cisco vpn because of ipsec over tcp

[Lucas]

Dear All

Have anyone here tried to compile cisco vpn for Fedora 16 - 32 or 64 bit?
I need it sometimes and it should support ipsec over tcp, unfortunately nothing in unix
can provide it.

Thanks for suggestions.

[Peter Robinson]

On Mon, Nov 14, 2011 at 4:49 PM, Lucas <macachuto(a)gmail.com&gt; wrote:
>  Dear All
>
>  Have anyone here tried to compile cisco vpn for Fedora 16 - 32 or 64 bit?
>  I need it sometimes and it should support ipsec over tcp, unfortunately nothing in unix
> can provide it. 
Have you ever tried NetworkManager-vpnc (and the underlying vpnc) that
comes with Fedora OOTB?

Its been a while since I've used it (my current employer uses other
technology) but it use to work OK with the last Cisco env I used. From
the description:

A VPN client compatible with Cisco's EasyVPN equipment.

Supports IPSec (ESP) with Mode Configuration and Xauth.  Supports only
shared-secret IPSec authentication, 3DES, MD5, and IP tunneling.

Peter

[Michael Cronenworth]

Lucas wrote:
>  Have anyone here tried to compile cisco vpn for Fedora 16 - 32 or 64
> bit?
>  I need it sometimes and it should support ipsec over tcp, unfortunately nothing in unix
> can provide it. 
NetworkManager works with Cisco VPN tunnels.

Cisco also provides a Linux client that you can use.

Why do you say "nothing in unix can provide it?"

[Matej Cepl]

Dne 14.11.2011 17:49, Lucas napsal(a):
>  Have anyone here tried to compile cisco vpn for Fedora 16 - 32 or 64
>  bit? I need it sometimes and it should support ipsec over tcp,
>  unfortunately nothing in unix can provide it. 
Also, I use pretty happily openswan (via NetworkManager-openswan, you 
probably need most recent versions) with our Cisco concentrators.

Matěj

[Paul Wouters]

On Thu, 12 Jan 2012, Matej Cepl wrote:

>  Dne 14.11.2011 17:49, Lucas napsal(a):
> > Have anyone here tried to compile cisco vpn for Fedora 16 - 32 or 64
> > bit? I need it sometimes and it should support ipsec over tcp,
> > unfortunately nothing in unix can provide it. 
I am not sure if the tcp port 10000 can be implemented from a cisco
licence point of view. If any kind of fake tcp is implemented to tunnel
IPsec, it's probably best to stick it on port 443. The tor people know a
lot about faking https traffic to circumvent a lot of deep packet
inspectors.

But really, if a network administrator blocks udp 4500 so that IPsec
NAT-T is failing, you are basically on a network not welcome to IPsec.
Whether you should attempt port 10000 tcp on such a network, I don't
know....

>  Also, I use pretty happily openswan (via NetworkManager-openswan, you
>
>  probably need most recent versions) with our Cisco concentrators. 
Perhaps it is time to turn these cisco's into RHEL servers with openswan
:)

Paul

[Matej Cepl]

Dne 13.1.2012 01:22, Paul Wouters napsal(a):
>  Perhaps it is time to turn these cisco's into RHEL servers with
> openswan
>  :) 
Hear, hear!

Matěj