VPNC Basic Interoperability Test

VPNC interop logo

The Basic Interoperability test assures VPN users that IPsec systems are generally interoperable with other IPsec systems. To pass, a system has to interoperate with at least three quarters of the other systems that are in the test.

Every system in the test is tested against every other system. Most pairs of systems are tested twice, switching the roles of initiator and responder. For two systems to be considered interoperable, they each must be able to be initiator or responder. An exception to this rule is that systems that are typically used as remote-access VPN clients are always tested as the initiator because that is how they are almost always deployed by VPN users. If a pair of systems fails a test, it is noted whether or not an IPsec tunnel could be created with one of the systems acting as the initiator, or whether no tunnel could ever be set up.

The Basic Interoperability Test mirrors typical use of IPsec systems in VPNs. A gateway system protects a network of systems behind the gateway; a remote-access client protects either just the single system on which it is running, or a pseudo-network of addresses that refer to the single system.

As specified in the VPNC documentation profile, in IKE Phase 1, each system uses TripleDES, SHA-1, MODP group 2 (1024-bit), and a pre-shared secret of "hr5xb84l6aa9r6". In IKE Phase 2, each system uses TripleDES, SHA-1, ESP tunnel mode, and PFS with MODP group 2 (1024 bits).

The following are the results from the testing, including notes that might affect users checking the results on their own.

INSIDE Secure QuickSec Toolkit (version 5.0) passed all tests in both directions with all other participants.

INSIDE Secure SoftRemoteLT (version 10.1.1) passed all tests as initiator with all other participants. INSIDE Secure was tested as a remote-access client, and therefore always initiated.

Barracuda NG Firewall (version 5.2.3) passed all tests in both directions with all participants except the remote access clients. For those clients, Barracuda NG Firewall could not be configured to pass traffic in an IPsec tunnel using preshared secrets.

Certicom Security Builder IPSec (version 3.2.5) passed all tests as initiator with all other participants. Security Builder IPSec was tested as a remote-access client, and therefore always initiated.

Cisco ASA Family (version 8.4.1.10) passed all tests in both directions with all other participants.

Cisco IOS IPsec (version 15.1(2)T2) passed all tests in both directions with all other participants.

Cisco Linksys RV082 (version 1.3.2) passed all tests in both directions with all other participants.

Cisco MDS 9000 Family (version 2.0(1B)) passed all tests in both directions with all other participants.

Cisco VPN 3000 Concentrator (version 4.0.1.Rel May 06 2003) passed all tests in both directions with all other participants.

Cyberoam CR series (version 9.5.9.41) passed all tests in both directions with all other participants.

D-Link Broadband VPN Router Family (version 1.4) passed all tests in both directions with all other participants.

D-Link Unified Services Router DSR-500/500N/1000/1000N Family (version 1.0) passed all tests in both directions with all other participants.

D-Link Unified Services Router DSR-150/150N/250/250N (version 1.0) passed all tests in both directions with all other participants.

D-Link NetDefend DFL-200/700/1100 Firewall Family (version 1.2.0) passed all tests in both directions with all other participants.

D-Link NetDefend DIR-130 Firewall Family (version 1.10) passed all tests in both directions with all other participants.

D-Link NetDefend DIR-140L/640L/840L Firewall Family (version 1.0) passed all tests in both directions with all other participants.

D-Link NetDefend DIR-330 Firewall Family (version 1.10) passed all tests in both directions with all other participants.

D-Link NetDefend DFL-800/1600/2500 Firewall Family (version 2.03) passed all tests in both directions with all other participants.

D-Link NetDefend UTM DFL-260E/860E/1660/2560/2560G Firewall Family (version 2.12) passed all tests in both directions with all other participants.

D-Link NetDefend VPN Client (version 1.0) passed all tests as initiator with all other participants. NetDefend Client was tested as a remote-access client, and therefore always initiated.

Encore BANDIT family (version 15535.0313) passed all tests in both directions with all other participants.

Juniper Networks NetScreen family (ScreenOS 6.1) passed all tests in both directions with all other participants.

Mocana NanoSec (version 5.5) passed all tests in both directions with all other participants.

NETGEAR DG834 family (version 4.01) passed all tests in both directions with all other participants.

NETGEAR DG834Gv5 (version 6.00) passed all tests in both directions with all other participants.

NETGEAR FVG318 (version 2.1.2) passed all tests in both directions with all other participants.

