Skip to content
NeoGuard

VPN Concentrator

A VPN concentrator is a network device or virtual gateway that builds, encrypts, and manages a large number of simultaneous VPN tunnels at a central point. Organizations use it to aggregate remote access for many employees and sites into their internal network.

A VPN concentrator is a specialized network device that sits at the edge of a corporate network and accepts, encrypts, and manages many VPN tunnels at once. An ordinary router offers VPN only as a side feature. A concentrator is built for one job: aggregating secure remote access for hundreds or thousands of users and sites at a single point.

How does a VPN concentrator work?

A VPN concentrator sits between the internal network and the public internet. When a device connects from outside, the same sequence always runs:

  • Authentication: The concentrator checks who is connecting, for example via certificates, RADIUS/LDAP, or SAML.
  • Handshake: Both sides agree on encryption methods and keys and build the tunnel over IPsec (ESP) or SSL/TLS.
  • Routing: The concentrator assigns the client an internal IP address from an address pool and routes traffic between that client and the internal subnets.

In a hub-and-spoke topology, the concentrator is the hub where all tunnels terminate. Traffic between two branches passes through this central point, where it can be filtered and controlled. Often the firewall function runs on the same device. The core is the ability to terminate very many connections at once without performance collapsing.

What is a VPN concentrator used for?

The term dates back to when Cisco’s VPN 3000 series built central remote access for entire enterprises. Today the function shows up in three forms:

  • Multi-function firewalls (NGFW): Devices from Palo Alto, Fortinet, or Cisco, when they are used primarily to aggregate many remote-access tunnels.
  • Cloud services: AWS offers a Site-to-Site VPN Concentrator designed explicitly to connect 25 or more low-bandwidth sites over IPsec tunnels.
  • Virtual gateways: Software appliances that handle tens of thousands of tunnels and multi-gigabit encrypted throughput.

Typical settings are enterprises with large remote workforces, organizations with many branch offices, and managed service providers that offer remote access as a service.

VPN concentrator, gateway, or router: what is the difference?

The distinguishing factor is scale. The underlying technology is the same. A VPN router or a simple gateway encrypts a handful of connections on the side. A concentrator is built to authenticate, encrypt, decrypt, and manage very many tunnels at once. In practice, though, the term is used loosely: many vendors call any device that aggregates remote-access VPN a concentrator, even when it is also a firewall and a router. There is no hard technical line between “gateway” and “concentrator”; the boundary is fluid.

Do you still need a VPN concentrator in 2026?

The function is still needed; a dedicated appliance for it, less and less often. Tunnel aggregation now usually lives inside a larger firewall, SD-WAN, or SASE (Secure Access Service Edge) platform rather than a separate “VPN concentrator” box. The drivers are well-known weaknesses of the classic model:

  • Once authenticated, a user often gains broad access to the whole network. With stolen credentials, that eases lateral movement.
  • Traffic is backhauled to a central point, which adds detours and latency for cloud and SaaS applications.
  • Rules are usually network- rather than application-level, which makes least privilege harder to express.

Zero Trust Network Access (ZTNA) and SASE address exactly this: they replace broad network access with application-specific, identity-based access. The concentrator role has not vanished, though. Even in a SASE architecture, the encrypted tunnels terminate somewhere (the provider’s cloud nodes), where the access rules are enforced. The term simply appears less often in new marketing.

Sources

Related Terms

VPN (Virtual Private Network)FirewallEncryptionKill SwitchVPN Passthrough