Any viable solution must have a key management mechanism to negotiate and exchange secret encryption keys in a secure manner. The ability to positively authenticate network users is vital to ensuring VPN security. Password protection is easily circumvented and thus inherently insecure. But x.509 digital certificates provide stronger authentication for more reliable performance. To avoid severe performance degradation, all security measures must be performed on VPN systems optimised for the same.
Encapsulation requires adding information to each packet, which increases the packet size.
This, in turn, increases the likelihood that internetwork routers will find the packets oversized and fragment them, further degrading performance. Packet fragmentation and data encryption can reduce dial-in system performance to unacceptable levels. Data compression can help solve this problem. However, the combination of compression and encapsulation requires additional computational power beyond that needed for security. Router and servers add-ons such as encryption cards may be limited in performance because they depend on the performance of the device to which they attach.