VPN Client 3.5 feature - IPSec over TCP

[raymng]

Hi there,

We have been using VPN client 3.1. What is the difference (advantages and disadvantages) between "IPSec over UDP" and "IPSec over TCP"?

Thanks.

[gmiiller]

Depending on where your clients are located, the TCP option is usually simpler and more palatable if your clients are going to be situated behind a firewall. We do this through a number of stateful inspection firewalls with NAT/PAT etc, as well as some proxying firewalls (with a few limitations)

[fmadar]

I was unable to use Ipsec/UDP or TCP going through a MS Proxy to a VPN3005. I can authenticate the group and user but after that the client hangs on. Could you do that? thanks.

[paqiu]

You can not do IPSE over UDP or TCP through MS proxy server.

Because MS proxy is not PAT/NAT, it is using application layer proxy service.

When we are doing IPSEC over UDP or TCP, we re-encapsulate the IPSEC packet into a new UDP or TCP packet, using UDP or TCP port 10000 ( can be changed to anything else).

This is reason why IPSEC/UDP or TCP can pass Microsoft internet connection share (ICS) but not proxy service.

Because ICS is PAT but MS proxy is another story.