We have servers at an ISP and a firewall in place. At our main office, we have a VPN. For an added layer of security, I'm thinking a good model may be to have developers connect to the corporate VPN and then only allow traffic in to the servers through the firewall from the VPN's IP.
1) Does this sound like a sound method for connection?
2) What is the best method for validating user at VPN? I've used a cryptocard in a previous environment, but I'm not real familiar with the technology or competitors.