Questions[ipsec](server)

I can't seem to get a straight answer to this quesion. Wikipedia says "IPsec is an integral part of the base protocol suite in IPv6," but does that mean that ALL communications are always encrypted, or does it mean that encryption is optional, but devices must be able to understand it (should it be used)?

If encryption is optional, is it the operating system that decides whether to use encryption, or is it the application? Do popular operating systems and software generally enable encryption?

I would investigate this myself, but I lack IPv6 connectivity.

Update: Ok, so it's optional. My follow-up question: typically, is it the application that defines whether to use encryption, or is it the operating system?

A specific example: Imagine I have a recent version of Windows with native ipv6 support, and I search for something on ipv6.google.com using Mozilla Firefox. Would it be encrypted?

I'm having trouble finding concrete, up-to-date information for how to set up strongswan or openswan to be used by the iphone's VPN client. My server is behind a budget linksys NAT router.

I found this, but it mentions a whole bunch of .pem files with no reference for how to create them. Unfortunately, the "fine" manuals for both packages were quite inscrutable and unfriendly to a novice. I've set up OpenVPN before and managed to get serviceable results very quickly, but after a day and a half of reading out of date docs, I barely even know where to start.

Any help would be greatly appreciated!

Interestingly I have not found any good search results when searching for "OpenVPN vs IPsec". So here's my question:

I need to set up a private LAN over an untrusted network. And as far as I know, both approaches seem to be valid. But I do not know which one is better.

I would be very thankful if you can list the pros and cons of both approaches and maybe your suggestions and experiences regarding what to use.

Update (Regarding the comment/question):

In my concrete case, the goal is to have any number of servers (with static IPs) connected transparently to each other. But a small portion of dynamic clients like "road warriors" (with dynamic IPs) should also be able to connect. The main goal is however having a "transparent secure network" run on top of the untrusted network. I am quite a newbie so I do not know how to correctly interpret "1:1 Point to Point Connections" => The solution should support broadcasts and all that stuff so it is a fully functional network.

What are the differences between OpenSwan and StrongSwan? All I found is this comparison between the outdated FreeSwan and testing version of OpenSwan - i.e. current stable of OpenSwan is 2.6 (3.0 in comparison) and current stable for StrongSwan is 4.4 (4.1.7 in comparison) which seems grossly unfair (there is no point in comparing Windows 98 with Ubuntu 10.10 or Mac OS X 10.7 with Slackware 8.0).

After reading some websites, StrongSwan seems to be better maintained while OpenSwan seems to be more popular.

Cisco VPN client (IPsec) does not support 64bit Windows.

Worse, Cisco does not even plan to release a 64-bit version, instead they say that
"For x64 (64-bit) Windows support, you must utilize Cisco's next-generation Cisco AnyConnect VPN Client."

• Cisco VPN Client Introduction
• Cisco VPN Client FAQ

But SSL VPN licences cost extra. For example, most new ASA firewalls come with plenty of IPSec VPN licences but only a few SSL VPN licences.

What alternatives do you have for 64-bit Windows? So far, I know two:

1. 32-bit Cisco VPN Client on a virtual machine
2. NCP Secure Entry Client on 64-bit Windows

Any other suggestions or experiences?