Customer Reviews

Cisco-Linksys BEFVP41 EtherFast Cable/DSL VPN Router with 4-Port 10/100 Switch

5 star:		(12)
4 star:		(7)
3 star:		(3)
2 star:		(8)
1 star:		(14)

 

 

The router/switch/NAT features of this little box work just like the other Linksys products in this line -- and just as well. What's new is the IPSec VPN support. You can set up secure tunnels over the Internet between two or more LANs using one of these boxes in front of each LAN. Alternatively (or in addition) you can set up a tunnel between a standalone remote PC and a LAN that has one of these routers *IF* the remote PC supports IPSec. Windows 2000 and XP support IPSec but Windows 9x/Me/NT do *NOT*. (If you want a Windows 9x/Me/NT PC to connect into an IPSec VPN, you will need a 3rd party IPSec driver, or just buy another one of these boxes to put in front of the PC.)

Configuring IPSec on a Windows 2000 or XP PC is not exactly easy either -- Linksys' how-to document is SIXTEEN PAGES long! But the difficulty is not Linksys' fault -- rather it's due to Microsoft's tortured GUI for the IPSec configuration.

But setting up a tunnel between two of these boxes is easy. It's only the standalone PC to LAN tunnel that is daunting.

I want to give this product 5 stars. It works very well, and the price is almost too good to be true -- it compares quite favorably with other products costing 5-10 times more. But I have to take a point off because Linksys does not give enough emphasis to the Windows 2000/XP limitation of the standalone PC VPN client in its marketing copy, and there is not one word about how to configure the standalone client in the manual that comes with the router -- you have to hunt for it on Linksys' Web site. From what I see on the discussion boards, there are a lot of people who are lost without better information on these points. So if you plan to use a standalone VPN client, be prepared for a struggle, but hang in there -- it DOES work!

I purchased a pair of Linksys BEFVP41 units to connect two office networks, and to provide for secure remote network access through VPNs to mobile users. While the units performed the former job adequately, the latter left a lot to be desired.

I should have known better when presented with Linksys' confusing marketing information. In one breath (from their web site) they say, "No IPSec VPN Client Software Needed," while in another say, "Mobile workers can also connect to a corporate network using an IPSec based VPN client software solution." As usual, there's a slight gulf between marketing spin and reality.

For PC-to-box connections, such as those with mobile users, it's true that no special client software is needed. Windows 2000 and XP users can, in fact, connect to the BEFVP41 without special software, but only if the computer has a static IP address. Whether on local networks or in a coffee shop hotspot, it's unlikely the typical desktop user will have a static IP address, which translated means that, in fact, VPN client software IS needed to make these units useful in that remote network access role.

That's because the BEFVP41 supports only IPSec. Commonly used Windows-based VPNs use PPTP or L2TP, both of which are built into Windows. But this unit (and most others) doesn't provide PPTP or L2TP support.

Back to the requirement, then, for aftermarket IPSec VPN software. The software is not inexpensive, and it adds considerably to the total cost of this Linksys solution. I tested the IPSec client from French company TheGreenBow, and it does work. The problem is that there is no DHCP or other types of dynamic addressing or DNS support; it's merely a "raw" network pipe. For most mobile users, this isn't going to be particularly functional, and that's especially true for users of networks that use Windows Active Directory. (Perhaps the other recommended option, the SoftRemote VPN client, addresses this, but either way, it's a costly add-on.)

All of this left me searching for ways to get PPTP support without buying other hardware. The suggestion widely made was to merely configure a Windows server behind the firewall to offer PPTP, and configure the Linksys BEFVP41 to pass PPTP through. Simply put, this doesn't work.

Linksys' web site features a tech note on how to configure this very scenario. However, had anyone at Linksys actually TESTED the tech note, they would have discovered it doesn't work. The tech note suggests port mapping ports 1723 (PPTP) and 47 (supposedly for GRE, a protocol necessary for PPTP to work properly). The problem is that "47" is NOT A PORT NUMBER, it is the PROTOCOL number of GRE. Mapping port 47 in the firewall has absolutely NO IMPACT WHATEVER on the GRE protocol. Whoever wrote the tech note clearly has very little understanding of the subject matter.

It is possible that some Linksys firewalls will work with PPTP pass-through, but the BEFVP41 clearly does not. Empirical evidence suggests that the GRE protocol is not properly handled internally to support the pass-through scenario. The connection can be made to port 1723 on a Windows server behind the firewall when passed through the Linksys, but without proper GRE handling, the VPN connection can't actually be established.

When you add to all of this a remarkably clunky web management interface, the Linksys BEFVP41 is a non-starter for me. Both units are on their way back to Amazon.com as I write this review. After a previous experience with the company where they took forever to update drivers to fix a compatibility issue; after seeing technically inaccurate tech notes on their support web site; and after adding-in this experience, I'll think twice before bothering with anything Linksys again.

