A few years ago, since I work for a company that makes switches and routers, I decided that our cloud VPN would be IPSec-based. It was going to be simple, and would work equally well with software and devices.

Oh, boy. It's not just ciphers. If you look at software alone, compatibility between the various *swan flavors is not exactly a thing.And what about IKE? By far the most misunderstood, haphazardly implemented piece of the puzzle.