In short
NordLayer ZTNA is Nord Security's zero trust access model for business: users sign in with SSO and MFA, connect through a Virtual Private Gateway on a dedicated server with your own IP, and are limited by device posture and Cloud Firewall rules. The ZTNA tools start on the Core plan; posture enforcement and the cloud firewall come with Premium.
Get a quote for NordLayer ZTNA
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What NordLayer ZTNA is
NordLayer is the business product from Nord Security, the company behind the consumer NordVPN. There is no appliance to buy: staff install the NordLayer app on their computers and phones (Windows, macOS, Linux and iOS among them), sign in, and their traffic passes through Nord Security's cloud gateways, where your policies apply.
NordLayer describes its zero trust network access as a set of tools layered onto that connection rather than a separate product:
- Identity first: users authenticate through your identity provider with single sign-on and multi-factor authentication before they connect
- Private gateways: a Virtual Private Gateway runs on a dedicated server with an IP address used only by your organisation
- IP allowlisting: you allowlist that dedicated IP on SaaS admin consoles, cloud networks and firewalls, so only connected staff can reach them
- Device checks: device posture monitoring, and on Premium Device Posture Security, which can stop non-compliant devices from connecting
- Segmentation: the Cloud Firewall (firewall as a service) restricts which users and teams can reach which private resources behind the gateway
That makes NordLayer a practical first step from an office-firewall VPN towards zero trust, particularly for organisations that do not have the time or budget for a full SSE platform. For the vendor overview, plans and NordPass and NordLayer Intelligence, see NordLayer on our cloud security site.
How a NordLayer connection works
In the terms used by the NCSC's ZTNA guidance, NordLayer works as a network-level policy engine: access decisions are made at the gateway and the cloud firewall, rather than per application by a broker sitting in front of each app. A typical connection looks like this:
- The user opens the NordLayer app and signs in through your identity provider, completing MFA.
- NordLayer checks the device against your posture rules, such as whether it has been jailbroken, and with Device Posture Security (included on Premium, an add-on on Core) can stop a non-compliant device connecting.
- The app connects to your Virtual Private Gateway using NordLynx, Nord Security's protocol built around WireGuard, or to a Shared Gateway for protected browsing.
- Cloud Firewall rules decide which private networks, hosts and ports that user or team can reach through the gateway.
- If the resource is in an office or cloud network, the gateway reaches it through a Site-to-Site connector (Premium); SaaS apps see the dedicated IP you have allowlisted.
- Administrators see connections and activity in the NordLayer Control Panel.
Two gateway types are worth understanding, because "NordLayer gateway" means different things in different conversations:
| Gateway | What it is | What it is for |
|---|---|---|
| Shared Gateway | Nord Security servers shared by many customers | Encrypted browsing on public Wi-Fi and web protection |
| Virtual Private Gateway | A dedicated server used only by your organisation, with a dedicated IP | Private access, IP allowlisting and segmentation with the Cloud Firewall |
For the wider explanation of brokers, connectors and policy engines, read how ZTNA works.
Not sure which level fits? Ask us
Tell us what you need and we will recommend the right level for your organisation, with a quote.
ZTNA capabilities by NordLayer plan
| ZTNA capability | Lite | Core | Premium |
|---|---|---|---|
| SSO and MFA through your identity provider | Yes | Yes | Yes |
| Shared Gateways, Web Protection and Download Protection | Yes | Yes | Yes |
| Virtual Private Gateway with dedicated IP and IP allowlisting | No | Yes, with a dedicated server | Yes, with a dedicated server |
| DNS filtering by category and Application Blocker | No | Yes | Yes |
| Device posture monitoring | Add-on | Yes | Yes |
| Device Posture Security (restrict non-compliant devices) | No | Add-on | Yes |
| Cloud Firewall (FWaaS) for segmentation | No | On request | Yes |
| User provisioning from your identity provider | Add-on | Add-on | Yes |
| Site-to-Site connector | No | No | Yes |
NordLayer itself says its ZTNA tools start on Core, because that is where the Virtual Private Gateway, fixed IP and allowlisting arrive. Premium is the plan to look at if you want zero trust in the stricter sense: enforced device posture, segmentation with the Cloud Firewall and automatic user provisioning so leavers lose access when they leave your directory. Organisations with 200 or more seats can ask about NordLayer's Enterprise offer, which is scoped individually. Feature placement changes from time to time, so we confirm the current plan contents when we quote.
Where NordLayer fits, and where it does not
NordLayer is good at moving a small or mid-sized team off an ageing VPN without new hardware, with an identity-based sign-in and a fixed IP to lock down cloud services. It is honest to say what it is not:
- It is closer to a zero trust business VPN than to an application broker. Users connect to a gateway and the Cloud Firewall limits what they reach. Products that broker one application at a time, such as Check Point SASE Private Access or Cisco Secure Access, give finer per-app control. The NCSC's ZTNA guidance warns against recreating the old "walled garden" when you swap a VPN for a cloud service, so plan your firewall rules per team and per resource, not one rule for everyone.
- A dedicated IP is a network-location signal. Allowlisting it is useful, but the NCSC also lists trusting network location as an anti-pattern when it is the only control. Keep MFA and conditional access on the SaaS apps as well, rather than relying on the IP alone.
