I am trying to replace a Cisco router with a GNU Debian/Linux router. This Cisco router terminates a VPN connection that was setup using VTI. Could someone please help me what software and configuration to use on Debian?

This is a summary from the working configuration on the Cisco router. I have replaced some sensible parts with text in angle brackets. I have no control over the other end of the IPSEC tunnel:

crypto pki trustpoint TP-self-signed-<keyid>
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-<keyid>
 revocation-check none
 rsakeypair TP-self-signed-<keyid>
no ip subnet-zero
no ip source-route
ip auth-proxy max-nodata-conns 3
ip admission source-interface Vlan1
ip admission max-nodata-conns 3
crypto isakmp policy 1
 encr 3des
 authentication pre-share
 group 2
crypto isakmp key <password> address <remote public IP>
crypto ipsec transform-set <xform name> esp-3des esp-sha-hmac
crypto ipsec profile <profile name>
 set transform-set <xform name>
interface Tunnel98
 ip address <local private tunnel IP>
 no ip redirects
 ip mtu 1400
 ip tcp adjust-mss 1360
 tunnel source Dialer1
 tunnel destination <remote public IP>
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile <profile name>
interface Vlan1
 ip address <local private IP>
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat inside
 ip virtual-reassembly
interface Dialer1
 ip address negotiated
 ip access-group to-internet out
 ip mtu 1492
 ip nat outside
 ip virtual-reassembly
 encapsulation ppp
 dialer pool 1
 dialer-group 1
 no cdp enable
 ppp authentication pap callin
 ppp pap sent-username <ppp username> password 7 <ppp password>
 ppp ipcp dns request
 ppp ipcp route default
no ip forward-protocol nd
ip route Dialer1
ip route 10.<remote private subnet 1>.0.0 <remote private tunnel IP> name <remote net 1 description>
ip route 10.<remote private subnet 2>.0.0 <remote private tunnel IP> name <remote net 2 description>
ip nat inside source list natacl interface Dialer1 overload
ip access-list standard natacl
 permit <local private net>
ip access-list extended to-internet
 deny   ip any
 deny   ip any
 deny   ip any
 permit ip any any
dialer-list 1 protocol ip permit
no cdp run

Thanks for your insights in advance!

2 Answers 2


VTI support has just been added to Linux. 3.6 Kernel



To terminate an IPsec VPN you probably want to look at Openswan or strongSwan.

The Openswan wiki has an entry on interoperability with Cisco:

  • http://wiki.openswan.org/index.php/Interop/InteroperatingCisco

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy