up vote 5 down vote favorite
2
share [g+] share [fb]

I'm looking for a Windows 7 compatible IPSec VPN client that allows protocol and port specific rules as well as an aggressive mode.

On Windows XP and Vista we've used SafeNet SoftRemote in which you can set up rules for specific protocols and ports. But SoftRemote isn't compatible with Windows 7.

172.xxx.xxx.1 TCP 1433
172.xxx.xxx.2 TCP 1433
172.xxx.xxx.10 ALL
...

Since the VPN gateway is configured this way the client must mirror these settings.

I've tried TheGreenBow, NCP Secure Entry, Cisco VPN Client and Shrew Soft VPN but none of these allows you to configure by protocol and port.

Does anyone have any other suggestions?

link|improve this question
feedback

6 Answers

up vote 7 down vote accepted
+50

I'm not sure if any of these meet your needs, but TechNet has a blog where they tested several clients for compatibility.

VPN Client Compatibility with Windows 7 and Windows Server 2008 R2

According to them a version for Windows 7 of SafeNet SoftRemote is due out in Q4 2009.

link|improve this answer
I've seen that source and no it's not SoftRemote that will be out in Q4 but rather QuickSec. There is no ETA on SoftRemote. While they tested serveral clients I haven't found a single Windows 7 IPSec client that meets my requirements. – Sani Huttunen Jun 1 '09 at 17:07
@ CKret - Thanks for the correction. I was just taking a quick look at the site, and didn't catch that it was actually a different product from the same company. – KevinH Jun 1 '09 at 17:38
feedback
up vote 1 down vote

(I can't comment yet, so I'm going to post to ask for clarification initially, then edit as necessary.)

If I understand, you're looking for a way to identify specific traffic flows (destination address / subnet, protocol, port combinations) that should be subjected to IPSEC encryption / authentication under Windows 7. Is that accurate?

The built-in ISPEC client in Windows 7 will allow you create IPSEC policies with "filters" that identify when traffic should be encrypted. Getting over the initial interop hurdle with your VPN gateway may be a bit tough, but this built-in functionality would allow you to subject only specific traffic flows to IPSEC encryption / authentication,

Open an "MMC.exe" instance and snap-in the "IP Security Policy Management" snap-in. Create an IPSEC policy and tool around in the settings for a bit. You can configure the IKE and main-mode encryption / authentication settings, as well as creating filter rules to define the types of traffic that will be encrypted / blocked, etc.

link|improve this answer
I seem to have forgotten to mention one important piece of information: I need aggressive mode which rules out the built-in IPSec in Windows 7. (If I understand it correctly that it doesn't support.) It is during Phase 2 negotiations the rules need to mirror the gateway rules. I.e. Protocol and port must match otherwise the gateway doesn't accept the connection You are right about the filters though – Sani Huttunen Jun 2 '09 at 6:20
Yep-- as far as I can tell, Windows 7 continues the trend of not supporting aggressive mode. sigh – Evan Anderson Jun 2 '09 at 13:00
feedback
up vote 0 down vote

Would the Cisco AnyConnect Client work?

http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/data_sheet_c78-527494.html

link|improve this answer
Unfortunately no since it's an SSL VPN client. – Sani Huttunen May 27 '09 at 8:26
:( If you find an answer, make sure you post it, I'm just getting into VPN stuff and am about to attempt to set my Cisco PIX 501 up tonight. – Gromer May 27 '09 at 20:44
I sure will. Might also put this up with a bounty if nothing comes up. – Sani Huttunen May 27 '09 at 21:35
@Gromer - Just so you know, I don't believe that the AnyConnect client is supported on your PIX with version 8 code. – GregD Jun 1 '09 at 14:04
feedback
up vote 0 down vote

Don't know if it meets the needs, but NCP client is good, and they have a beta which is Win7 compatible.... www.ncp-e.com

link|improve this answer
I've already tried NCP (as mentioned in the question) and unfortunately no, it does not meet the requirements. – Sani Huttunen Jul 8 '09 at 8:32
feedback
up vote 0 down vote

The mobile VPN product from www.ipunplugged.com supports Win7 This is an IPSec mobile VPN based on Mobile IP... not just a VPN client.

link|improve this answer
feedback
up vote 0 down vote

you may want to take a look at strongswan. I believe they have a version for windows 7.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.