> Unsurprisingly no mention of wireguard The hard part of a VPN, the part that everybody makes money at, isn't the IP-level encapsulation. Yes, Wireguard is bo

> Unsurprisingly no mention of wireguard The hard part of a VPN, the part that everybody makes money at, isn't the IP-level encapsulation. Yes, Wireguard is both conceptually and in implementation simpler and more elegant in this regard. But IPSec per se isn't actually a real pain point in real world corporate road warrior deployments, at least not any more than with Wireguard, which can have very similar issues with MTUs, NAT timeouts, etc when dealing with the diversity of remote user networks. The hard part of a corporate VPN is authentication, address assignment, subnet routing, nameserver announcements, etc. Therein lies the hard, dirty, complex pieces. Many IPSec-based VPNs utilize IKE for that, although some don't and utilize bespoke, hacky solutions. Most of the horror stories of configuring IPSec relate to IKE, and much of the complexity there is irreducible. (Though I rejoiced when Android finally added native IKEv2 support--years after Windows, macOS, and iPhone--as IKEv2 substantially reduces some of the complexity relative to IKEv1.) Wireguard provides none of that. Instead, you have to build that stuff separately, and in the realm of Wireguard it's still the wild west, with people slapping together management frameworks with all the dubious quality and opaqueness that have made the traditional VPN ecosystem a nightmare. (The Wireguard team is working on and publishes a separate project for that aspect, but AFAIU it's not widely used and in any event is far removed by its nature from the stark elegance of the transport layer Wireguard protocol.) But the year is 2021. Every major platform today, including Debian- and RedHat-based Linux, FreeBSD, NetBSD, OpenBSD, macOS, Android, and iPhone, ships with a modern, native IPSec+IKEv2 stack that is highly interoperable and provides, at least in the simple case, certificate-based authentication, dynamic address assignment and subnet routing, and nameserver advertisement. And, importantly, they all support modern cipher suites so the old problem of finding compatible suites is (or could be, in new deployments) a distant memory--everybody supports ECDH P256, AES128-GCM, etc. On my work-issued macOS laptop the third-party VPN software simply uses native IPSec and a custom IKE daemon. Though as far as I can tell from the configuration the custom daemon is just technical debt from building the product before macOS' IKE daemon (racoon fork) was more mature. And in fact, AFAICT there's absolutely nothing of value, beside IT familiarity, that macOS' IPSec+IKEv2 stack doesn't provide. An equivalent VPN setup using the native stack requires nothing more than a username, password, certificate, and a hostname for the endpoint. You don't need to install a third-party client to automate entering that information; heck, you don't really even need to automate it at all, not any more than you need to automate sending a person to gmail.com or outlook.com for their e-mail. When you're comparing Apples + Apples, I personally don't think Wireguard is a serious choice for corporate, road warrior VPN access. On most key points, actual Wireguard-based systems are qualitatively worse. The story is different for static point-to-point, server-to-server communications, especially when you can do static address assignments on the tunnel interfaces. In such scenarios the simplicity of Wireguard shines through. But in those scenarios the popular solution is more often OpenVPN than IPSec. I simply don't see Wireguard replacing IPSec for corporate VPNs. I hope I don't ever see that because good VPN solutions should be deeply integrated with the host system (e.g. to help prevent leakage, integrate DNS resolution, etc), and you're just not going to see that with Wireguard-based solutions. The situation isn't perfect on modern platforms, but it's much better than it was 10 or even 5 years ago, and its getting better and the pace of improvement has (relative to the past 20 years) picked up considerably.