For IPsec VPNs, two-factor authentication can be implemented at the connection level using a TOTP-based solution like SecurID integrated with the IPsec client. For SSL VPNs, 2FA can be enabled at the gateway web portal login using secondary authentication factors like OTP tokens, biometrics, push authentication, or QR code validation.