Who rated this post

I think the confusion is, in part, as the names used are quite similar.

The is no "Endpoint Security VPN client" installable as you suggest. There is a "Endpoint Security" installable that does indeed have three deployment options:  Endpoint Security VPN; Mobile for Windows and SecuRemote.

I would also want to clarify your next statements:

> Endpoint Security VPN including Desktoip FW

Endpoint Security VPN includes the ability to enforce an optional desktop FW. It is an IPsec client and provides office mode address assignment. If using the optional desktop firewall, it requires an IPsec gateway license and either endpoint container licensing (VPN + FW) or Sandblast client licensing and is licensed per-seat. If not using the optional desktop firewall, it uses MAB licensing and is licensed per-connected-user. 

> Mobile Endpoint Client (SSL for MAB)

Mobile for Windows offers VPN connectivity only. It is an IPsec client and provides office mode address assignment. It requires a IPsec gateway license and MAB gateway license. If a cluster, MAB licensing must be on both cluster members. It is licensed per-connected-user.

- SecuRemote VPN client (without OfficeMode, works without license !)

SecuRemote offers VPN connectivity only. It does not provide office mode address assignment and so can cause users issues if used with more than a small number of VPN users. It requires an IPsec gateway license. There are no licensing restrictions on the number of users.

To clarify the two terms: "per-seat" and "per-connected-user". Per seat means that, if you have 1500 potential remote access VPN users you need 1500 licenses, even if only at most 200 are connected one one time. Per connected user means that with 1500 potential users, you only need to buy licenses for 200 tunnels if that is the most that connect at one time.