I don't see how pure IPsec sans L2TP is remotely viable with clients originating from dynamic IPs. Thanks for dictating my security policy, Microsoft. Is it possible to just configure Cisco VPN for pure IPSEC and bypass the Cisco client in favor of the built-in Windows IPSEC client?Īlso, for whatever other failings it may have, the Microsoft KB240262 explains that Microsoft refuses to support pre-shared key authentication for L2TP/IPsec client VPN connections, only certificates. VPNC can be compiled on Windows with Cygwin but we need something GUI for our Windows userbase, like I imagine most shops do.

I'd hate to have to regress to PPTP VPN just to get interop sans lock-in. OS X's built-in VPN client will do L2TP/IPsec or PPTP. I don't think SSL-VPN is standardized for instance OpenVPN is not interoperable with Cisco SSL VPN, and F5 isn't interoperable with either, etc. I, too, use the awesome vpnc open source VPN client on Linux and other Unix, 32-bit and 64-bit, and the fact that L2TP/IPsec is a generally-interoperable standard is why we use it. Fantastic! If it can give the option of letting the client toggle split tunneling at will (i.e., turn it on when desired, even though gateway policy doesn't require it) that would be a big bonus. The Windows version isn't open source, but it is free, and ShrewSoft have configuration guides for 11 IPsec gateways from 9 different vendors. I haven't had a chance to test it myself but it looks like it might be a good thing.Īh, ShrewSoft looks like a great contender, and the type of thing I was looking for when I posted (that, and to be told whether I was incorrect, and to rant). I'd rather pay someone else than pay Cisco extortion fees, but free or open source would be best. I don't see any GUI freeware or open source clients. Looking around, it seems like Windows users are using other L2TP over IPsec clients, such as the commercial NCP universal IPsec client or a Win32 port of the open-source VPNC, compiled under Cygwin. Sure, there are circumstances where SSL VPNs are the right tool for the job, but not for us and I have absolutely no intention of changing to a proprietary solution nor to changing to per-user licensing, much less paying Cisco extra for those per-user licenses that I don't need nor want. Looks like Cisco is trying to lock everyone into a proprietary solution, and then charge more per-user for the privilege. This won't work with PIX devices and this won't work with ASAs that don't have the extra-cost SSL VPN licenses (ASAs have unlimited L2TP over IPsec connections, and L2TP over IPsec is quite interoperable between clients and servers). The issue is that, AFAICT, An圜onnect is Cisco-proprietary SSL VPN only. They're essentially saying that An圜onnect is the only way 64-bit Windows is going to be supported. I see that for 64-bit Windows, Cisco says to use their An圜onnect 'next generation' VPN client.

Cisco vpn 64 bit