FactoryPMI security

In theory probably not - in practice, probably. Your VPN connection probably uses a similar transport layer security (SSL/TLS) scheme as FactoryPMI does with secure connections. You’re probably “more secure” using SSL on top of the VPN at the expense of 2 additional layers of overhead.

If I were a betting man against teams of researchers and professional hackers, I’d trust a Cisco VPN client marginally over the FactoryPMI TLS connection. However, either scheme alone is equivalent in strength to what you trust on the Internet with banking and your money.

The only reason I would use SSL and VPN in combination is if you want to require FPMI SSL connection to users that connect locally and your VPN users. A properly configured VPN provides adequate security on it’s own. Try it out and see how it performs.

I have played with scenarios with 3+ tunnels deep. At that point you can create huge problems since you have packets of a fixed size, and each need to create headers. Getting too screwy with this can lead to significant packet fragmentation, which can cause serious performance hits.

Bottom line - either should work fine alone.