NETGEAR FVL328 (version 1.4 Release 10) passed all tests in both directions with all other participants.

NETGEAR FVS124G (version 1.1.24) passed all tests in both directions with all other participants.

NETGEAR FVS318G (version 3.0.5-18) passed all tests in both directions with all other participants.

NETGEAR FVS318N (version 4.0.1) passed all tests in both directions with all other participants.

NETGEAR FVS318v3 (version 3.0_22) passed all tests in both directions with all other participants.

NETGEAR FVS328 (version 1.0.0) passed all tests in both directions with all other participants.

NETGEAR FVS336G (version 2.2) passed all tests in both directions with all other participants.

NETGEAR FVS336V2 (version 3.0.6) passed all tests in both directions with all other participants.

NETGEAR FVS338 (version 2.0.0) passed all tests in both directions with all other participants.

NETGEAR FVX538 (version 2.0.0) passed all tests in both directions with all other participants.

NETGEAR ProSafe VPN Client (version 10.1.1) passed all tests as initiator with all other participants. ProSafe Client was tested as a remote-access client, and therefore always initiated.

NETGEAR SRX5308 (version 3.0.6) passed all tests in both directions with all other participants.

NETGEAR UTM 5 (version 1.0) passed all tests in both directions with all other participants.

NETGEAR UTM9S (version 2.0.9) passed all tests in both directions with all other participants.

NETGEAR UTM 10 (version 1.0) passed all tests in both directions with all other participants.

NETGEAR UTM 25 (version 1.0) passed all tests in both directions with all other participants.

NETGEAR UTM 50 (version 1.1) passed all tests in both directions with all other participants.

NETGEAR UTM 150 (version 1.3.7) passed all tests in both directions with all other participants.

SonicWALL NSA and NSA E-Class series (version 5.0) passed all tests in both directions with all other participants.

SonicWALL TZ and PRO products running SonicOS Enhanced (version 5.3) passed all tests in both directions with all other participants.

Stonesoft StoneGate (version 5.3.1) passed all tests in both directions with all other participants.

TeamF1 V-IPSecure (version 1) passed all tests in both directions with all other participants.

Wind River IPIKE (version 6.9) passed all tests in both directions with all other participants.

ZyXEL SBG3300 Series (version 1.0) passed all tests in both directions with all other participants.

ZyXEL VFG6005 Series (version 2.04) passed all tests in both directions with all other participants.

The following are links to the files showing each pair of systems interoperating. Each file shows an expanded dump of the IKE messages setting up the secure IPsec tunnel. The information was collected with "tethereal", part of the excellent freeware "ethereal" network diagnostics package.

It is unlikely that this information is of much value to typical users; however, without it, you have no proof that the two systems actually were able to interoperate.

INSIDE Secure SoftRemoteLT initiating to:
          INSIDE Secure QuickSec toolkit
          Barracuda NG Firewall
          Cisco ASA Family
          Cisco IOS IPsec
          Cisco Linksys RV082
          Cisco MDS 9000 Family
          Cyberoam CR series
          D-Link Broadband VPN Router Family
          D-Link DSR-150/150N/250/250N
          D-Link NetDefend DFL-200/700/1100 Firewall Family
          D-Link NetDefend DFL-210/800/1600/2500 Firewall Family
          D-Link NetDefend DIR-140L/640L/840L Firewall Family
          D-Link NetDefend UTM DFL-260E/860E/1660/2560/2560G Firewall Family
          D-Link Unified Services Router DSR-500/500N/1000/1000N Family
          Encore BANDIT family
          Juniper Networks NetScreen family
          Mocana NanoSec
          NetDefend DIR-130
          NetDefend DIR-330
          NETGEAR DG834 family
          NETGEAR DG834GV5
          NETGEAR FVG318
          NETGEAR FVL328
          NETGEAR FVS124G
          NETGEAR FVS318G
          NETGEAR FVS318N
          NETGEAR FVS318v3
          NETGEAR FVS328
          NETGEAR FVS336G
          NETGEAR FVS336V2
          NETGEAR FVS338
          NETGEAR FVX538
          NETGEAR SRX5308
          NETGEAR UTM 10
          NETGEAR UTM 150
          NETGEAR UTM 25
          NETGEAR UTM 5
          NETGEAR UTM 50
          NETGEAR UTM9S
          SonicWALL NSA and NSA E-Class series
          SonicWALL TZ and PRO products running SonicOS Enhanced
          Stonesoft StoneGate
          TeamF1 V-IPSecure
          Windriver IPIKE
          ZyXEL SBG3300 Series
          ZyXEL VFG6005 Series