My chosen replacement for the BEFVP41 (a pair of CyberGuard/SnapGear SG300 units) have already arrived, and have proven themselves to be far more flexible, more configurable, and more powerful than the BEFVP41. Along with their configurability, the SG300s provide PPTP and L2TP support directly (in addition to IPSec), making a total solution that (unlike the BEFVP41) TRULY doesn't require special software clients to offer a total office-to-office and mobile-to-office network solution.

I have 30 of these units at customer locations who connect to our head office to sell a service through the encrypted VPN tunnel. Easy to setup, connects to any standardized VPN box, remotely manageable, good throughput and the price is bar none the best out there. Go with Sonicwall and you have to buy licensing for every feature you want to use. No licensing on the LINKSYS. For the guy who was complaining about the port forwarding and the port triggering, you probably were doing something wrong as I have both port forwarding and port triggering enabled on my boxes and doing more than one address. It helps if people read instructions. The port forwarding info is in the help file on the router.

"Port Triggering
Some Internet applications or games use alternat ports to communicate between server and LAN host. When you want to use those applications, find out the ports used by them and fill the triggering(outgoing) port and alternat incoming port in this table. The router will forward the incoming packets to LAN host
"

So if you wanted to setup a VPN tunnel and use a application that you wanted going through port 5000, outbound on the Linksys and Inbound on another VPN router, that's what it's purpose is.

Highly recommended

I've been lookiing for a solid, inexpensive VPN solution for quite some time so I was pleased to find this little router. I had no problems configuring the unit to connect to a Watchguard Firebox II and a Nortel Networks Contivity 100S, both of which inhabit my equipment rack at the office. Configuring VPN's can be frustrating if you are unfamiliar with the technology but this product has a very simple interface and a bit of time spent educating yourself about IPSec will ease the setup.

Highly recommended.

The Linksys VPN Router gets the best results when you use one on each end, up to 40 tunnels. It took me 20 minutes per router to set up and make a permanent VPN connection. I did get one bad router. Each router must have exactly the same settings (That is what makes a VPN). On one router installation, I couldn't get a VPN connection. After checking the log, I found that there was a Crypto Sub-System error on that unit that prevented it from operating properly. I returned the defective unit and received a good one. With a properly configured VPN, there is no reason for IP forwarding or using the DMZ application. A Microsoft Domain controller, A Unix server, a main frame, 40 PCs, and several print servers are working together like they were in the same office. Linksys did a great job with this device. If you experience problems, it is likely to be your settings. Afterall, VPN is a rigid security application.

I found this box when looking for an affordable firewall and vpn solution for remote users. On site, we're using Symantec products, including Velociraptor and their firewall V 6.5.3. The Symantec products are quite expensive (in the thousands of dollars) and count user licenses. Symantec support was absolutely horrible at a cost of nearly a grand a year. So, when pricing firewalls (especially with vpn) the linksys is absolutely dirt cheap.

When testing vpn solutions, I found IKE unreliable regardless of manufacturer, particularly when mixing different manufacturers (i.e., Linksys connecting to Symantec). I bought support from Symantec specifically to resolve VPN issues. The most intelligent comment that I received from them, is that VPN is still new to the extent there are not clear standards, so some products simply will not work with those from another manufacturer. In our organization, we have Netscreen 5xp (about $500 for a box smaller than the linksys) Sonicwall, Symantec (several flavors) and Linksys. The Linksys boxes are used remotely (in homes) only.

So, when working with IKE, I have some experience using different products from different manufacturers. I just don't use it. All tunnels are created with static keys. By far, the most difficult products for which to build tunnels are the Symantec products. The naming conventions are absolutely counter-intuitive, i.e., is it the integrity algorithm key or the privacy algorithm key that establishes the connection vs encrypting the data? The Linksys fields are much more intuitive, and similar to those of other manufacturers.

With the (also expensive) Sonic firewalls, it was not possible to build 3DES tunnels with the Linksys due to limitations with the Sonicwall. I'm able to use 3DES tunnels between the Linksys and Symantec products. I'm only able to build 3DES tunnels between the Symantec products and SOME Sonicwall products. This goes back to lack of a clear standard, restrictions on key length, some products allowing non-standard characters, and others not, etc. The Linksys is very configurable with these more expensive products, and it is the more expensive product that usually is the problem.

Regarding reliabiliy, I work from home on a daily basis, and the tunnel will remain up for months at a time. If the firewall service is restarted on the Symantec product, the tunnel drops until it is reset on the Linksys. This can be done by disabling and re-enabling, or simply rebooting the router. I simply do not worry about hacks to my home PC which runs 24x7.

Over all, the product is fantastic considering the price. For those who've been very negative, I can only say that I've not experienced it with at least half a dozen in service, and suggest that they try some other products to gain a more true comparison. I've also called Linkys support a couple of times, and consider it reasonably good. Perhaps they're not experts, but it was far less stressful than talking to Symantec (costing nearly a grand per year for the privilage) only to find a support tech that was overburdened and over stressed (perhaps from handling a complex and difficult issue for the gazzilionth time) and who made it absolutely clear that you'll come away feeling like a bumbling idiot each time you call. Consider that you get what you pay for, and paying allot is not a guarantee that all will go well. I'm a network admin for a small company.

