You may notice that different wording is used here and there in documentation and on the website. Here we aim to provide some clarification. What the subscription licensing system really counts is the amount of active VPN tunnels. This means various scenarios are possible. For example, you can configure 1 user account on your OpenVPN Access Server and set it up so that with that same user name and password you can establish a VPN connection from multiple different devices at the same time. For example you could set up an account called “andrew” and set a password for it, and then use that same account on an iPad, a Windows computer, and two Macintosh computers, all at the same time. In such a situation if all those devices are connected at the same time you’re using 4 connections on the license. If your subscription is for 10, then that leaves 6 connections free.
It also works the other way around. You can have 500 user accounts on your OpenVPN Access Server but only license it for 100 connections, and if 25 of those 500 users are connected then you can still connect 75 VPN tunnels with any of the 500 accounts. So in other words, the subscription licensing system does not look at how many user accounts you have, but how many VPN tunnel are connected at the same time. So if you have 500 user accounts but you anticipate that only about 90 of them will ever be online at the same time, then a subscription for 100 VPN connections is perfectly fine.
And if for example you have 10 VPN tunnel connections active on a server that is on a subscription for 10 connections, then anyone trying to establish the 11th connection will be denied access and receive a message that the licensed amount has been exceeded. When one of the currently connected tunnels is stopped, then that opens up 1 license and the user can then log in.
A subscription can be activated on multiple Access Server at the same time. This allows for automatic sharing of the subscription across multiple Access Servers. The way this works is that as long as the total amount of VPN connections on all Access Servers using the same subscription stays at or below the amount of allowed VPN connections on the subscription, then all servers will be allowed to connect the maximum amount of connections. Only when you go over, does the subscription system start forcing the Access Servers to kick some users off to stay within the limits.
To give an example, if you have a subscription for 100 connections, and Access Servers A and B are both using that same subscription, then each server will be allowed to connect 100 connections each. This is done to allow a situation where you might want 99 connections on server A and 1 connection on server B, just to give an example. It is only when the total amount of the connections on both servers added up go over 100, that users will start to be kicked off. For example if you have 30 users on Access Server A, and 71 users on Access Server B, then you have 101 connections, which exceeds 100 connections allowed on your subscription. Then 1 user will be kicked off, and that will most likely be the user that last connected. At such a point, the amount of allowed connections on Access Server B might be lowered to 70, forcing the 71st connection to be kicked off. Once you are at or below the limit again, the subscription licensing system ‘resets’ and tells both servers the maximum amount of connections are allowed again.