From owner-freebsd-net@freebsd.org Sun Nov 19 14:31:02 2017 Return-Path: Delivered-To: freebsd-net@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id C5BABDF69F1 for ; Sun, 19 Nov 2017 14:31:02 +0000 (UTC) (envelope-from vas@mpeks.tomsk.su) Received: from relay2.tomsk.ru (mail.sibptus.tomsk.ru [212.73.124.5]) by mx1.freebsd.org (Postfix) with ESMTP id 3AC6F7A01C for ; Sun, 19 Nov 2017 14:31:01 +0000 (UTC) (envelope-from vas@mpeks.tomsk.su) X-Virus-Scanned: by clamd daemon 0.98.5_1 for FreeBSD at relay2.tomsk.ru Received: from [212.73.125.240] (HELO admin.sibptus.transneft.ru) by relay2.tomsk.ru (CommuniGate Pro SMTP 5.1.16) with ESMTPS id 39869787; Sun, 19 Nov 2017 20:26:14 +0600 Received: from admin.sibptus.transneft.ru (sudakov@localhost [127.0.0.1]) by admin.sibptus.transneft.ru (8.15.2/8.15.2) with ESMTP id vAJEUvkd083890; Sun, 19 Nov 2017 21:30:59 +0700 (+07) (envelope-from vas@mpeks.tomsk.su) Received: (from sudakov@localhost) by admin.sibptus.transneft.ru (8.15.2/8.15.2/Submit) id vAJEUsmf083887; Sun, 19 Nov 2017 21:30:54 +0700 (+07) (envelope-from vas@mpeks.tomsk.su) X-Authentication-Warning: admin.sibptus.transneft.ru: sudakov set sender to vas@mpeks.tomsk.su using -f Date: Sun, 19 Nov 2017 21:30:54 +0700 From: Victor Sudakov To: "Muenz, Michael" Cc: freebsd-net@freebsd.org Subject: Re: OpenVPN vs IPSec Message-ID: <20171119143054.GC82727@admin.sibptus.transneft.ru> References: <20171118165842.GA73810@admin.sibptus.transneft.ru> <20171119120832.GA82727@admin.sibptus.transneft.ru> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Organization: AO "Svyaztransneft", SibPTUS X-PGP-Key: http://www.dreamwidth.org/pubkey?user=victor_sudakov X-PGP-Fingerprint: 10E3 1171 1273 E007 C2E9 3532 0DA4 F259 9B5E C634 User-Agent: Mutt/1.9.1 (2017-09-22) X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.25 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 19 Nov 2017 14:31:02 -0000 Muenz, Michael wrote: > Am 19.11.2017 um 13:08 schrieb Victor Sudakov: > > Muenz, Michael wrote: > >>> Is there any reason to prefer IPSec over OpenVPN for building VPNs > >>> between FreeBSD hosts and routers (and others compatible with OpenVPN > >>> like pfSense, OpenWRT etc)? > >>> > >>> I can see only advantages of OpenVPN (a single UDP port, a single > >>> userland daemon, no kernel rebuild required, a standard PKI, an easy > >>> way to push settings and routes to remote clients, nice monitoring > >>> feature etc). But maybe there is some huge advantage of IPSec I've > >>> skipped? > >>> > >> Hi, > >> > >> partners/customers with Cisco IOS or ASA wont be able to partner up > >> without IPSEC. > > Sure, that's why I wrote "and others compatible with OpenVPN > > like pfSense, OpenWRT etc" in the first paragraph. > > > > Are you just searching for arguments against IPSec or real life cases? Actually, I' searching for arguments *for* IPSec. > IMHO when you have both ends under control OpenVPN is just fine. > If you are planning to interconnect with many customers/vendors IPSec > fits best. I have a personal success story of establishing transport mode IPSec between Windows and FreeBSD/racoon. But when other OSes are involved, I have the impression that there is no pure IPSec, it's usually IPSec+L2TP, and that's where the FreeBSD part becomes complicated (interaction between ipsec, mpd5 and racoon is required). > > In the last 15 years I was never asked about a Site2Site VPN with OpenVPN > from any customer or partner of the firewalls I managed. OK, thank you, I have now one argument: IPSec is multi-vendor. -- Victor Sudakov, VAS4-RIPE, VAS47-RIPN AS43859