User supplied credentials, every connection for ipsec?

[minektur]

I'd like to configure a sg-3100or sg-1000 and send it out with a user to attach to untrusted internet, to force all traffic from a computer attached to it through a vpn tunnel back to a network I trust…  (well, they have multiple devices, including a voip phone that all should have their traffic tunneled).

Is there any way to have the end user supply vpn credentials/password, every time they turn on the device/bring-up-the tunnel?

[minektur]

perhaps using captive portal somehow?  the tunnels can be automatic but no use of devices on any of the ports without portal authentication?  I've never used captive portal before… I'll have to go read up on it.