Introduction
| Linksys USB VPN and Firewall Adapter | |
|---|---|
| Summary | Specialized miniature version of Linksys’ BEFSX41 router disguised as a USB – Ethernet adapter. Intended to allow mobile clients tunnel to remote IPsec gateway |
| Update | None |
| Pros | • Easy to install • Inexpensive compared to IPsec client software |
| Cons | • Another thing to carry on the road • Won’t work with all IPsec gateways • Windows-only |
When I first read the USBVPN1‘s product description, I at first thought that the folks at Linksys had lost it. But midway through writing a somewhat snarky news item about the USB VPN & Firewall Adapter, the light dawned and I realized what Linksys was up to – making an inexpensive portable mate for their extremely popular BEFVP41 and BEFSX41 VPN endpoint routers.
After my short time with the product, I think they’ve achieved their goal, but the results may not suit everyone’s needs.
Basic Features
The USBVPN1 is a lot smaller than it appears in Linksys’ product literature and is nicely packaged. It has a slightly larger footprint than a typical PC Card network adapter and is about as thick as two PC cards stacked on each other. It sports the “old” (pre-Cisco) purple and gray colors and doesn’t have the Cisco logo either.
The first tip-off that you’re not dealing with a typical USB network adapter is the USB A type connector on one end of the adapter. Since this is the same connector type found on your computer instead of the USB B type connector usually found on USB-type adapters, Linksys includes a USB A-to-A (male) cable so that your installation won’t screech to a halt.
All indicators are on the top surface of the adapter along with a foldable RJ45 10/100 Ethernet jack. You get separate indicators for USB, Diag, Link / Act, Full / Col, and 100, and also a handy Session LED that’s lit when the IPsec VPN tunnel is up and running.
What It Is
It took me about 5 minutes after the VPN1’s arrival for me to open the case and confirm my theory. Yes, folks, it’s really a mini-Me version of Linksys’ BEFSX41. Its heart is the same Conexant CX82100 single-chip ARM940T-based processor used in the SX41, but with an ADMtek ADM8511 handling the USB port duties and an Altima AC101L providing the Ethernet interface. So if there was something that was bugging you about the SX41’s VPN performance, it’s probably a good chance it still lurks inside this little wonder!
Setup and Administration
Installation consists of connecting the adapter to the USB port of your computer with the supplied USB cable, loading the CDROM containing the driver into your machine’s CD drive, and letting Windows Plug and Play take care of the rest.
The installation on my WinXP Home machine yielded an odd message, probably due to the fact that XP thought it was installing a USB device, but that’s not how it turns out that the VPN1 wants to be known. A quick reboot, though, and everything was ok. Installation on a Win98SE machine was uneventful, probably because 98SE wants a reboot after any network changes.
The VPN1 appears as a Network Adapter (not as a USB device), so in XP it will show up as a new Local Area Connection in Network Connections. The Installer sets the adapter’s TCP/IP properties to automatically obtain an IP address, so if all goes well, the computer attached to it will end up with 192.168.1.100 as its IP address from the VPN1’s built-in DHCP server. All you’ll then need to do is point your web browser to the VPN1’s default IP of 192.168.1.1, login and you’ll be at the Setup screen shown in Figure 1.
Figure 1: Setup screen
(click on the image for a full-sized view)
As you can see in Figure 1, the admin interface is organized with the same tabs as found in the SX41, with the exception of the Advanced tab. Like the SX41, it can handle static, dynamic, PPPoE and PPTP WAN authentication. Unfortunately, when Linksys killed all the Advanced level tabs, that included the MAC Clone tab found on the SX41. So if your Internet connection requires spoofing a particular MAC address, you won’t be able to use the VPN1.
Although the VPN1 functions as a NAT router, the only Firewall features that Linksys lets you control are shown in Figure 2.
Figure 2: Firewall screen
(click on the image for a full-sized view)
Setup and Administration, Continued
The VPN settings shown in Figure 3 and the Advanced Settings screen (not shown) are the same as the SX41’s. Since I covered these capabilities in the SX41 review, I won’t repeat the info here.
Figure 3: VPN screen
(click on the image for a full-sized view)
I didn’t have any problem getting a subnet-to-subnet tunnel up and running with the BEFSX41 that I used as a test partner. The firmware revision in my review unit was titled 1.00.8, Mar 12, 2003, so I think that the VPN1 includes the fixes in the 1.44.3, Dec 24 2002 firmware that came loaded in the BEFSX41 that Linksys sent me as a test companion. (Curious that the most recent version on the Linksys download page is marked 1.44, Nov 27, 2002.) Note that you get only one Tunnel profile vs. the two in the SX41.
Given that Linksys pitches the USBVPN1 as a connection companion to the SX41, you’d think that the User Manual would include an example setup that included settings for both products. But maybe Linksys figured that most VPN1 buyers would already be familiar with the ins and outs of configuring an SX41, because the VPN1’s User Guide VPN section is pretty much a copy of the SX41 manual’s and doesn’t include a router-to-router setup example. The manual does contain a few descriptions of SX41 features that didn’t make it into the VPN1, though.
VPN Performance
Though the Altima chip gives the VPN1 10/100 auto MDI / MDI-X Ethernet capability, performance is limited by the USB interface on the other side of the device. My quick tests with IXIA’s Chariot showed performance less than the blazing fast results I got in my SX41 performance tests, which I attribute to the VPN1’s USB side.
Maximum non-tunnel throughput averaged about 5.8Mbps, with little variation during my one minute Chariot run. Running the same test through the IPsec tunnel yielded a 1.5Mbps throughput – fast enough to keep up with most cable modem and residential broadband connections.
Wrap Up
It’s pretty frustrating to pay only about $60 for a VPN endpoint router and then have to cough up at least twice that to buy an IPsec software client. Although it is possible to get WinXP’s IPsec client to work with the SX41, the USBVPN1 is a much easier-to-use solution for connection to either the SX41 or its more powerful sibling, the BEFVP41.
Even though its limited configuration options won’t work with all IPsec gateways, and it won’t do you a bit of good if your on-the-road connection is via a wireless hotspot, the VPN1 should provide an easy-to-use and reasonably-priced alternative for basic IPsec VPN connection.