You have been asked to design a remote access VPN solution to support up to 2000 devices. You must ensure that only corporate assets are allowed to connect to the VPN, and users must authenticate to g

Device-unique certificates bind authentication to a specific enrolled device, which directly conflicts with the requirement that users may not always use the same device - users would be unable to authenticate from any corporate device that does not hold their expected certificate.

SSL VPN solutions such as Cisco AnyConnect support host-checking and posture assessment to verify that only corporate-managed endpoints can establish a tunnel, and they integrate natively with AAA infrastructure to apply role-based access policies for up to thousands of concurrent users.

IPsec VPN provides secure tunneling but is less suited for flexible remote access at scale because it requires per-device client configuration and lacks the built-in posture assessment and role-based policy enforcement capabilities that SSL VPN solutions offer.

Local usernames and passwords stored on the VPN device do not leverage existing corporate directory credentials, do not scale efficiently to 2000 users, and do not provide dynamic role-based authorization tied to group membership.

A central authentication directory such as Active Directory with RADIUS or LDAP allows users to authenticate with their existing corporate passwords, supports group-based role authorization, and is accessible from any corporate device the user happens to be using.

User-unique certificates allow portability across devices but do not enforce that the device itself is a corporate-managed asset, meaning a user could install their personal certificate on a non-corporate device and gain access.