Despite the improvements and generally more-granular access controls that are possible with Secure Sockets Layer (SSL) VPNs, IPsec gateways still provide an important service for connecting remote and external users back to the secure internal network. These gateways perform network address translation (NAT), mutually authenticate the devices at each end of the tunnel and ensure confidentiality by encrypting the traffic traversing each tunnel. IPsec gateways are mature products and may be combined with other security controls in multifunction appliances that include some mix of firewall, intrusion-prevention, and content-inspection capabilities. IPsec gateways can also scale to products that support more than 10,000 concurrent sessions. Because a client agent or native OS support for IPsec is required, the use of these gateways is generally limited to computers that are owned and managed by IT. RADIUS and NDES are for layer 2 MS CA is for certificates