<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br><div><div>Am 02.01.2014 um 14:29 schrieb L. Aaron Kaplan <<a href="mailto:kaplan@cert.at">kaplan@cert.at</a>>:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span style="font-family: Monaco; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;">Okay, so I guess also for remote access , we might see a lot of compatibility issues with different clients?</span><br style="font-family: Monaco; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"></blockquote></div><br><div>with remote-access there comes extra trouble:</div><div><br></div><div>The EOL-announced Cisco VPN-client is still often in use but only supports DH-Group2 by default. There are workarounds possible, but they need a modification on the client. And I think the same way the document doesn't really take care of Windows XP it shouldn't really take care about legacy clients.</div><div><br></div><div>The much more modern AnyConnect client is not widely used yet with routers as additional licenses are needed which are quite expensive. So for remote-access, using the ASA is the most common scenario.</div><div><br></div><div>Nevertheless a Remote-Access section for the AnyConnect crypto on IOS should be included. But that again needs two sections, one for SSL/TLS and one for IKEv2. But the IKEv2-section will look quite similar to the one used for site-to-site. I'll look into that.</div><div><br></div><div><br></div><div>regards, Karsten</div><div><br></div></body></html>