Re: Netscreen to Cisco client/server VPN?

The vpn client world is very unfortunate when we talk about IPSec 
and inter vendor interoperability: the 2 main "standards" in use
(mode config and xauth) suffers a lot of interop issues. Especially,
every vendor have implemented those features as vendor specific, using
private attributes or even working hard and on purpose to avoid interoperability
(for exemple Nortel use an unknown hash algorithm in their password based
authentication). When it comes down to try to get a mode config and xauth
client to work with the major gateways, it turns pretty fast to nightmares.

In your case, i would try to go with SSH sentinel as the vpn client and get
certificate based authentication on both boxes. Both gateway will support
the connection, however, xauth and modeconfig may or may not work. Both
vendor vpn clients will only work against their vendor equipement.

So, it can be done, but may be restricted road warrior features wise.

Hope this help,

J.

On Thu, Nov 20, 2003 at 01:16:04PM -0800, Jim Dueltgen wrote:
> Hi folks,
> 
> I'm currently slogging through the archives but I'm hoping someone 
> has a quick answer for me.  I've got a road warrior type user who 
> needs to connect (not simultaneously) from a Win2K laptop to both a 
> Cisco (3000 I believe) and NetScreen (5XP running the 4.x firmware) 
> VPN server.  He currently has the Cisco VPN client installed.  Since 
> the Cisco VPN Dialer and NetScreen Remote clients don't seem to play 
> nicely with each other when they're both installed I'm wondering if 
> anyone has had any success using either client (Cisco or NetScreen 
> Remote) to connect to both server types and if so if you have a 
> recipe or config examples to share.  I see lots of interoperability 
> testing for VPN server-to-server connections but I'm not finding any 
> relevant information about client-to-server interoperability.  Any 
> help, including, "It can't be done, you bonehead," would be 
> appreciated.
> 
> Regards,
> 
> Jim Dueltgen
> LMi.net
> _______________________________________________
> VPN mailing list
> [email protected]
> http://lists.shmoo.com/mailman/listinfo/vpn

-- 

-> Jean-Francois Dive
--> [email protected]

  I think that God in creating Man somewhat overestimated his ability.
  -- Oscar Wilde