In this Frequently Asked Questions article, there is a question
Does single sign-on work outside my corporate firewall?"
The answer is :
Yes, single sign-on can work outside your corporate firewall. When users are outside the corporate firewall, they can use their network passwords to log in to Salesforce. Alternately, you can require that users must first be connected to your corporate network in order to log in.
I want to know that how to "require users must first be connected to your corporate network".
It's by IP restrict or other ways? If by IP restrict, is it also work with VPN ?