What Is a VPN Concentrator? How It Works, Who Needs One, and the Risks
Key points
- A VPN concentrator manages many encrypted VPN connections in one central place.
- It authenticates users, builds encrypted tunnels, assigns addresses, and enforces access rules.
- It's built for large organizations with many remote workers. Home users don't need one. It's built for large organizations with many remote workers. Home users don't need one.
- Today, it's usually a feature of a firewall or a cloud service rather than a separate box.
- VPN gateways have become a top target for hackers, so patching and multi-factor authentication are essential.
Think of it as the security check-in desk at a company's headquarters. Every remote employee arrives through their own private, armored tunnel. The check-in desk confirms who they are, gives them a visitor badge, and decides which rooms they're allowed to enter, all while handling thousands of arrivals at once.
VPN Concentrator vs. the VPN App on Your Phone
The word "VPN" means two quite different things:
A personal VPN (like the apps in our best VPNs guide) sends your internet traffic through a provider's servers to protect your privacy online.
A corporate VPN connects employees to their company's private network, so they can reach internal files, apps and systems from home or on the road.
A VPN concentrator belongs to the second group. It's the device on the company's side that receives all those employee connections.
How a VPN Concentrator Works
When an employee opens their work VPN app, here's what happens behind the scenes:
Connect: The VPN client on the employee's laptop or phone reaches out to the concentrator over the internet.
Authenticate: The concentrator checks who the user is, usually with a password plus multi-factor authentication (MFA) or a digital certificate.
Build a tunnel: It agrees on encryption keys with the device and creates a private, encrypted tunnel.
Assign an address: It gives the device an internal IP address, so it can work like a computer in the office.
Encrypt and decrypt: All traffic in the tunnel is scrambled on the way in and out, so anyone intercepting it sees only gibberish.
Enforce rules: It decides what each user can reach. For example, the finance team can access accounting systems, but contractors can't.
Log and monitor: It records connections so IT and security teams can spot problems.
Where does it sit? At the edge of the company network, usually behind the firewall or in a protected zone called a DMZ, where it can meet traffic from the internet before it reaches internal systems.
Which Protocols Does a VPN Concentrator Use?
A protocol is the set of rules for building and protecting the tunnel. Not all are equally safe:
Protocol | What it is | Status in 2026 |
|---|---|---|
IPsec (with IKEv2) | A widely used suite that encrypts and authenticates data at the network level | ✅ Recommended |
SSL/TLS VPN | Uses the same encryption that protects websites; often works through a browser or light app | ✅ Recommended (use modern TLS versions) |
L2TP/IPsec | An older combination where IPsec does the encryption | ⚠️ Legacy; Microsoft has deprecated it for incoming connections on Windows Server |
PPTP | One of the oldest VPN protocols | ❌ Insecure. Avoid it |
In October 2024, Microsoft announced that future Windows Server versions will no longer accept incoming PPTP or L2TP VPN connections, and it recommended IKEv2 and SSTP instead.
Tunnel mode vs transport mode
IPsec can work in two modes, and this is often explained incorrectly:
Tunnel mode encrypts the entire original data packet and wraps it inside a new one. This is the standard for remote-access and site-to-site VPN gateways, including concentrators.
Transport mode encrypts only the contents of each packet and is mainly used for direct device-to-device connections.
Who Needs a VPN Concentrator?
VPN concentrators are built for organizations where many people connect remotely at the same time, such as:
Large companies with remote or hybrid workforces
Government agencies
Hospitals and healthcare systems
Universities
Businesses with many branch offices, contractors, or partners
As a rough guide, Security.org suggests a concentrator starts to make sense once an organization has more than about 100 remote users who need simultaneous access. Smaller businesses are usually better served by a VPN-capable router or a managed business VPN service.
Hardware, Virtual or Built Into Your Firewall?
