A VPN concentrator is a device or service that terminates many VPN tunnels in one place, handling encryption, authentication and address assignment for remote users or sites. Today the function usually lives inside a firewall, router or cloud service, but the design question is the same: one gateway is a single choke point.
What does it actually do?
The IPsec architecture in RFC 4301 describes security gateways, systems that implement IPsec protocols on behalf of other hosts. A concentrator is a security gateway built to hold a large number of tunnels. Its jobs are:
- Negotiating keys and authenticating each peer, usually with IKE as covered in NIST SP 800-77 Revision 1.
- Encrypting and decrypting the traffic.
- Assigning internal addresses to remote clients.
- Applying policy about which networks each user may reach.
- Logging connections.
Dedicated hardware concentrators were once common because encryption was expensive on general purpose processors. Cryptography is cheap now, so the role is mostly software on a firewall or a managed cloud gateway.
How is it different from a site to site tunnel?
A site to site tunnel joins two fixed networks and usually needs only a pair of gateways. A concentrator handles the many to one pattern: hundreds of laptops, each its own small tunnel, ending on one gateway. The scaling problems differ. Many users means more sessions, more authentication traffic and more policy groups.
What are the risks of a single gateway?
Attack surface. It faces the internet and accepts connections from strangers by design. A flaw in its software can expose the whole internal network, so patching speed matters.
Availability. If it fails, every remote user loses access. Plan for a pair of gateways or a managed service with redundancy.
Flat access. If every authenticated user lands in the same address pool with broad rights, the concentrator makes lateral movement easy.
Capacity. Peak loads, such as everyone connecting at the start of the workday, can overwhelm it.
Visibility. Traffic inside the tunnel is invisible to inspection tools on the path, so inspection has to happen at or behind the gateway.
Constructed example: Monday at nine
A company of 800 staff moves from mostly office work to mostly remote. The old concentrator was sized for 100 simultaneous users. On the first Monday, sessions drop and staff retry, which adds more load. Support tickets pile up. The fix was a second gateway, split tunneling for traffic that does not need to cross the company network, and per group address pools with narrower rules. Capacity planning would have caught the first problem. Reviewing group rights caught the second.
Do you still need one?
It depends on your design. If staff mostly use cloud applications, per application access may serve them better than a full network connection. If you have legacy systems that only live on an internal network, a gateway will remain. Many companies run both.
How to check or apply this
- Find every VPN termination point, including forgotten ones on old firewalls, and record software versions.
- Confirm multi factor authentication is enforced at the gateway.
- Review address pools and rules per group, and remove broad any to any access.
- Test failover and measure peak sessions against capacity.
- Forward gateway logs to a central place and alert on odd logins.
- Decide which applications could move to per application access and reduce what the VPN must expose.
Quick check
Is a VPN concentrator the same as a firewall?
No, although many firewalls include the function. The concentrator terminates tunnels. The firewall filters traffic by policy.
What is the biggest risk with one?
It is a high value internet facing target. Unpatched software or broad access after login can expose the whole internal network.
Sources
- RFC 4301, Security Architecture for the Internet Protocol
- NIST SP 800-77 Rev. 1, Guide to IPsec VPNs
Last reviewed: 18 October 2026.
