Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm looking for a Windows 7 compatible IPSec VPN client that allows protocol and port specific rules as well as an aggressive mode.

On Windows XP and Vista we've used SafeNet SoftRemote in which you can set up rules for specific protocols and ports. But SoftRemote isn't compatible with Windows 7.

172.xxx.xxx.1 TCP 1433
172.xxx.xxx.2 TCP 1433
172.xxx.xxx.10 ALL
...

Since the VPN gateway is configured this way the client must mirror these settings.

I've tried TheGreenBow, NCP Secure Entry, Cisco VPN Client and Shrew Soft VPN but none of these allows you to configure by protocol and port.

Does anyone have any other suggestions?

UPDATE:
I've got some news...
I've managed to get SoftRemote to work on Windows 7 x64 through Windows XP Mode. After scouring all corners of the Internet for idéas I had enough information to construct a working solution.

This solution will probably benefit other clients as well!

You'll find a post here with detailed instructions of how I went about.

share|improve this question
add comment

5 Answers 5

up vote 7 down vote accepted
+50

I'm not sure if any of these meet your needs, but TechNet has a blog where they tested several clients for compatibility.

VPN Client Compatibility with Windows 7 and Windows Server 2008 R2

According to them a version for Windows 7 of SafeNet SoftRemote is due out in Q4 2009.

share|improve this answer
    
I've seen that source and no it's not SoftRemote that will be out in Q4 but rather QuickSec. There is no ETA on SoftRemote. While they tested serveral clients I haven't found a single Windows 7 IPSec client that meets my requirements. –  Sani Huttunen Jun 1 '09 at 17:07
    
@ CKret - Thanks for the correction. I was just taking a quick look at the site, and didn't catch that it was actually a different product from the same company. –  KevinH Jun 1 '09 at 17:38
add comment

(I can't comment yet, so I'm going to post to ask for clarification initially, then edit as necessary.)

If I understand, you're looking for a way to identify specific traffic flows (destination address / subnet, protocol, port combinations) that should be subjected to IPSEC encryption / authentication under Windows 7. Is that accurate?

The built-in ISPEC client in Windows 7 will allow you create IPSEC policies with "filters" that identify when traffic should be encrypted. Getting over the initial interop hurdle with your VPN gateway may be a bit tough, but this built-in functionality would allow you to subject only specific traffic flows to IPSEC encryption / authentication,

Open an "MMC.exe" instance and snap-in the "IP Security Policy Management" snap-in. Create an IPSEC policy and tool around in the settings for a bit. You can configure the IKE and main-mode encryption / authentication settings, as well as creating filter rules to define the types of traffic that will be encrypted / blocked, etc.

share|improve this answer
    
I seem to have forgotten to mention one important piece of information: I need aggressive mode which rules out the built-in IPSec in Windows 7. (If I understand it correctly that it doesn't support.) It is during Phase 2 negotiations the rules need to mirror the gateway rules. I.e. Protocol and port must match otherwise the gateway doesn't accept the connection You are right about the filters though –  Sani Huttunen Jun 2 '09 at 6:20
    
Yep-- as far as I can tell, Windows 7 continues the trend of not supporting aggressive mode. sigh –  Evan Anderson Jun 2 '09 at 13:00
add comment

Would the Cisco AnyConnect Client work?

http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/data_sheet_c78-527494.html

share|improve this answer
    
Unfortunately no since it's an SSL VPN client. –  Sani Huttunen May 27 '09 at 8:26
    
:( If you find an answer, make sure you post it, I'm just getting into VPN stuff and am about to attempt to set my Cisco PIX 501 up tonight. –  Gromer May 27 '09 at 20:44
    
I sure will. Might also put this up with a bounty if nothing comes up. –  Sani Huttunen May 27 '09 at 21:35
    
@Gromer - Just so you know, I don't believe that the AnyConnect client is supported on your PIX with version 8 code. –  GregD Jun 1 '09 at 14:04
add comment

The mobile VPN product from www.ipunplugged.com supports Win7 This is an IPSec mobile VPN based on Mobile IP... not just a VPN client.

share|improve this answer
add comment

you may want to take a look at strongswan. I believe they have a version for windows 7.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.