Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Could somebody explain how tokens fit into the VPN world? We currently use Citrix XenApp as our remote access solution and it works very well. But we're considering adding an additional layer of security with tokens. We're not in the SecurID price range but something like SafeWord looks good. To complicate matters, we're also looking at establishing a VPN to allow both direct network access and Citrix. I understand how VPN works in theory and for us, this box looks ideal:

But not sure if this solution would fit in with a token system. I suppose I'm asking what are all the bits in a token based VPN solution? What boxes and bits of software usually make up the blend?

Cheers, Rob.

share|improve this question

A minor correction to "radius": most of the "big name" (and quite a lot of the not-so-big) VPN vendor support the RSA SecurID protocol natively. That means integration with SecurID is (mostly) a case of configuring the VPN device with the necessary information to locate the SecurID servers (that's contained in what RSA calls the "sdconf.rec" file).

You load it up in the VPN box and off you go.

Of course, using RADIUS is also an option, but you don't have to stand-up a separate Radius server, as the Authentication Manager server comes bundled with a cut-down Radius server precisely to be able to "talk" radius with the devices that don't support the SecurID protocol natively (other times it's been called ACE or SID).

For more information and detailed configuration guides, RSA publishes guides to all certified products (ie, those that have gone through a certification process, but many more are working with SecurID fine), in the site

Hope this helps

share|improve this answer

For SecurID you have to install a Radius server, then just to configure your VPN concentrator to use this Radius server.
I guess that SafeWord is working in the same,I don't see how it could work is another way.
As the spec of the concentrator say that it support RADIUS "Supports multiple backend user repositories, including Microsoft Active Directory, LDAP & RADIUS" it should be OK.
Just ask SafeWord is they do use a Radius server

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.