Date: Sun, 19 Nov 2017 14:33:33 +0100 From: Miroslav Lachman <000.fbsd@quip.cz> To: "Muenz, Michael" <m.muenz@spam-fetish.org>, freebsd-net@freebsd.org Subject: Re: OpenVPN vs IPSec Message-ID: <5A11882D.1050700@quip.cz> In-Reply-To: <d92dff62-3baf-a22d-bfac-5a668b276259@spam-fetish.org> References: <20171118165842.GA73810@admin.sibptus.transneft.ru> <b96b449e-3dc1-6e75-e803-e6d6abefe88e@spam-fetish.org> <20171119120832.GA82727@admin.sibptus.transneft.ru> <d92dff62-3baf-a22d-bfac-5a668b276259@spam-fetish.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Muenz, Michael wrote on 2017/11/19 13:32: > Am 19.11.2017 um 13:08 schrieb Victor Sudakov: >> Muenz, Michael wrote: >>>> Is there any reason to prefer IPSec over OpenVPN for building VPNs >>>> between FreeBSD hosts and routers (and others compatible with OpenVPN >>>> like pfSense, OpenWRT etc)? >>>> >>>> I can see only advantages of OpenVPN (a single UDP port, a single >>>> userland daemon, no kernel rebuild required, a standard PKI, an easy >>>> way to push settings and routes to remote clients, nice monitoring >>>> feature etc). But maybe there is some huge advantage of IPSec I've >>>> skipped? >>>> >>> Hi, >>> >>> partners/customers with Cisco IOS or ASA wont be able to partner up >>> without IPSEC. >> Sure, that's why I wrote "and others compatible with OpenVPN >> like pfSense, OpenWRT etc" in the first paragraph. >> > > Are you just searching for arguments against IPSec or real life cases? > IMHO when you have both ends under control OpenVPN is just fine. > If you are planning to interconnect with many customers/vendors IPSec > fits best. > > In the last 15 years I was never asked about a Site2Site VPN with OpenVPN > from any customer or partner of the firewalls I managed. I have opposite experience. One customer needs IPSec and setting and debugging was a pain because we don't have access to the other end. On the other hand customers with OpenVPN works in a minute. Just send or receive openvpn.conf, set some variables in rc.conf and VPN is up and running. So I prefer OpenVPN whenever possible. Miroslav Lachman
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?5A11882D.1050700>