User Authentication

You might have noticed that these configuration options all lead to the host device (computer, firewall, hardware client, or router) being authenticated at the headend (most likely a VPN concentrator). The tunnel endpoints, not the person who is using the tunnel, are authenticated via this process. User authentication remains the function of the same means by which it is normally done inside the main (headend) network: most often with a Windows domain logon, which can be the next step after the tunnel is authenticated.

In this respect, we come back to the point made earlier: The communicating experience for the users must be as much like the experience they would have locally as possible, but security comes first. In a sense, the tunnel is replacing the bootup and initial network connection to the LAN. Of course, because this occurs over an insecure public infrastructure, a secured tunnel is necessary to protect both the remote user and the headend from malicious parties anywhere in the communications path between them.