You have been asked to design a remote access VPN solution to support up to 2000 devices. You must ensure that only corporate assets are allowed to connect to the VPN, and users must authenticate to…

Local usernames and passwords on the VPN device do not integrate with existing application credentials, cannot scale to 2000 users without excessive administrative overhead, and provide no role-based authorization capability.

A central directory such as Active Directory integrated via RADIUS or LDAP allows users to authenticate with their existing application passwords without requiring new credentials, and supports role-based authorization policies to control access based on user group membership. This also scales effortlessly to 2000 users since authentication is managed centrally rather than maintained as local accounts on the VPN headend.

User-unique certificates require distributing the certificate to every device the user might use, which conflicts with the requirement that users may not always connect from the same device, and they do not use the existing password infrastructure.

IPsec VPN is optimized for site-to-site connectivity and relies primarily on device-level authentication mechanisms such as certificates or pre-shared keys rather than flexible user-role-based access tied to a central directory.

Device-unique certificates would restrict connections to enrolled corporate assets but do not support the requirement that a user may use different devices, and they do not address role-based authorization or reuse of existing user passwords.

SSL VPN (such as Cisco AnyConnect) is the correct transport choice for user-centric remote access because it supports integration with central authentication directories, enforces role-based access policies per user session, and allows any enrolled corporate device to be used - satisfying the requirement that a user may not always connect from the same device.