It is pretty easy to turn off any roles you don't want on Streisand. If you know for sure you will be using IPSEC I agree with you, use the ToB setup. Specific

It is pretty easy to turn off any roles you don't want on Streisand. If you know for sure you will be using IPSEC I agree with you, use the ToB setup. Specifically, compare their IKE setups: https://github.com/jlund/streisand/blob/master/playbooks/roles/l2tp-ipsec/templates/ipsec.conf.j2#L26 https://github.com/jlund/streisand/blob/master/playbooks/rol... https://github.com/trailofbits/algo/blob/master/roles/vpn/templates/ipsec.conf.j2#L13 https://github.com/trailofbits/algo/blob/master/roles/vpn/te... Algo's is much more conservative. Streisand lets 3des and SHA1 into the mix. If you allow it, users will end up using it. Otherwise, I think you are spot on and I prefer Algo (having used both for various things and just playing around).