VPNC Basic Interoperability Test

VPNC interop logo

The Basic Interoperability test assures VPN users that IPsec systems are generally interoperable with other IPsec systems. To pass, a system has to interoperate with at least three quarters of the other systems that are in the test.

Every system in the test is tested against every other system. Most pairs of systems are tested twice, switching the roles of initiator and responder. For two systems to be considered interoperable, they each must be able to be initiator or responder. An exception to this rule is that systems that are typically used as remote-access VPN clients are always tested as the initiator because that is how they are almost always deployed by VPN users. If a pair of systems fails a test, it is noted whether or not an IPsec tunnel could be created with one of the systems acting as the initiator, or whether no tunnel could ever be set up.

The Basic Interoperability Test mirrors typical use of IPsec systems in VPNs. A gateway system protects a network of systems behind the gateway; a remote-access client protects either just the single system on which it is running, or a pseudo-network of addresses that refer to the single system.

As specified in the VPNC documentation profile, in IKE Phase 1, each system uses TripleDES, SHA-1, MODP group 2 (1024-bit), and a pre-shared secret of "hr5xb84l6aa9r6". In IKE Phase 2, each system uses TripleDES, SHA-1, ESP tunnel mode, and PFS with MODP group 2 (1024 bits).

The following are the results from the testing, including notes that might affect users checking the results on their own.

Certicom Security Builder IPSec (version 2.9) passed all tests as initiator with all other participants. Security Builder IPSec was tested as a remote-access client, and therefore always initiated.

Check Point UTM-1 (R65) passed all tests in both directions with all participants.

Check Point VPN-1 Gateway (NGX R65) passed all tests in both directions with all participants.

Cisco ASA Family (version 7.1) passed all tests in both directions with all other participants.

Cisco IOS IPsec (version 12.4(1a)) passed all tests in both directions with all other participants.

Cisco Linksys RV082 (version 1.3.2) passed all tests in both directions with all other participants.

Cisco MDS 9000 Family (version 2.0(1B)) passed all tests in both directions with all other participants.

Cisco VPN 3000 Concentrator (version 4.0.1.Rel May 06 2003) passed all tests in both directions with all other participants.

Cyberoam CR series (version 9.4.2 release 3) passed all tests in both directions with all other participants.

D-Link Broadband VPN Router Family (version 1.4) passed all tests in both directions with all other participants.

D-Link NetDefend DFL-200/700/1100 Firewall Family (version 1.2.0) passed all tests in both directions with all other participants.

D-Link NetDefend DIR-130 Firewall Family (version 1.10) passed all tests in both directions with all other participants.

D-Link NetDefend DIR-330 Firewall Family (version 1.10) passed all tests in both directions with all other participants.

D-Link NetDefend DFL-800/1600/2500 Firewall Family (version 2.03) passed all tests in both directions with all other participants.

D-Link NetDefend UTM DFL-260/860 Firewall Family (version 2.12) passed all tests in both directions with all other participants.

D-Link NetDefend VPN Client (version 1.0) passed all tests as initiator with all other participants. NetDefend Client was tested as a remote-access client, and therefore always initiated.

Encore BANDIT family (version 15535.0313) passed all tests in both directions with all other participants.

eSoft InstaGate (Software 3.1.20030717) passed all tests in both directions with all participants. As described in the InstaGate documentation profile, InstaGate always uses a Phase 1 lifetime of one hour; this required changes to the defined policies of a few of the other systems being tested.

IBM Internet Security Systems Proventia (version 3.4) passed all tests in both directions with all other participants.

Intoto iGateway family (iGateway v3.5) passed all tests in both directions with all other participants.

Jungo Software Technologies OpenRG (version 4.0.22) passed all tests in both directions with all other participants.

Juniper Networks NetScreen family (ScreenOS 6.1) passed all tests in both directions with all other participants.

Microsoft ISA Server 2006 passed all tests in both directions with all other participants.

Microsoft Windows Server 2003 (with Service Pack 1) passed all tests in both directions with all other participants.

Mocana Embedded IPsec/IKE (version 2.02) passed all tests in both directions with all other participants.

NETGEAR DG834 family (version 4.01) passed all tests in both directions with all other participants.

NETGEAR FVG318 (version 2.1.2) passed all tests in both directions with all other participants.

NETGEAR FVL328 (version 1.4 Release 10) passed all tests in both directions with all other participants.

NETGEAR FVS114 (version 1.0) passed all tests in both directions with all other participants.

NETGEAR FVS124G (version 1.1.24) passed all tests in both directions with all other participants.

NETGEAR FVS318v3 (version 3.0_22) passed all tests in both directions with all other participants.

NETGEAR FVS328 (version 1.0.0) passed all tests in both directions with all other participants.

NETGEAR FVS336G (version 2.2) passed all tests in both directions with all other participants.

NETGEAR FVS338 (version 2.0.0) passed all tests in both directions with all other participants.

NETGEAR FVX538 (version 2.0.0) passed all tests in both directions with all other participants.

NETGEAR ProSafe VPN Client (version 10.1.1) passed all tests as initiator with all other participants. ProSafe Client was tested as a remote-access client, and therefore always initiated.

Nokia IP VPN (version 6.2) passed all tests in both directions with all other participants.

Nortel Contivity (version 04-80.124) passed all tests in both directions with all other participants.

Nortel Secure Router (version r9.2) passed all tests in both directions with all participants except for D-Link Broadband VPN Router Family.

phion netfence (version 3.6) passed all tests in both directions with all participants except the remote access clients. For those clients, netfence could not be configured to pass traffic in an IPsec tunnel using preshared secrets.

