Subject: [Ipsec] Racoon or Pluto

From: "Philip Bellino" <[email-masked]>
Date: Wed, 2 May 2007 08:52:45 -0400

Hello,
I am new to the list, so please forgive me if I should direct it to
another group.

Running Linux 2.6.19 on both client and host machines.

I can accomplish IPsec using the manual method, but now want to take
advantage of IKE.

I see that there are 2 daemons out there to use, Racoon and Pluto.

Which one does the group recommend?

Thanks,
Phil Bellino

============================ 
Phil Bellino 
MRV Communications, Inc. 
Boston Product Division 
295 Foster St. 
Littleton,MA 01460 
Tel: (978)952-4807 
Email: [email-masked] 
============================ 

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: VANHULLEBUS Yvan <[email-masked]>
Date: Wed, 2 May 2007 15:01:21 +0200

> Hello,

Hi.

> I see that there are 2 daemons out there to use, Racoon and Pluto.

Linux 2.6;x kernels use by default the "new" Linux IPSec stack, which
is designed to work with racoon.

Pluto is the IKE daemon designed to work with *SWAN stack, which was
the IPSec stack for older kernels, and which is still available for
new kernels.

> Which one does the group recommend?

Well, I'll recommand you to use racoon, but I'm one of the
developpers, so I am probably partial :-)

Start by checking if both daemons have all the features you want.

Yvan.

-- 
NETASQ
http://www.netasq.com

---

From: Martin Willi <[email-masked]>
Date: Wed, 02 May 2007 15:24:34 +0200

Hi,

> the IPSec stack for older kernels, and which is still available for
Pluto was designed for the KLIPS (*SWAN) stack, but newer versions also
work on the native linux IPsec stack (netkey) using the XFRM interface.

> developpers, so I am probably partial :-)
I would recommend strongSwan, but I'm a dev of that project ;-).

strongSwan uses Pluto for IKEv1 key exchanges and a newer daemon called
Charon for IKEv2 exchanges. We are using linux' native IPsec stack only
(no kernel patching anymore).

Regards
Martin