Date: Sun, 19 Nov 2017 19:08:32 +0700 From: Victor Sudakov <vas@mpeks.tomsk.su> To: "Muenz, Michael" <m.muenz@spam-fetish.org>, Jim Thompson <jim@netgate.com> Cc: freebsd-net@freebsd.org Subject: Re: OpenVPN vs IPSec Message-ID: <20171119120832.GA82727@admin.sibptus.transneft.ru> In-Reply-To: <b96b449e-3dc1-6e75-e803-e6d6abefe88e@spam-fetish.org> References: <20171118165842.GA73810@admin.sibptus.transneft.ru> <b96b449e-3dc1-6e75-e803-e6d6abefe88e@spam-fetish.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Muenz, Michael wrote: > > > > Is there any reason to prefer IPSec over OpenVPN for building VPNs > > between FreeBSD hosts and routers (and others compatible with OpenVPN > > like pfSense, OpenWRT etc)? > > > > I can see only advantages of OpenVPN (a single UDP port, a single > > userland daemon, no kernel rebuild required, a standard PKI, an easy > > way to push settings and routes to remote clients, nice monitoring > > feature etc). But maybe there is some huge advantage of IPSec I've > > skipped? > > > Hi, > > partners/customers with Cisco IOS or ASA wont be able to partner up > without IPSEC. Sure, that's why I wrote "and others compatible with OpenVPN like pfSense, OpenWRT etc" in the first paragraph. Jim Thompson wrote: > > Performance is better with IPsec. Because it's in the kernel? But many use (and recommend) StrongSwan which is a userland implementation. > It's a standard, too. IPsec in itself maybe a standard, but IKE does not seem to be much of a standard, I get the impression that there's much incompatibility between vendors (Cisco, racoon etc). -- Victor Sudakov, VAS4-RIPE, VAS47-RIPN AS43859
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20171119120832.GA82727>