OpenVPN vs IPSec

[Victor Sudakov]

Muenz, Michael wrote:
> >
> > Is there any reason to prefer IPSec over OpenVPN for building VPNs
> > between FreeBSD hosts and routers (and others compatible with OpenVPN
> > like pfSense, OpenWRT etc)?
> >
> > I can see only advantages of OpenVPN (a single UDP port, a single
> > userland daemon, no kernel rebuild required, a standard PKI, an easy
> > way to push settings and routes to remote clients, nice monitoring
> > feature etc). But maybe there is some huge advantage of IPSec I've
> > skipped?
> >
> Hi,
> 
> partners/customers with Cisco IOS or ASA wont be able to partner up 
> without IPSEC.

Sure, that's why I wrote "and others compatible with OpenVPN
like pfSense, OpenWRT etc" in the first paragraph.

Jim Thompson wrote:
> 
> Performance is better with IPsec.

Because it's in the kernel? But many use (and recommend) StrongSwan
which is a userland implementation.

> It's a standard, too. 

IPsec in itself maybe a standard, but IKE does not seem to be much of
a standard, I get the impression that there's much incompatibility
between vendors (Cisco, racoon etc). 

-- 
Victor Sudakov,  VAS4-RIPE, VAS47-RIPN
AS43859