What has not been mentioned in this dialogue to this point is that the router performance capabilities using the Cisco VPN Client can be a factor of 5 . The 871 will support 10 VPN tunnels. It will support only 2 SSL VPN tunnels. The 1800 supports 50 IPsec or 25 SSL. The relationship carries through the entire product line.

We have a fully-functional, multi-point VPN architecture deployed and in use by well over 1000 support staff. How could how incurring the costs of design, licensing, hardware, deployment, support and maintenance be justified?

To make the situation worse, Cisco has not been open with their plans despite two years of asking about 64 bit windows support in the existing VPN client. Our parent company already wanted us to dump the Cisco solution. Unfortunately, I’m out of good answers as to why we should not just do so. Cisco had gotten pretty good about sufficient end-of-life announcements. They really blew this one though.

The irony is that Cisco had one of the most flexible IPSEC implementations available but they apparently are going to abandon it to become a 3rd rate SSL VPN vendor.

See: http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6635/ps7180/prod_brochure09186a00801f0a72.html

So since when does it make sense for a company to sink all that money into developing a client that not only are they not getting paid to develop but also losing even more money in the support of the client that they keep doing development work on?

But on a more important note, not all is lost for the IPSec client, we have posted a BETA Cisco VPN Client “IPSec” for Windows 7, Version 5.0.06.0100 can now be gotten from cisco.com.

If you have any problems, email cvc-beta(at)cisco(dot)com and let us know.

IPSec support in Anyconnect has not been needed when there has been a perfectly functional IPSec client available. IPSec isn’t just going to disappear and Cisco engineers and TME’s aren’t stupid. *cough*

YES, there is cause for both IPSec and SSL to coexist. For IPSec use, you need central policy control / management / NAC ‘patdowns’ over ALL clients, including 64-bit VPN clients. With Cisco out of the picture, the market is free for focused and mature providers to step in, like Andrew mentioned, NCP is the one I am familiar with. More info here:

http://vpnhaus.wordpress.com/

I find the no client SSL VPN to be worthless. It only suits certain specific software, its painful to configure and even worse to train staff so they know how to support it. Using ACS to set the parameters is a complete nightmare.

IPSec is simple to use, has limited choices which makes it easy to support. It used very widely and worth keeping.

(Yes, I know the answer is: Because the competition is charging for it, so can we. It’s a rhetorical question.)

I want choice or, at least, an explanation. Why should we not use IPSec when it has worked so well for the last five years ?

http://www.shrew.net/software

Shrew has supports for windows, linux and BSD

There is no need to buy NCP VPN client or TheGreenBow VPN client.

http://www.ncp-e.com/en/solutions/vpn-products/secure-entry-client.html