Certicom Security Builder IPSec initiating to:
          INSIDE Secure QuickSec toolkit
          Barracuda NG Firewall
          Cisco ASA Family
          Cisco IOS IPsec
          Cisco Linksys RV082
          Cisco MDS 9000 Family
          Cyberoam CR series
          D-Link Broadband VPN Router Family
          D-Link DSR-150/150N/250/250N
          D-Link NetDefend DFL-200/700/1100 Firewall Family
          D-Link NetDefend DFL-210/800/1600/2500 Firewall Family
          D-Link NetDefend DIR-140L/640L/840L Firewall Family
          D-Link NetDefend UTM DFL-260E/860E/1660/2560/2560G Firewall Family
          D-Link Unified Services Router DSR-500/500N/1000/1000N Family
          Encore BANDIT family
          Juniper Networks NetScreen family
          Mocana NanoSec
          NetDefend DIR-130
          NetDefend DIR-330
          NETGEAR DG834 family
          NETGEAR DG834GV5
          NETGEAR FVG318
          NETGEAR FVL328
          NETGEAR FVS124G
          NETGEAR FVS318G
          NETGEAR FVS318N
          NETGEAR FVS318v3
          NETGEAR FVS328
          NETGEAR FVS336G
          NETGEAR FVS336V2
          NETGEAR FVS338
          NETGEAR FVX538
          NETGEAR SRX5308
          NETGEAR UTM 10
          NETGEAR UTM 150
          NETGEAR UTM 25
          NETGEAR UTM 5
          NETGEAR UTM 50
          NETGEAR UTM9S
          SonicWALL NSA and NSA E-Class series
          SonicWALL TZ and PRO products running SonicOS Enhanced
          Stonesoft StoneGate
          TeamF1 V-IPSecure
          Windriver IPIKE
          ZyXEL SBG3300 Series
          ZyXEL VFG6005 Series

NETGEAR FVS318v3 initiating to:
          INSIDE Secure QuickSec toolkit
          Barracuda NG Firewall
          Cisco ASA Family
          Cisco IOS IPsec
          Cisco Linksys RV082
          Cisco MDS 9000 Family
          Cyberoam CR series
          D-Link Broadband VPN Router Family
          D-Link DSR-150/150N/250/250N
          D-Link NetDefend DFL-200/700/1100 Firewall Family
          D-Link NetDefend DFL-210/800/1600/2500 Firewall Family
          D-Link NetDefend DIR-140L/640L/840L Firewall Family
          D-Link NetDefend UTM DFL-260E/860E/1660/2560/2560G Firewall Family
          D-Link Unified Services Router DSR-500/500N/1000/1000N Family
          Encore BANDIT family
          Juniper Networks NetScreen family
          Mocana NanoSec
          NetDefend DIR-130
          NetDefend DIR-330
          NETGEAR DG834 family
          NETGEAR DG834GV5
          NETGEAR FVG318
          NETGEAR FVL328
          NETGEAR FVS124G
          NETGEAR FVS318G
          NETGEAR FVS318N
          NETGEAR FVS328
          NETGEAR FVS336G
          NETGEAR FVS336V2
          NETGEAR FVS338
          NETGEAR FVX538
          NETGEAR SRX5308
          NETGEAR UTM 10
          NETGEAR UTM 150
          NETGEAR UTM 25
          NETGEAR UTM 5
          NETGEAR UTM 50
          NETGEAR UTM9S
          SonicWALL NSA and NSA E-Class series
          SonicWALL TZ and PRO products running SonicOS Enhanced
          Stonesoft StoneGate
          TeamF1 V-IPSecure
          Windriver IPIKE
          ZyXEL SBG3300 Series
          ZyXEL VFG6005 Series

