Comment Comment by brandon Historically at Google the exceptions fell into one of a few buckets:* You used a modified client or client proxy (this was done for e.g. SSH)* You used a remote-desktop protocol to remote into a machine with direct network access to the service* The service got a wholesale exemption and was allowed through the firewall with ordinary IP ACLs(descending order of impressiveness wrt the BeyondCorp philosophy and whitepaper)Some of this is discussed in the "Non-HTTP Protocols" section of this paper: https://www.usenix.org/system/files/login/articles/login_win... parent brandon 6 years ago
* You used a modified client or client proxy (this was done for e.g. SSH)
* You used a remote-desktop protocol to remote into a machine with direct network access to the service
* The service got a wholesale exemption and was allowed through the firewall with ordinary IP ACLs
(descending order of impressiveness wrt the BeyondCorp philosophy and whitepaper)
Some of this is discussed in the "Non-HTTP Protocols" section of this paper: https://www.usenix.org/system/files/login/articles/login_win...