Fedora’s VPN Migration Has Two Routes, and Only One Uses OpenConnect

A Fortinet SSLVPN connection and a Cisco IKEv1 connection do not have the same replacement in Fedora 45. The project recommends OpenConnect for the first and Libreswan for the second. That distinction sits at the centre of its November 3 notice retiring two unmaintained NetworkManager plugins.

The packages are NetworkManager-fortisslvpn and NetworkManager-vpnc. Fedora says an upgrade to version 45 automatically removes them if installed. Anyone depending on one of those connections needs both a replacement client and a profile that works with the existing gateway. Installing a maintained package gets only the first part done.

Fortinet and Cisco need different clients

For the Fortinet route, the package is NetworkManager-openconnect. In the desktop connection editor, Fedora’s procedure creates a multi-protocol OpenConnect connection and selects Fortinet SSL VPN as the protocol. The notice specifically says OpenConnect supports the older PPP-based Fortinet protocols.

The saved gateway and authentication details still matter. Keep them available while creating the replacement, and test the resources reached through the tunnel before removing NetworkManager-fortisslvpn. The procedure puts verification ahead of removal. There is no benefit in discovering a missing setting after the old client is gone and the operating-system upgrade is complete.

The Cisco route has an extra service dependency

NetworkManager-libreswan is Fedora’s migration target for the IKEv1 family previously handled by vpnc. The notice says ipsec.service must be running or activation will fail. It also describes a possible need to enable IKEv1 explicitly, using ikev1-policy=accept under config setup in /etc/ipsec.d/ikev1.conf.

IKEv1 is deprecated. This setting accommodates a legacy gateway; it should not be read as a reason to change a working modern service to an older protocol. Confirm the requirement with the administrator responsible for that gateway.

Fedora’s instructions use a new IPsec-based connection with IKEv1 selected. They call for the gateway, a group name enclosed in square brackets, the group password and user credentials. IKE/ESP proposals, DH/PFS settings and routing can need adjustment too. The gateway configuration and old vpnc logs are the sources Fedora identifies for that information.

Keeping Fedora 44 does not restore upstream support

Fedora 43 and 44 retain installed copies of the old plugins. They will receive no further feature or security updates for those plugins, however. Remaining on the older release postpones the package removal, rather than putting maintenance back in place.

The retirement follows published security problems involving malicious profiles and legacy privilege handling. Fedora says NetworkManager maintainers and FESCo agreed to move users to supported alternatives.

Our Fedora 45 debugger report similarly separates a release change from the configuration already on a particular machine. For VPNs, start by identifying Fortinet SSLVPN or Cisco IKEv1, then follow that route. A useful handover test includes an internal hostname and the route to a required resource, not just acceptance of the login. Keep an independent way to contact support until that test succeeds.