VPNC Basic Interoperability Test

VPNC interop logo

The Basic Interoperability test assures VPN users that IPsec systems are generally interoperable with other IPsec systems. To pass, a system has to interoperate with at least three quarters of the other systems that are in the test.

Every system in the test is tested against every other system. Most pairs of systems are tested twice, switching the roles of initiator and responder. For two systems to be considered interoperable, they each must be able to be initiator or responder. An exception to this rule is that systems that are typically used as remote-access VPN clients are always tested as the initiator because that is how they are almost always deployed by VPN users. If a pair of systems fails a test, it is noted whether or not an IPsec tunnel could be created with one of the systems acting as the initiator, or whether no tunnel could ever be set up.

The Basic Interoperability Test mirrors typical use of IPsec systems in VPNs. A gateway system protects a network of systems behind the gateway; a remote-access client protects either just the single system on which it is running, or a pseudo-network of addresses that refer to the single system.

As specified in the VPNC documentation profile, in IKE Phase 1, each system uses TripleDES, SHA-1, MODP group 2 (1024-bit), and a pre-shared secret of "hr5xb84l6aa9r6". In IKE Phase 2, each system uses TripleDES, SHA-1, ESP tunnel mode, and PFS with MODP group 2 (1024 bits).

The following are the results from the testing, including notes that might affect users checking the results on their own.

Certicom Security Builder IPSec (version 3.2.5) passed all tests as initiator with all other participants. Security Builder IPSec was tested as a remote-access client, and therefore always initiated.

Check Point IP VPN (version 6.2) passed all tests in both directions with all participants.

Check Point UTM-1 (R65) passed all tests in both directions with all participants.

Check Point VPN-1 Gateway (NGX R65) passed all tests in both directions with all participants.

Cisco ASA Family (version 7.1) passed all tests in both directions with all other participants.

Cisco IOS IPsec (version 12.4(1a)) passed all tests in both directions with all other participants.

Cisco Linksys RV082 (version 1.3.2) passed all tests in both directions with all other participants.

Cisco MDS 9000 Family (version 2.0(1B)) passed all tests in both directions with all other participants.

Cisco VPN 3000 Concentrator (version 4.0.1.Rel May 06 2003) passed all tests in both directions with all other participants.

Cyberoam CR series (version 9.5.9.41) passed all tests in both directions with all other participants.

D-Link Broadband VPN Router Family (version 1.4) passed all tests in both directions with all other participants.

D-Link NetDefend DFL-200/700/1100 Firewall Family (version 1.2.0) passed all tests in both directions with all other participants.

D-Link NetDefend DIR-130 Firewall Family (version 1.10) passed all tests in both directions with all other participants.

D-Link NetDefend DIR-330 Firewall Family (version 1.10) passed all tests in both directions with all other participants.

D-Link NetDefend DFL-800/1600/2500 Firewall Family (version 2.03) passed all tests in both directions with all other participants.

D-Link NetDefend UTM DFL-260/860 Firewall Family (version 2.12) passed all tests in both directions with all other participants.

D-Link NetDefend VPN Client (version 1.0) passed all tests as initiator with all other participants. NetDefend Client was tested as a remote-access client, and therefore always initiated.

Encore BANDIT family (version 15535.0313) passed all tests in both directions with all other participants.

Freescale iGateway family (iGateway v3.5) passed all tests in both directions with all other participants.

Juniper Networks NetScreen family (ScreenOS 6.1) passed all tests in both directions with all other participants.

McAfee UTM Firewall (version 4.0.4) passed all tests in both directions with all other participants.

Mocana Embedded IPsec/IKE (version 5.1) passed all tests in both directions with all other participants.

NETGEAR DG834 family (version 4.01) passed all tests in both directions with all other participants.

NETGEAR DG834Gv5 (version 6.00) passed all tests in both directions with all other participants.

NETGEAR FVG318 (version 2.1.2) passed all tests in both directions with all other participants.

NETGEAR FVL328 (version 1.4 Release 10) passed all tests in both directions with all other participants.

NETGEAR FVS124G (version 1.1.24) passed all tests in both directions with all other participants.

NETGEAR FVS318G (version 3.0.5-18) passed all tests in both directions with all other participants.

NETGEAR FVS318v3 (version 3.0_22) passed all tests in both directions with all other participants.

NETGEAR FVS328 (version 1.0.0) passed all tests in both directions with all other participants.

NETGEAR FVS336G (version 2.2) passed all tests in both directions with all other participants.

NETGEAR FVS336V2 (version 3.0.6) passed all tests in both directions with all other participants.

NETGEAR FVS338 (version 2.0.0) passed all tests in both directions with all other participants.

NETGEAR FVX538 (version 2.0.0) passed all tests in both directions with all other participants.

NETGEAR ProSafe VPN Client (version 10.1.1) passed all tests as initiator with all other participants. ProSafe Client was tested as a remote-access client, and therefore always initiated.

NETGEAR SRX5308 (version 3.0.6) passed all tests in both directions with all other participants.

NETGEAR UTM 5 (version 1.0) passed all tests in both directions with all other participants.

NETGEAR UTM 10 (version 1.0) passed all tests in both directions with all other participants.

NETGEAR UTM 25 (version 1.0) passed all tests in both directions with all other participants.

Nortel Contivity (version 04-80.124) passed all tests in both directions with all other participants.

Nortel Secure Router (version r9.2) passed all tests in both directions with all participants except for D-Link Broadband VPN Router Family.

phion netfence (version 4.0.4) passed all tests in both directions with all participants except the remote access clients. For those clients, netfence could not be configured to pass traffic in an IPsec tunnel using preshared secrets.

SafeNet QuickSec Toolkit (version 5.0) passed all tests in both directions with all other participants.

SafeNet SoftRemoteLT (version 10.1.1) passed all tests as initiator with all other participants. SafeNet was tested as a remote-access client, and therefore always initiated.

SonicWALL NSA and NSA E-Class series (version 5.0) passed all tests in both directions with all other participants.

SonicWALL TZ and PRO products running SonicOS Enhanced (version 3.2) passed all tests in both directions with all other participants.

Stonesoft StoneGate (version 5.1.1) passed all tests in both directions with all other participants.

TeamF1 V-IPSecure (version 1) passed all tests in both directions with all other participants.

WatchGuard Firebox X Core and Peak e-Series (version 10.0) passed all tests in both directions with all other participants.

Wind River IPIKE (version 6.7) passed all tests in both directions with all other participants.

The following are links to the files showing each pair of systems interoperating. Each file shows an expanded dump of the IKE messages setting up the secure IPsec tunnel. The information was collected with "tethereal", part of the excellent freeware "ethereal" network diagnostics package.

It is unlikely that this information is of much value to typical users; however, without it, you have no proof that the two systems actually were able to interoperate.