Ooo. I just found Tom's Networking which says the BEFVP41 I was looking at is a VPN endpoint. For that matter, the BEFSX41 is an endpoint, too, and it is incredibly cheap because it drops the VPN coprocessor. I'm going to spend some more time reading Tom's Networking.