A remote access concentrator is a central network endpoint or function that gathers remote users’ VPN connections and gives authenticated users an authorized path into an organization’s network. It is usually a description of the remote-access role of a VPN concentrator—not the name of one required appliance or protocol.
How a remote access concentrator works
A user or device connects to the organization’s VPN endpoint over an untrusted network, such as the internet. The endpoint handles the VPN connection, authenticates the user, applies authorization rules, and provides access to permitted network resources. The Australian Cyber Security Centre describes remote access as access that starts outside an organization’s network and enters through a gateway; its many-to-one pattern has individual users or devices connecting to a central VPN concentrator: Gateway security guidance.
As an Amazon Associate I earn from qualifying purchases.
In practice, “concentrator” emphasizes that one central endpoint handles multiple connections. That endpoint can terminate VPN tunnels and serve as the controlled entry point to internal resources. Authentication alone does not have to grant access to every part of a network: authorization determines what a connected user is allowed to reach.
What the term does—and does not—mean
VPN concentrator
A VPN concentrator is the general term for infrastructure that handles multiple VPN connections. It can be a dedicated appliance, but the same function can be built into a router, firewall, SD-WAN headend, network controller, or cloud service. Cisco’s description of VPN concentrators covers remote-access and site-to-site VPN use, while newer product documentation illustrates the function integrated into broader platforms: Cisco VPN concentrators, Cisco SD-WAN secure remote access, and HPE Aruba VPN documentation.
#1 Best Overall
- SA2500
- Juniper
Remote-access VPN versus site-to-site VPN
Remote-access VPN connects an individual user’s or device’s client to an organization’s network. Site-to-site VPN connects network endpoints, such as two offices or a branch and a data center. Both can use VPN concentrator functions, but they solve different connectivity problems.
L2TP Access Concentrator (LAC)
A LAC is a specific role in the Layer 2 Tunneling Protocol (L2TP) architecture, not a synonym for every remote access concentrator. In Cisco’s description of its VPDN implementation, the LAC receives a Point-to-Point Protocol (PPP) client session and forwards it to an L2TP Network Server (LNS); the LNS authenticates the user and completes PPP negotiation: Cisco VPDN and L2TP roles.
Rank #2
![Zyxel USG Flex 500 (USG110 v2), UTM Firewall Hardware Only, Recommended up to 150 Users [USGFLEX500]](https://m.media-amazon.com/images/I/31Qe+hFFLlL._SL160_.jpg)
- Unified Threat Management Recommended for up to 150 Users, 2300Mbps SPI Firewall, 7 x Configurable Gigabit WAN/LAN, 1 x SFP. Replaces Outgoing USG USG110 Model
- Provides one single management platform on the cloud while expanding and strengthening the protection from firewalls to access points
- SPI Firewall to Block Spoofing with IPSec and SSL VPN for secure connections between multiple offices and/or home
- Optional Licensable Features Sold Separately: IPS Intrusion Prevention, Anti-Malware, Web Content Filtering, Anti-SPAM
- Industry Trusted ICSA Certified firewall and backed by a Lifetime Warranty Limited Liability
Where the concentrator function can run
- Dedicated appliance: A purpose-built VPN device can handle many connections, but dedicated hardware is not part of the definition and is not required in every design.
- Existing network platform: A router, firewall, SD-WAN headend, or controller can provide the endpoint function as part of a wider network platform. Cisco SD-WAN and HPE Aruba documentation are examples of vendor-specific implementations, not universal product requirements.
- Cloud networking service: AWS uses the name VPN Concentrator for a particular Transit Gateway attachment intended to aggregate many low-bandwidth site connections. AWS says organizations with around 25 or more remote sites in that profile may consider it. Its stated limits are up to 100 sites per attachment, each under 100 Mbps; 5 Gbps aggregate per concentrator; and up to five concentrators per Transit Gateway. These figures apply only to the named AWS service, and AWS does not state a publication year on the cited page: AWS Transit Gateway VPN attachments.
How it differs from ZTNA and SASE
A traditional remote-access VPN typically creates an encrypted tunnel to a network endpoint, after which access is governed by network authorization. Zero Trust Network Access (ZTNA) instead emphasizes granting identity- and context-based access to selected applications. Secure Access Service Edge (SASE) is a broader cloud-delivered approach that combines remote-access and other networking and security functions. These labels describe different access and delivery approaches; a concentrator is the VPN endpoint role, not a competing product category in every deployment. Cisco’s overview presents these distinctions from a vendor perspective: Cisco overview of VPN, ZTNA, and SASE.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Quick Recap
Best Value
- DUAL FUNCTIONALITY: Combines a 2.4 GHz Wi-Fi access point with an 8-channel LoRaWAN concentrator in a single outdoor device for efficient IoT connectivity
- WIRELESS STANDARDS: Features 802.11 b/g/n Wi-Fi capabilities and operates in the 863-870 MHz LoRaWAN frequency band
- HARDWARE SPECS: Utilizes Semtech SX1301 chipset and R11e-LoRa8 miniPCIe card for reliable long-range communication
- ADVANCED FEATURES: Supports Listen Before Talk (LBT) and spectral scan capabilities for optimized performance
- DEPLOYMENT READY: Weather-resistant enclosure and RouterOS compatibility make it ideal for both remote IoT installations and backhaul-enabled LoRa gateway applications
Rank #4
- DUAL CONNECTIVITY: Features both 2.4 GHz Wi-Fi (802.11 b/g/n) access point and LoRa concentrator module for IoT deployments and sensor networking
- OUTDOOR RATED: Housed in a durable IP54-rated case designed for reliable operation in outdoor and industrial environments
- VERSATILE POWER OPTIONS: Supports multiple power input methods including passive PoE, automotive power, or DC jack for flexible installation
- INTEGRATED SOLUTION: Combines Wi-Fi backhaul capabilities with LoRa connectivity in a single device, streamlining long-range IoT infrastructure
- PROFESSIONAL GRADE: MikroTik wAP LR2 Kit includes R11e-LR2 miniPCIe card for professional IoT and industrial applications requiring reliable connectivity
Rank #3
- Cisco ASA5520-AIP20-K9 ASA 5520 Appliance w/ AIP-SSM-20
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