NETGEAR FVS336V2 initiating to:
          INSIDE Secure QuickSec toolkit
          Barracuda NG Firewall
          Cisco ASA Family
          Cisco IOS IPsec
          Cisco Linksys RV082
          Cisco MDS 9000 Family
          Cyberoam CR series
          D-Link Broadband VPN Router Family
          D-Link DSR-150/150N/250/250N
          D-Link NetDefend DFL-200/700/1100 Firewall Family
          D-Link NetDefend DFL-210/800/1600/2500 Firewall Family
          D-Link NetDefend DIR-140L/640L/840L Firewall Family
          D-Link NetDefend UTM DFL-260E/860E/1660/2560/2560G Firewall Family
          D-Link Unified Services Router DSR-500/500N/1000/1000N Family
          Encore BANDIT family
          Juniper Networks NetScreen family
          Mocana NanoSec
          NetDefend DIR-130
          NetDefend DIR-330
          NETGEAR DG834 family
          NETGEAR DG834GV5
          NETGEAR FVG318
          NETGEAR FVL328
          NETGEAR FVS124G
          NETGEAR FVS318G
          NETGEAR FVS318N
          NETGEAR FVS318v3
          NETGEAR FVS328
          NETGEAR FVS336G
          NETGEAR FVS338
          NETGEAR FVX538
          NETGEAR SRX5308
          NETGEAR UTM 10
          NETGEAR UTM 150
          NETGEAR UTM 25
          NETGEAR UTM 5
          NETGEAR UTM 50
          NETGEAR UTM9S
          SonicWALL NSA and NSA E-Class series
          SonicWALL TZ and PRO products running SonicOS Enhanced
          Stonesoft StoneGate
          TeamF1 V-IPSecure
          Windriver IPIKE
          ZyXEL SBG3300 Series
          ZyXEL VFG6005 Series

NETGEAR ProSafe VPN Client initiating to:
          INSIDE Secure QuickSec toolkit
          Barracuda NG Firewall
          Cisco ASA Family
          Cisco IOS IPsec
          Cisco Linksys RV082
          Cisco MDS 9000 Family
          Cyberoam CR series
          D-Link Broadband VPN Router Family
          D-Link DSR-150/150N/250/250N
          D-Link NetDefend DFL-200/700/1100 Firewall Family
          D-Link NetDefend DFL-210/800/1600/2500 Firewall Family
          D-Link NetDefend DIR-140L/640L/840L Firewall Family
          D-Link NetDefend UTM DFL-260E/860E/1660/2560/2560G Firewall Family
          D-Link Unified Services Router DSR-500/500N/1000/1000N Family
          Encore BANDIT family
          Juniper Networks NetScreen family
          Mocana NanoSec
          NetDefend DIR-130
          NetDefend DIR-330
          NETGEAR DG834 family
          NETGEAR DG834GV5
          NETGEAR FVG318
          NETGEAR FVL328
          NETGEAR FVS124G
          NETGEAR FVS318G
          NETGEAR FVS318N
          NETGEAR FVS318v3
          NETGEAR FVS328
          NETGEAR FVS336G
          NETGEAR FVS336V2
          NETGEAR FVS338
          NETGEAR FVX538
          NETGEAR SRX5308
          NETGEAR UTM 10
          NETGEAR UTM 150
          NETGEAR UTM 25
          NETGEAR UTM 5
          NETGEAR UTM 50
          NETGEAR UTM9S
          SonicWALL NSA and NSA E-Class series
          SonicWALL TZ and PRO products running SonicOS Enhanced
          Stonesoft StoneGate
          TeamF1 V-IPSecure
          Windriver IPIKE
          ZyXEL SBG3300 Series
          ZyXEL VFG6005 Series

NETGEAR UTM 5 initiating to:
          INSIDE Secure QuickSec toolkit
          Barracuda NG Firewall
          Cisco ASA Family
          Cisco IOS IPsec
          Cisco Linksys RV082
          Cisco MDS 9000 Family
          Cyberoam CR series
          D-Link Broadband VPN Router Family
          D-Link DSR-150/150N/250/250N
          D-Link NetDefend DFL-200/700/1100 Firewall Family
          D-Link NetDefend DFL-210/800/1600/2500 Firewall Family
          D-Link NetDefend DIR-140L/640L/840L Firewall Family
          D-Link NetDefend UTM DFL-260E/860E/1660/2560/2560G Firewall Family
          D-Link Unified Services Router DSR-500/500N/1000/1000N Family
          Encore BANDIT family
          Juniper Networks NetScreen family
          Mocana NanoSec
          NetDefend DIR-130
          NetDefend DIR-330
          NETGEAR DG834 family
          NETGEAR DG834GV5
          NETGEAR FVG318
          NETGEAR FVL328
          NETGEAR FVS124G
          NETGEAR FVS318G
          NETGEAR FVS318N
          NETGEAR FVS318v3
          NETGEAR FVS328
          NETGEAR FVS336G
          NETGEAR FVS336V2
          NETGEAR FVS338
          NETGEAR FVX538
          NETGEAR SRX5308
          NETGEAR UTM 10
          NETGEAR UTM 150
          NETGEAR UTM 25
          NETGEAR UTM 50
          NETGEAR UTM9S
          SonicWALL NSA and NSA E-Class series
          SonicWALL TZ and PRO products running SonicOS Enhanced
          Stonesoft StoneGate
          TeamF1 V-IPSecure
          Windriver IPIKE
          ZyXEL SBG3300 Series
          ZyXEL VFG6005 Series

