Tunneling

Applies to. PCI DSS v4.0.1 does not name tunnelling in its requirements. It comes up under Requirement 4, which asks that PAN sent over open, public networks is protected with strong cryptography and security protocols that accept only trusted keys and certificates and do not fall back to insecure versions; an encrypted tunnel, such as a VPN or a TLS session, is one way to meet that. It also comes up under Requirement 1, because a tunnel that terminates inside the CDE is a network connection that must appear on the network diagram and pass through the NSCs at the CDE boundary.

Limits. An encapsulating tunnel counts only if it is encrypted with strong cryptography; the requirement is that the protocol supports only secure versions and does not fall back to insecure ones, so a plain unencrypted tunnel over a public network does not meet it.