As you may have read elsewhere, this router has a problem with the GRE protocol used by Microsoft for their PPtP server (see Alan Bryant's May 27, 2004 review).

This will stop you using it with the built-in PPtP VPN client/server which is provided with Windows 2000/XP.

Here is the text of a complaint I have submitted to Linksys...


"I am attempting to operate a Microsoft PPtP server behind a BEFVP41 (firmware 1.41.1). I have PPtP Pass Through enabled and port 1723 forwarded to the fixed IP address of the server but the router refuses to pass the GRE protocol used by Microsoft (Protocol 47).

In answer ID 737, you suggest forwarding port 47 presumably in a belief that this has something to do with GRE. It does not and is therefore not the solution to this problem. GRE does not use TCP/UDP port 47, it is 'Protocol 47', something entirely different.

It seems that the the writer of answer 737 has neither tested this scenario nor has a true understanding of the nature of this problem.

I and others have investigated this problem extensively using protocol analysers at the client and server ends and can only conclude that the present version of firmware in the BEFVP41 (1.41.1) is incapable of handling the GRE protocol correctly.

Can you please advise when a fix will be implemented? This is seriously devaluing an otherwise good product.

I also suggest that you amend answer 737 as it is misleading and will frustrate others less versed in IP protocols than myself."


I await a reply from Linksys as I write this review.


Having said all that, if you have no interest in running the Microsoft PPtP server, the BEFVP41 may do everything else you require.

It functions okay as a basic NAT router and it's stealth capabilities are good (Steve Gibson's 'Shields Up' reports 'True Stealth' as long as you forward port 113 to a non-existant host).

The in-built IPSec tunneling works well. I am using one to provide permanant tunnels to a number of BEFSX41's very reliably.

The web interface is a little odd at times but it does do the job reasonably and you do get used to it eventually.


To summarise:

A reasonable basic NAT router.

Very good stealth.

IPSec tunneling works okay (at least to other Linksys products).

Microsoft's PPtP server will NOT work with the current firmware version.

I've been using this router for almost 2 years. Recently it just stopped working - I think it finally burned out, probably due to all of the heat it generates while running. Besides that, I found that it was very slow, compared with other routers. Its VPN implementation works OK, but its slow also - I don't know why, since its hardware!!! I replaced it with a NetGear FVS328, I now my VPN connections are about 4 times faster, and my regular web browsing is a lot faster. Do yourself a favor get the NetGear!

I have a small office network that I wanted to be able to access securely from home. I did a TON of research to find the most robust and cheapest solution. Those searches lead me to the BEFVP41 for the office and the FREE SSH Sentinel 1.3.2.2 VPN client for home which can be downloaded at http://www.olin.wustl.edu/computing/reference/wireless/ipsec.cfm . A tutorial on how to set this whole thing up can be found at http://www.homenethelp.com/vpn/router-client-v13.asp .

It is very important that the BEFVP41 have a static ip address for the wan side. If you don't have one, ask your ISP for one, otherwise forget about doing VPN. Also, make sure the office subnet address is different than the one at home. SSH Sentinel doesn't appear to support netbios broadcast, so you won't be able to browse the office network when you connect. However, you can access each computer by their ip address. If you have a dhcp server that can allocate static addresses, then this is not a big problem as the address won't change on you.

I was able to set the whole thing up in one hour by carefully following the tutorials. However, I am VERY experienced with networking so your mileage may vary. What is great about this setup is I can log into my office securely from my laptop from any hotspot. The next time I visit Starbucks, I'm bringing my laptop.

By the way, you can buy a second BEFVP41 or the cheaper BEFSX41 for the home. This way you can log onto your home network from the office. I didn't need to do this so there was no point in spending the extra money. However doing it this way will allow you to browse the computers on the network. Also, don't waste your money on the USBVPN1 USB adapter. If you can't hook to an ethernet port, it won't work(i.e. any hotspot).

Good luck!

I own few Linksys products and have to admit that when they work, they do perform well in SOHO environment. (Unfortunately my last BEFVP41 unit wasn't too long lived, it died 6 months after I have purchased it.)
However if you are anything more than just casual internet surfer and you heavily depend on reliable access to the net I would highly discourage you from purchasing it due to very poor customer support system Linksys has in place.
If you need to replace your defective unit be prepared to cope with the incompetence of their RMA system ("sorry sir, our database is down again") and long wait for the replacement unit, even when using the advance replacement option. Unless you can afford the downtime, or have a spare router, do not bother buying Linksys.
If you live in Hawaii or Alaska Linksys will make you pay for half of the shipping cost back to you! It's clearly a company that doesn't particularly care for its image and neither for truly satisfied customer.
Oh, and did I mention to be prepared to shell out money on long distance calls (no 800 number) every time when you attempt to contact their customer service.
Sorry Linksys, you do not deserve anything more than one star with such lousy customer service.