SASE and Zero Trust (ZTNA) consultant in the UAE: replace your VPN
I help companies in the UAE and the GCC replace remote-access VPN with Zero Trust Network Access (ZTNA) on a Security Service Edge (SSE) platform. I have deployed HPE Aruba SSE (formerly Axis Security) connectors and role-based access policies for hybrid workforces, and I hold the HPE Aruba APS-ASSE and Cato SASE certifications.
Who this is for
- Companies of 50 to 500 people with remote staff on a traditional VPN
- Businesses that give contractors or vendors access to one or two internal apps
- Teams fixing an audit finding about broad VPN access
- Organisations already licensed for HPE Aruba SSE that need it deployed
Problems it solves
- A VPN puts remote users on the whole network when they need a single app
- Onboarding and offboarding contractors takes too long and leaves access behind
- VPN concentrators become a bottleneck at busy times
- Nobody can say quickly who accessed which application
What you get
- An access inventory: applications, user groups and who needs what
- Role-based access policies mapped to your user groups
- SSE connector deployment next to your applications
- A pilot group first, then a phased migration off VPN
- A VPN decommissioning plan once every app is covered
- Documentation of every policy and connector
How an engagement runs
- 1
Assess
Review what is running today: configs, links, sites and the problems you see.
- 2
Design
An HLD and LLD you sign off before anything changes.
- 3
Implement
Changes in planned windows, each with a rollback plan.
- 4
Hand over
Documentation, diagrams and a walkthrough for your team.
Relevant experience
- Configured HPE Aruba SSE (formerly Axis Security) connectors for secure user and application access
- Built role-based Zero Trust access policies for a hybrid workforce, replacing legacy VPN
- Managed user-specific access policies day to day in Aruba SSE
Frequently asked questions
What is the difference between ZTNA and a VPN?
A VPN connects a user to the network, after which they can usually reach far more than they need. Zero Trust Network Access connects a user to specific applications only, after checking who they are, and every other system stays invisible to them.
Are SASE and SSE the same thing?
SSE (Security Service Edge) is the security half of SASE: secure web access, cloud app security and Zero Trust access to private apps. SASE adds the networking half, usually SD-WAN. Many companies start with SSE to replace VPN and add SD-WAN later.
Do we have to switch off our VPN on day one?
No. A pilot group moves to Zero Trust access first while everyone else stays on the VPN. Applications move over in phases, and the VPN is retired once every app and user group is covered.
Which SSE platforms do you work with?
My hands-on deployments are on HPE Aruba SSE (formerly Axis Security), and I hold the HPE Aruba APS-ASSE certification. I also hold the Cato Certified Associate (SASE) certification.
Do you work outside Dubai?
Yes. I work on-site anywhere in the UAE and remotely across the GCC, including Saudi Arabia, Qatar, Kuwait, Bahrain and Oman. My largest SD-WAN rollouts spanned all of those countries plus Jordan.
Ways to work together
- One-off assessment. An audit, survey or review with a written report and a prioritised plan.
- Project. Design and implementation with a fixed scope, dates and handover.
- Remote support retainer. Ongoing help for changes, troubleshooting and questions.
- On-site in the UAE. Surveys, cutovers and installs at your sites across the Emirates.
- Remote across the GCC. Design, configuration and support for sites in KSA, Qatar, Kuwait, Bahrain and Oman.
Page updated November 2026.
Tell me about your project
Book a free 30-minute call on WhatsApp, or send the details and I will reply with next steps.
WhatsApp +971 54 782 9816 · Based in Dubai, working across the UAE and GCC