The term became popular in the early 2000s, when companies such as Cisco sold standalone "VPN concentrator" boxes. Today, the job is usually done in one of three ways:
Option | What it looks like | Good for |
|---|---|---|
Built into a firewall | A feature of a next-generation firewall from vendors such as Cisco, Fortinet, or Palo Alto Networks | Most organizations today |
Virtual appliance | Software running on a server or in a public cloud | Flexible, cloud-heavy setups |
Dedicated hardware | A standalone appliance just for VPN traffic | Very high connection counts |
Benefits and Drawbacks
Benefits | Drawbacks |
|---|---|
Handles thousands of secure connections at once | Expensive to buy, license, and maintain |
One central place to manage access and security rules | Needs skilled network and security staff |
Supports MFA and role-based access | Can slow down when too many people connect |
Works with many devices and operating systems | A single point of failure if there's no backup |
Keeps data encrypted across public networks | A high-value target for attackers |
VPN Concentrator vs VPN Router, Site-to-Site VPN and VPN Client
What it does | Who it's for | |
|---|---|---|
VPN concentrator | Accepts and manages many remote users' encrypted connections | Large organizations |
VPN router | Encrypts traffic for all devices on one local network | Homes and small offices |
Site-to-site VPN | Permanently links two or more office networks | Companies with multiple locations |
VPN client | Software on one device that connects to a VPN | Individual users |
IPsec | A protocol, not a device; many concentrators use it to build tunnels | (Technology, not a product) |
The Big Risk: VPN Gateways Are a Favorite Target
Because a VPN concentrator is the front door to a company's network, attackers love to target it. A single flaw can give them a way in.
Verizon's 2025 Data Breach Investigations Report found that edge devices and VPNs made up 22% of breaches involving exploited vulnerabilities, up from just 3% the year before. Only about 54% of those device flaws were fully fixed during the year, with a median of 32 days to patch.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued emergency directives ordering federal agencies to act on actively exploited VPN flaws, including Ivanti Connect Secure in January 2024 and Cisco ASA and Firepower devices in September 2025.
"Organizations worked very hard to patch those edge device vulnerabilities, but our analysis showed only about 54% of those were fully remediated throughout the year," the Verizon report noted.
How to secure a VPN concentrator
Patch fast, especially when a vendor or CISA warns of active attacks.
Require MFA for every user, with no exceptions.
Use modern protocols (IKEv2/IPsec or current TLS). Turn off PPTP.
Hide the admin login from the internet.
Give least-privilege access, so users only reach what they need.
Monitor logs for unusual logins, locations, or times.
Plan for failure with a backup appliance or service.
Are VPN Concentrators Being Replaced?
Partly. Many organizations are moving toward Zero Trust Network Access (ZTNA), often delivered through a cloud model called SASE (Secure Access Service Edge).
The difference is simple:
A traditional VPN checks you at the door, then lets you onto the network.
ZTNA checks you every time you try to open a specific app, and never puts you "on the network" at all.
Research firm Gartner predicted that by 2025, at least 70% of new remote access deployments would rely mainly on ZTNA instead of VPNs, up from less than 10% at the end of 2021. In practice, many companies now run both: ZTNA for everyday apps and a VPN concentrator for older systems that still need full network access.
How Much Does a VPN Concentrator Cost?
Costs vary widely. Small-business appliances can cost a few hundred dollars, while enterprise systems require much larger investments, plus ongoing licenses, support contracts, and staff time. For many organizations, the higher cost is the expertise needed to run and secure it properly.
Do You Need a VPN Concentrator at Home?
No. A VPN concentrator is built for organizations managing many remote users. If you want privacy at home or on public Wi-Fi, a personal VPN app or a VPN-enabled router is all you need.
The Bottom Line
A VPN concentrator is the central gateway that lets a large workforce connect securely to a company network from anywhere. It's powerful and still widely used, but it's also one of the most attacked devices on the internet. If your organization relies on one, keep it patched, require MFA, use modern protocols, and start thinking about how zero trust tools could take on part of the load.
Frequently asked questions
What is a VPN concentrator?
A VPN concentrator is a network device or service that manages many encrypted VPN connections at once. It authenticates remote users, creates secure tunnels, assigns internal IP addresses and controls what each user can access on a company network.
What is the difference between a VPN and a VPN concentrator?
A VPN is the encrypted connection itself. A VPN concentrator is the device on the company's side that receives, manages and secures hundreds or thousands of those connections at the same time.
Where is a VPN concentrator placed in a network?
It usually sits at the edge of the company network, behind the firewall or in a protected zone called a DMZ, so it can handle traffic from the internet before it reaches internal systems.
What is the difference between a VPN concentrator and a VPN router?
A VPN router encrypts traffic for all devices on one local network, like a home or small office. A VPN concentrator is built to accept and manage connections from many remote users in different places.
Which protocols do VPN concentrators use?
Most use IPsec (with IKEv2) or SSL/TLS. Older protocols like L2TP are being phased out, and PPTP is considered insecure and should be avoided.
Are VPN concentrators secure?
They use strong encryption, but they're a frequent target for attackers. Verizon's 2025 report found edge devices and VPNs made up 22% of exploitation-related breaches. Fast patching, MFA and modern protocols are essential.
Is ZTNA replacing VPN concentrators?
Partly. Many organizations are adding Zero Trust Network Access for everyday app access, while keeping VPN concentrators for older systems that still need full network access.