Check Point VPN-1 SecuRemote/SecureClient NGX R60 HFA1 is a great and secure software that will help your own virtual private network(VPN) to be more secure and and safe.
Explicit Mode
SDL can be invoked explicitly, prior to the domain logon. Using Explicit Mode, SDL is implemented as a Pre-Logon Access Provider (PLAP).
A PLAP is a component that enables Pre Logon Connection to the Internet. For example, a dialup connection appears as such a pre logon connection. Once SDL is enabled, or if Windows enables its own PLAP, a new button for Network Logon is added to the logon screen at the lower right corner.
Clicking the Network Logon button will redirect the user to a screen showing all available pre logon connection methods (PLAPs), in which SecureClient SDL participates.
If the user clicks the Network Logon button and the SecureClient PLAP is the only PLAP registered, then the connect dialog box will appear and the user can proceed with connecting to the VPN gateway.
If more than one PLAP is registered, the user will get a screen with a list of all the registered PLAPs.
When choosing SecureClient PLAP the connect dialog will appear and the user can proceed with connecting to the VPN gateway.
The user can then proceed with the log on to windows.

Implicit Mode
Implicit mode SDL is invoked automatically and immediately after the user authenticates to the domain
controller. This means that while using implicit mode, authentication to the domain controller over a
VPN tunnel is not provided. It does, however, provide Group Policy and logon scripts over the VPN tunnel.

Note - By default, windows performs authentication to the domain controller against the cache it holds. This means that, unless configured otherwise, actual domain connectivity will not be required for domain authentication.

In addition, implicit mode SDL will not be invoked when using Smart Card logon to windows.