This is generally the best way, as it allows you to use things like client certificates or some other form of authentication to enforce AAA, and reduce the requ

This is generally the best way, as it allows you to use things like client certificates or some other form of authentication to enforce AAA, and reduce the requirement of using VPN (which itself increases the security as it reduces the number of holes in your network) Of course it's still unsecure from your proxy to the device, but that's a more managable risk