The few users who are travelling on business or working from home may be authorized to gain access through the corporate firewall. Corporate travellers do desire to access their secure machine from an insecure terminal and network connection, such as from facilities provided at a conference, but such access is typically not permitted. This assumption of physical co-location or secure network access is not viable in research environments.
Most users do considerable work at home or while traveling.
Furthermore, mobile hosts, particularly laptops running Linux, are becoming commonplace among researchers. In addition, collaborative research often requires that certain individuals from other organizations be granted access to resources that we do not wish to make available to the general public. In each case, the remote user is potentially approaching the firewall through an insecure network. This finer granularity means that extending a firewall to permanently encompass sites outside a single building or a single LAN segment is more important. Together, these multiple sites constitute a virtual security enclave , and the enclave must have a firewall at every point of connection to an insecure network.