What Is a VPN Concentrator? Do You Still Need One?

A VPN concentrator is a networking device purpose-built to create and manage a large number of VPN tunnels at the same time — typically remote-access tunnels from many employees into one corporate network. Think of it as a specialised gateway whose whole job is terminating and encrypting concurrent VPN connections at scale.

The term dates from an era when VPN termination was heavy enough to justify dedicated hardware. That is less true today, which is why the honest answer to 'do I need one?' is usually 'you already have its function inside your firewall.'

The word 'concentrator' captures the idea well: many individual tunnels arriving from all over the internet, concentrated down to a single point that decrypts them and connects each user to the internal network. That is a demanding job at scale — thousands of simultaneous encrypted sessions, each needing key management and policy enforcement — and it is why the function once justified its own specialised box. What has changed is not the job but where it is done.

What a VPN concentrator does

A concentrator authenticates remote users, negotiates and maintains their encrypted tunnels, and hands their decrypted traffic to the internal network under whatever access policy you set. Its value is scale and specialisation: dedicated cryptographic hardware to handle hundreds or thousands of simultaneous IPsec or SSL tunnels without becoming a bottleneck.

Functionally it is a concentrated remote-access gateway. Everything it does — key exchange, ESP encryption, session management, access control — is the same work any VPN gateway does, done in bulk.

Concentrator vs router vs firewall

The distinction is one of role, not magic. A router forwards packets between networks; a firewall filters traffic by policy; a VPN concentrator terminates many VPN tunnels. On modern equipment these roles collapse into one box: a next-generation firewall from Fortinet, Palo Alto, Cisco or Check Point terminates VPN tunnels, filters traffic and routes, all at once.

So the practical hierarchy is simple: a small office uses its firewall or router's built-in VPN; a large enterprise with tens of thousands of remote users may still deploy dedicated high-capacity VPN appliances (effectively concentrators) or scale horizontally in the cloud.

Do you still need a dedicated one?

For most organisations, no — the concentrator's function lives inside the firewall you already run, and cloud-hosted gateways scale elastically without dedicated hardware. You would still consider a purpose-built appliance when your concurrent-tunnel count is genuinely large, when you want to separate VPN termination from your perimeter firewall for performance or blast-radius reasons, or when a vendor's high-end model simply offers the throughput you need.

What has not changed is the security reality: a device terminating everyone's tunnels is a concentrated, high-value target. Whatever terminates your remote access must be patched aggressively — the same lesson as the FortiClient and SSL-VPN appliance vulnerabilities of recent years.

The bigger shift

The real trend is away from concentrating all remote access at one network chokepoint at all. Zero trust network access brokers per-application connections rather than terminating a network tunnel, which removes the single fat gateway from the design. If you are sizing a concentrator today, it is worth asking whether the workload should be a VPN at all.

For how these tunnels are established in the first place, see remote-access VPN explained, and for where concentrators fit among the other pieces, the business VPN guide has the map.

How to size and place one

If you do deploy a dedicated VPN concentrator, size it on two numbers and place it deliberately. The two numbers are concurrent tunnels — how many simultaneous users or sites you must terminate — and encrypted throughput, the aggregate bandwidth the device can encrypt and decrypt without becoming the bottleneck. Vendors quote both, and both fall sharply under real-world cipher and packet-size mixes, so build in headroom rather than buying to the datasheet peak.

Placement matters because a concentrator terminates untrusted connections from the internet. It typically sits at the network edge, often in a DMZ, with tightly controlled paths from the decrypted side into the internal network — you do not want a compromise of the concentrator to be a compromise of everything behind it. And because it is a single point through which remote access flows, it should be deployed as a high-availability pair, so a failure or a patch reboot does not sever every remote user at once.

Hardware crypto acceleration is the reason dedicated appliances still exist at scale: offloading AES or ChaCha operations to purpose-built silicon lets one box sustain far more tunnels than a general-purpose server. That advantage narrows every year as commodity CPUs gain crypto instructions and as cloud gateways scale horizontally, which is exactly why the dedicated concentrator is a shrinking category rather than a growing one.

The bottom line

A VPN concentrator is a specific answer to one problem — terminating a large volume of remote-access tunnels — and for most organisations that answer now lives inside the firewall or the cloud, not in a separate box. If a vendor is selling you a standalone concentrator, the fair questions are whether your concurrent-tunnel count truly exceeds what your existing gateway can handle, and whether the workload should be a network VPN at all.

Where the term still earns its place is in high-scale, latency-sensitive or heavily-regulated networks that want VPN termination isolated from the perimeter firewall for performance or blast-radius reasons. Everywhere else, treat 'do we need a VPN concentrator?' as a prompt to look at what your firewall already does and whether zero trust would remove the need for a fat aggregation point entirely.