NETGEAR UTM9S initiating to:
          INSIDE Secure QuickSec toolkit
          Barracuda NG Firewall
          Cisco ASA Family
          Cisco IOS IPsec
          Cisco Linksys RV082
          Cisco MDS 9000 Family
          Cyberoam CR series
          D-Link Broadband VPN Router Family
          D-Link DSR-150/150N/250/250N
          D-Link NetDefend DFL-200/700/1100 Firewall Family
          D-Link NetDefend DFL-210/800/1600/2500 Firewall Family
          D-Link NetDefend DIR-140L/640L/840L Firewall Family
          D-Link NetDefend UTM DFL-260E/860E/1660/2560/2560G Firewall Family
          D-Link Unified Services Router DSR-500/500N/1000/1000N Family
          Encore BANDIT family
          Juniper Networks NetScreen family
          Mocana NanoSec
          NetDefend DIR-130
          NetDefend DIR-330
          NETGEAR DG834 family
          NETGEAR DG834GV5
          NETGEAR FVG318
          NETGEAR FVL328
          NETGEAR FVS124G
          NETGEAR FVS318G
          NETGEAR FVS318N
          NETGEAR FVS318v3
          NETGEAR FVS328
          NETGEAR FVS336G
          NETGEAR FVS336V2
          NETGEAR FVS338
          NETGEAR FVX538
          NETGEAR SRX5308
          NETGEAR UTM 10
          NETGEAR UTM 150
          NETGEAR UTM 25
          NETGEAR UTM 5
          NETGEAR UTM 50
          SonicWALL NSA and NSA E-Class series
          SonicWALL TZ and PRO products running SonicOS Enhanced
          Stonesoft StoneGate
          TeamF1 V-IPSecure
          Windriver IPIKE
          ZyXEL SBG3300 Series
          ZyXEL VFG6005 Series

SonicWALL NSA and NSA E-Class series initiating to:
          INSIDE Secure QuickSec toolkit
          Barracuda NG Firewall
          Cisco ASA Family
          Cisco IOS IPsec
          Cisco Linksys RV082
          Cisco MDS 9000 Family
          Cyberoam CR series
          D-Link Broadband VPN Router Family
          D-Link DSR-150/150N/250/250N
          D-Link NetDefend DFL-200/700/1100 Firewall Family
          D-Link NetDefend DFL-210/800/1600/2500 Firewall Family
          D-Link NetDefend DIR-140L/640L/840L Firewall Family
          D-Link NetDefend UTM DFL-260E/860E/1660/2560/2560G Firewall Family
          D-Link Unified Services Router DSR-500/500N/1000/1000N Family
          Encore BANDIT family
          Juniper Networks NetScreen family
          Mocana NanoSec
          NetDefend DIR-130
          NetDefend DIR-330
          NETGEAR DG834 family
          NETGEAR DG834GV5
          NETGEAR FVG318
          NETGEAR FVL328
          NETGEAR FVS124G
          NETGEAR FVS318G
          NETGEAR FVS318N
          NETGEAR FVS318v3
          NETGEAR FVS328
          NETGEAR FVS336G
          NETGEAR FVS336V2
          NETGEAR FVS338
          NETGEAR FVX538
          NETGEAR SRX5308
          NETGEAR UTM 10
          NETGEAR UTM 150
          NETGEAR UTM 25
          NETGEAR UTM 5
          NETGEAR UTM 50
          NETGEAR UTM9S
          SonicWALL TZ and PRO products running SonicOS Enhanced
          Stonesoft StoneGate
          TeamF1 V-IPSecure
          Windriver IPIKE
          ZyXEL SBG3300 Series
          ZyXEL VFG6005 Series

If you have comments or questions about VPNC's testing, please feel free to send them to Paul Hoffman, VPNC's director, at paul.hoffman@vpnc.org.