iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A VPN concentrator is a network gateway that centrally terminates and manages multiple encrypted VPN tunnels. It lets remote employees or branch offices connect to an organization’s private network, and in a hub-and-spoke design it can route traffic between connected sites. The function may run on a dedicated appliance or be built into a router or firewall.
What a VPN concentrator does
A VPN uses a public network, such as the internet, to link a remote user or site with a private network. The VPN endpoint negotiates tunnel settings, authenticates users or peer devices, manages encryption keys, and encrypts or decrypts and encapsulates or unencapsulates traffic. A concentrator performs these endpoint tasks centrally for multiple connections. Cisco’s overview of how VPNs work describes the role and possible forms of the endpoint.
“Concentrator” emphasizes the central handling of many tunnels. The term overlaps with “VPN gateway”: vendors may use either for a device or service that acts as a VPN endpoint. The exact capabilities depend on the product and design, so the label alone does not establish tunnel capacity, encrypted throughput, or supported VPN types.
How it is deployed
Dedicated appliance
A purpose-built VPN concentrator can be selected when a deployment needs a device dedicated to handling many tunnels. Cisco describes dedicated concentrators as one possible component, alongside VPN-enabled or VPN-optimized routers and VPN-capable firewalls. Cisco’s VPN overview identifies throughput and the number and type of tunnels as selection factors.
#1 Best Overall
Router or firewall with VPN capability
In other deployments, VPN termination is integrated into a router or firewall already serving the network. A VPN router with IPsec support may suit moderate encryption and tunneling needs, but it is not automatically equivalent to an enterprise concentrator designed for a large remote workforce. Check current protocol support, encrypted throughput, tunnel capacity, and management features for the specific device. Cisco’s guidance on VPN components distinguishes among these device types.
Common VPN designs
A concentrator can support different kinds of connectivity. The main distinction is what forms each end of the connection:
Rank #2
| Design | What connects | Typical use | Key distinction |
|---|---|---|---|
| Remote access | An individual user’s device and a private network | Remote or mobile workers | A VPN client is typically installed on each user device. |
| Site to site | One fixed network and another | Headquarters and branch offices | Network gateways connect the sites; users generally rely on their local network connection. |
| Hub and spoke | Multiple remote peers and a central hub | Central access and routing among sites | The hub terminates multiple tunnels and may carry traffic between spokes. |
Remote access and site-to-site describe who or what connects; hub and spoke describes how multiple peers are arranged around a central endpoint. A hub can route traffic from one tunnel to another, allowing spokes to communicate through it. Fortinet’s FortiOS 6.0.0 handbook explains the concentrator role in that topology. Cisco’s VPN overview and VPN basics also describe VPN endpoints and hub-and-spoke roles.
Benefits and operational trade-offs
Central termination gives network teams one place to manage many remote connections and can support access from different locations. VPNs can also provide an alternative to private leased lines, depending on the organization’s requirements. But concentrating tunnels also concentrates demand: capacity, resilience, security maintenance, and access policy all need attention.
- Capacity: Plan for expected concurrent tunnels and users, growth, and encrypted throughput under realistic traffic—not just a device’s headline interface speed.
- Availability: If the central endpoint is unavailable, many remote connections may be disrupted. Evaluate high availability, failover, and the effect of an appliance or service outage.
- Access control: A successful VPN connection should not automatically grant access to every internal resource. Set authorization around users’ actual needs.
- Endpoint and appliance security: Insecure user devices, unpatched vulnerabilities, and weak maintenance can create risk. Fortinet identifies these and excessive permissions among concerns to assess, while noting that risk depends on implementation. Fortinet’s remote-access VPN overview discusses these operational risks.
- Visibility and operations: Decide how teams will monitor tunnel status, review logs, maintain policies, and apply patches.
How to choose a VPN concentrator
- Define the connection types. Establish whether the system will serve remote users, fixed sites, or both.
- Estimate scale. Determine expected concurrent users and tunnels, then account for likely growth. Do not rely on old product capacity examples as current sizing guidance.
- Check performance under encryption. Compare encrypted throughput for the VPN types and traffic patterns you expect, not only unencrypted or interface-speed figures.
- Plan for failure. Decide what happens if the endpoint or its network connection fails, and evaluate redundancy and failover against the disruption your organization can tolerate.
- Review security controls. Assess authentication, authorization, endpoint posture, logging, patching, and least-privilege access policies.
- Fit it into operations. Determine whether a dedicated appliance or an existing VPN-capable router or firewall best fits the design, and confirm how staff will configure, monitor, and maintain it.
These criteria matter whether VPN capability is dedicated or integrated. The right choice depends on the tunnel workload and operating requirements—not simply whether a product is called a gateway or a concentrator.
Quick Recap
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