- It is not a full secure web gateway with TLS inspection and inline data loss prevention. If that matters, compare Todyl SASE, Exium SASE or the wider SASE providers.
For many small and mid-sized organisations those trade-offs are acceptable, which is why NordLayer features in our guide to ZTNA for small business.
Is NordLayer ZTNA the right fit for you?
We will check it against your systems and requirements and recommend the right option.
NordLayer and other ZTNA options we supply
| If you are weighing up | Consider |
|---|---|
| NordLayer vs a fuller SASE platform | Todyl SASE adds a cloud NGFW with SSL inspection and LAN segmentation; Exium SASE adds SaaS controls and agentless access on Pro |
| NordLayer vs remote desktop only | If people only need their office PC or an RDS server, TruGrid SecureRDP may be simpler |
| NordLayer vs keeping the network flat | Zero Networks Connect puts remote users under the same segmentation as everyone inside the network |
| NordLayer vs enterprise SSE | See ZTNA providers for Check Point, Cisco, Trend Micro and Island |
There is no single right answer, and no ranking here: the right choice depends on what people connect to, how many devices are managed and what else you want the platform to do. ZTNA vs VPN explains the underlying difference.
Licensing and how we help
NordLayer is licensed per user, from five users on Lite, Core and Premium, with each user licence covering up to six devices. Dedicated servers for Virtual Private Gateways are licensed on top of user seats, and add-ons such as Device Posture Security on Core are extra lines. Prices depend on plan, seats, servers and term, so ask us for a quote; the detail is on NordLayer licensing.
Forever Systems can help you:
- Scope: list who needs remote access, which resources they reach and which systems are allowlisted by IP today.
- Choose the plan: decide between Core and Premium, and how many dedicated servers and regions you need.
- Set up identity: connect Microsoft Entra ID, Okta, OneLogin or JumpCloud for single sign-on and MFA, and on Premium (or as an add-on) automatic user provisioning from Entra ID or Okta.
- Build policy: create gateways, Cloud Firewall rules per team and device posture rules, then pilot with a small group.
- Retire the old route: once users have moved, help you close the old VPN so it cannot be used to bypass the new rules, a legacy route the NCSC lists among its ZTNA anti-patterns.
Timescales depend on how many resources and sites are involved and are confirmed at quote. Contact us to talk it through.
How Forever Systems helps with ZTNA and SASE
We are an independent IT and cyber security provider. We supply and support several zero trust access and SASE platforms, so we can recommend what fits how your people work rather than one vendor's answer to everything.
- Assess first: we look at your current VPN, firewall, identity set-up and the applications people need to reach before suggesting anything new
- Vendor-aware advice across ZTNA, SSE and SASE options, including Cisco Secure Access and Check Point Harmony SASE
- Pilots and phased roll-out: we can help you start with one group of users or one application, then extend access policy by policy
- VPN replacement: planning the move away from remote access VPNs, including identity provider integration and device posture checks
- Ongoing support: policy changes, licence reviews and renewals, with the details confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, features and term, so ask us for a quote.
Frequently asked questions
Does NordLayer offer ZTNA?
Yes. NordLayer provides zero trust network access tools on top of its business VPN: identity-based sign-in with SSO and MFA, Virtual Private Gateways with dedicated IPs and allowlisting, device posture checks and, on Premium, Cloud Firewall segmentation and Device Posture Security. NordLayer says its ZTNA tools start on the Core plan.
What is the difference between NordLayer and NordVPN?
NordVPN is Nord Security's consumer VPN. NordLayer is its business product, with an admin Control Panel, identity provider sign-in, private gateways with dedicated IPs, device posture checks, a cloud firewall and per-user licensing managed by IT.
What is a NordLayer gateway?
A gateway is the server your users connect through. Shared Gateways are used by many NordLayer customers and suit protected browsing. A Virtual Private Gateway runs on a dedicated server with an IP address only your organisation uses, which you can allowlist on cloud apps and firewalls.
Which NordLayer plan do we need for zero trust access?
Core is the minimum for private gateways, a fixed IP and allowlisting. Premium adds enforced Device Posture Security, the Cloud Firewall for segmentation, user provisioning from Entra ID or Okta and the Site-to-Site connector, which is usually what a zero trust design needs.
Does NordLayer replace our office VPN?
For many small and mid-sized organisations it can, because users connect through NordLayer's gateways instead of a VPN on the office firewall. We check what people connect to first, including any legacy systems, and plan the switch-off of the old VPN once everyone has moved.
How many devices does a NordLayer licence cover?
Each NordLayer user licence covers up to six devices, and the Lite, Core and Premium plans start at five users. Dedicated servers for private gateways are licensed separately.
Still have a question about NordLayer ZTNA?
Ask us and a member of our team will reply by email.
More zero trust access guides
Todyl SASETodyl's SASE module: ZTNA, secure web gateway, secure DNS and cloud NGFW through one agent and the Todyl SGN.
Exium (NETGEAR)Exium is now part of NETGEAR: what that means, and what Exium SASE Essentials, SASE Pro and Cyber Gateway do.ZTNA for small businessZero trust access for small and medium-sized firms, with no hardware and per-user or per-device licensing.ZTNA vs VPNPer-app zero trust access compared with network-level VPN access, and when a VPN still makes sense.ZTNA costWhat drives zero trust network access cost: licensing units, tiers, add-ons, deployment and what you retire.