I have a customer who has a very nicely working setup with a Cisco 2951 running as an EZVPN client to a head end. Because the 2951 is EOL, the customer is being pushed to replace this with a currently supported product. In looking at the datasheet...