> Unfortunately there are some exceptions out there. Everyone who has ever tried to create an IPsec tunnel to an OpenBSD machine can probably tell a tale of tha

> Unfortunately there are some exceptions out there. Everyone who has ever tried to create an IPsec tunnel to an OpenBSD machine can probably tell a tale of that. It’s clear to me from this alone that the author of this article has never had the misfortune of trying to get any two network appliances from any two different vendors to establish an IPsec tunnel. It’s a certifiable nightmare and I have lost entire weeks of my life in the past to trying and often failing. The IPsec suite has a vast surface area and it is significantly harder for any one person to understand compared to something like Wireguard, which is, above most other things, simple. In an ideal world, IPsec might be easy “if it’s done right” but it’s incredibly difficult to debug what is happening when IPsec goes wrong. There are so many moving parts, competing specifications, buggy implementations and, for every tunable, there’s a whole heap of hidden complexity. The industry likes to appoint Cisco, Juniper etc as if they are some kind of gold standard for some reason. They are certainly among best in the league tables for the highest number of bugs per config line if nothing else.