RetiCorp RetiEdge E Series 1200/1100A/1100/900A/900/700 (version 4.1.0) passed all tests in both directions with all other participants.

SafeNet QuickSec Toolkit (version 2.1) passed all tests in both directions with all other participants.

SafeNet SoftRemoteLT (version 10.1.1) passed all tests as initiator with all other participants. SafeNet was tested as a remote-access client, and therefore always initiated.

Secure Computing SnapGear Network Gateway Security (version 3.1.5) passed all tests in both directions with all other participants.

SonicWALL NSA and NSA E-Class series (version 5.0) passed all tests in both directions with all other participants.

SonicWALL TZ and PRO products running SonicOS Enhanced (version 3.2) passed all tests in both directions with all other participants.

Stonesoft StoneGate (version 2.6) passed all tests in both directions with all other participants.

TeamF1 V-IPSecure (version 1) passed all tests in both directions with all other participants.

Viking V VPN/Firewall (version V2R1) passed all tests in both directions with all other participants.

WatchGuard Firebox X Core and Peak e-Series (version 10.0) passed all tests in both directions with all other participants.

Wind River IPIKE (version 6.5.2) passed all tests in both directions with all other participants.

The following are links to the files showing each pair of systems interoperating. Each file shows an expanded dump of the IKE messages setting up the secure IPsec tunnel. The information was collected with "tethereal", part of the excellent freeware "ethereal" network diagnostics package.

It is unlikely that this information is of much value to typical users; however, without it, you have no proof that the two systems actually were able to interoperate.

Certicom Security Builder IPSec initiating to:
          Check Point Software VPN-1 Gateway
          Check Point UTM-1
          Cisco ASA Family
          Cisco IOS IPsec
          Cisco Linksys RV082
          Cisco MDS 9000 Family
          Cisco VPN 3000 Concentrator
          Cyberoam CR series
          D-Link Broadband VPN Router Family
          D-Link NetDefend DFL-200/700/1100 Firewall Family
          D-Link NetDefend DFL-210/800/1600/2500 Firewall Family
          D-Link NetDefend UTM DFL-260/860 Firewall Family
          Encore BANDIT family
          eSoft InstaGate
          IBM Internet Security Systems Proventia
          Intoto iGateway family
          Jungo Software Technologies OpenRG
          Juniper Networks NetScreen family
          Microsoft ISA Server 2006
          Microsoft Windows Server 2003
          Mocana Embedded IPsec/IKE
          NetDefend DIR-130
          NetDefend DIR-330
          NETGEAR DG834 family
          NETGEAR FVG318
          NETGEAR FVL328
          NETGEAR FVS114
          NETGEAR FVS124G
          NETGEAR FVS318v3
          NETGEAR FVS328
          NETGEAR FVS336G
          NETGEAR FVS338
          NETGEAR FVX538
          Nokia IP VPN
          Nortel Contivity
          Nortel Secure Router
          phion netfence
          RetiCorp RetiEdge E Series 1200/1100A/1100/900A/900/700
          SafeNet QuickSec toolkit
          Secure Computing SnapGear Network Gateway Security
          SonicWALL NSA and NSA E-Class series
          SonicWALL TZ and PRO products running SonicOS Enhanced
          Stonesoft StoneGate
          TeamF1 V-IPSecure
          WatchGuard Firebox X Core and Peak e-Series
          Wind River IPIKE

D-Link NetDefend VPN Client initiating to:
          Check Point Software VPN-1 Gateway
          Check Point UTM-1
          Cisco ASA Family
          Cisco IOS IPsec
          Cisco Linksys RV082
          Cisco MDS 9000 Family
          Cisco VPN 3000 Concentrator
          Cyberoam CR series
          D-Link Broadband VPN Router Family
          D-Link NetDefend DFL-200/700/1100 Firewall Family
          D-Link NetDefend DFL-210/800/1600/2500 Firewall Family
          D-Link NetDefend UTM DFL-260/860 Firewall Family
          Encore BANDIT family
          eSoft InstaGate
          IBM Internet Security Systems Proventia
          Intoto iGateway family
          Jungo Software Technologies OpenRG
          Juniper Networks NetScreen family
          Microsoft ISA Server 2006
          Microsoft Windows Server 2003
          Mocana Embedded IPsec/IKE
          NetDefend DIR-130
          NetDefend DIR-330
          NETGEAR DG834 family
          NETGEAR FVG318
          NETGEAR FVL328
          NETGEAR FVS114
          NETGEAR FVS124G
          NETGEAR FVS318v3
          NETGEAR FVS328
          NETGEAR FVS336G
          NETGEAR FVS338
          NETGEAR FVX538
          Nokia IP VPN
          Nortel Contivity
          Nortel Secure Router
          phion netfence
          RetiCorp RetiEdge E Series 1200/1100A/1100/900A/900/700
          SafeNet QuickSec toolkit
          Secure Computing SnapGear Network Gateway Security
          SonicWALL NSA and NSA E-Class series
          SonicWALL TZ and PRO products running SonicOS Enhanced
          Stonesoft StoneGate
          TeamF1 V-IPSecure
          WatchGuard Firebox X Core and Peak e-Series
          Wind River IPIKE

Intoto iGateway family initiating to:
          Check Point Software VPN-1 Gateway
          Check Point UTM-1
          Cisco ASA Family