ADAPTIVE CONFIGURATION SELECTION FOR INTER-VENDOR IPSEC VPNS: A RULE-BASED FRAMEWORK FOR FORTINET, SOPHOS, AND PFSENSE

Abstract

Organizations that connect sites using firewalls from more than one vendor routinely see IPsec VPN performance vary not just with the encryption settings chosen but with which two vendors are paired. Building on an empirical study of IPsec tunnels configured between Fortinet, Sophos, and pfSense firewalls across three vendor pairings, four encryption and key-exchange configurations, and two tunnel modes, this paper proposes a rule-based framework that recommends a near-optimal IPsec configuration for a given vendor pairing instead of leaving administrators to rediscover suitable settings through trial and error. The framework encodes vendor-pairing-specific performance patterns observed experimentally into a compact decision table covering encryption algorithm, key-exchange version, and tunnel mode, and returns a recommended configuration together with the throughput, latency, and stability behavior that pairing can be expected to show. Evaluated against manually configured baselines on the same three-vendor testbed, configurations selected by the framework matched the best-performing configuration identified through exhaustive testing for every vendor pairing, without requiring per-pairing manual tuning. The approach offers network administrators a lightweight, interpretable starting point for configuring multi-vendor IPsec VPNs, and is designed to be extended to additional vendors as further empirical data becomes available.