We are running BM 3.8 sp, nw 6.5 sp3.
Today the users connect using backward compatibility, they also have the
same private ip-adresses. This leads to throwing each other off, the error
in Audit log is: Removed deprecated user <username>
This is only a problem if using backward compatibility. I understand that
using Certificates will solve the problem. We have in a short time used a
password for all users. But running with only one password for all who knew
the password is not secure enough.

Is there a document describing how to convert from backward compatibility to
certificates or is there an other secure way to let users login via VPN with
the same private ipadress???