktop
PathGuard VPN Client
 PathGuard VPN Client
PathGuard VPN Gateway
 PathGuard VPN Gateway
Other protocols
IoT, special applications
 Other protocols IoT, special applications
SCION SDK
 SCION SDK
Custom backend
with the SCION SDK
 Custom backend with the SCION SDK Text is not SVG - cannot display

The traffic type decides the client and the server side. Each server side is in the hidden AS.

Traffic types​

  • The users use a mobile or desktop app that talks HTTP: Use the SCION SDK in the app and the PathGuard Web Gateway. The web server does not change. A typical example is a mobile banking app that uses the standard web API of the bank.
  • The users use a browser: Use the PathGuard Web SDK and the PathGuard Web Gateway. The web server does not change, and the users install nothing. A typical example is an e-banking portal. The same Web Gateway can serve apps and browsers at the same time.
  • The users need access to a network, not to one application: Use the PathGuard VPN Client and the PathGuard VPN Gateway. Typical examples are the remote access of employees to internal networks, the access of field devices to their backend, SSH, remote desktop, and older applications that you cannot change.
  • The application uses its own protocol: Use the SCION SDK in the application and in the backend. No PathGuard gateway is necessary. Typical examples are IoT devices and special applications with their own protocols.

Components overview​

ComponentRuns onWhat you needLimitations
SCION SDKNative applications. HTTP/3 libraries for Android and iOS.The libraries in the application. They are open source. See the SCION SDK documentation.None.
PathGuard Web SDKWeb applications in common browsers. It works with fetch, Axios, the Angular HttpClient, and a service worker.The Web SDK in the web application. DNS names for the web access point (WAP), which the certificate of the web server must cover. See Browser access.The browser user cannot select the SCION path. User are authorized based on short-term IP leases.
PathGuard Web GatewayThe hidden AS.A web server that accepts TCP, for example HTTP/1.1 or HTTP/2.No support for QUIC.
PathGuard VPN ClientAndroid, iOS, Linux, macOS, and Windows. A headless client for devices and servers.Enrollment with the identity provider of the enterprise, for example Microsoft Entra ID, or with client credentials, for example an API key or a client certificate.On mobile devices, only a single VPN connection can be active at a time.
PathGuard VPN GatewayThe hidden AS.The internal networks that the clients reach. The VPN Gateway gives an address to each client and tells it the routes.None.