user authenticate with Certificates, we can config your Concentrator in order to ask for username / password, this is called phase 1.5, actually certificates is known as phase 1, once user is authenticated will start phase 2 (ipsec). You can config your Concentrator for local or external authentication.