4

Is Cisco IPsec different from ordinary IPsec?

Although Windows 10 has built-in VPN support for L2TP/IPSec, it does not support IPSec provided by Cisco. Thus, we generally need to install hand-made cisco VPN client.

3
  • Actually, you can get the windows client to connect to a cisco "server", but you'll be configuring the cisco end to match the parameters of the windows side. (as you can't change the windows side) It's far easier to install Cisco's VPN client software.
    – Ricky
    May 27 '19 at 17:54
  • If A and B don't work well together, don't automatically assume it's B's fault ;-
    – hertitu
    May 29 '19 at 6:58
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin
    Jan 5 at 23:29
5

Both Windows L2TP/IPsec and Cisco IPsec are different from ordinary IPsec.

Originally the "ordinary" IPsec handshake protocol (IKEv1) did not have any features to negotiate the client's VPN address, or to push parameters such as split-tunnel routes & DNS servers. In other words, you could use it to manually create static tunnels, but it lacked the convenience features.

Microsoft and Cisco took different approaches to adding the necessary features:

  • The Windows "L2TP/IPsec" client uses IKEv1 to negotiate an IPsec ESP transport-mode link (host-host), which then carries an L2TP tunnel, and the tunnel addresses are negotiated via L2TP. (In this case L2TP is the real "VPN" protocol, and IPsec merely provides encryption.)

  • The Cisco "IPsec VPN" client uses IKEv1 with proprietary Cisco extensions (known as "Unity" and later as mode-config) to negotiate an IPsec ESP tunnel-mode link (site-site), together with with 'virtual' addresses, routes, and all your expected VPN features.

  • (Some vendors use yet different methods. For example, FortiGate uses DHCP-over-IPsec.)

So although both are built on top of standard IPsec, they add the missing features differently: Windows uses a second protocol on top, while Cisco extends IKE directly, and it's this part that requires two different clients.


Note that modern Windows versions have a second IPsec VPN client, which uses IKEv2 – a newer version of the IPsec handshake protocol, which has fully incorporated the Cisco extensions (now known as "narrowing" and "mode config"). With IKEv2, "ordinary IPsec" can be used as a fully-featured VPN protocol on its own, hopefully compatible with other vendors.

(Though even with IKEv2, Windows still goes its own ways, e.g. ignoring the negotiated IPv6 routes as one of the most annoying examples.)

1

The Windows IPsec client apparently has some problems. There are some workarounds, for example, here.

4
  • You said that it does not support any non-windows vpn?
    – mallea
    May 27 '19 at 17:41
  • That's not what I said. See the link for how to configure.
    – Ron Trunk
    May 27 '19 at 17:56
  • I cant access to the website.
    – mallea
    May 27 '19 at 19:41
  • @RonTrunk the link you provided is invalid (as of 20190628 at 1758GMT-5). Error given: The network connection was lost.
    – sietecFAST
    Jun 28 '19 at 22:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.