vpnc, OpenConnect, or AnyConnect Wrapper: Which One?

Installing another plugin until something connects can waste an afternoon, because "Cisco VPN" describes at least three arrangements. A legacy group-secret profile with XAuth is not the same service as an AnyConnect-compatible gateway, even when the same organization runs both. The plugin has to match the protocol and the authentication flow, not the vendor logo. A menu entry only tells you which integration is present, never which one the gateway will accept.

Ask the gateway administrator two questions: which protocol, and which client is approved for it.

Three integrations, three different targets

NetworkManager lists these as separate integrations. NetworkManager-vpnc covers legacy Cisco-compatible IPsec. NetworkManager-openconnect provides an OpenConnect-based frontend for supported protocols including AnyConnect. A separately listed AnyConnect wrapper depends on the proprietary client being installed and configured first.

They are not spellings of the same executable. Installing one does not make the others work, and an entry appearing in a menu is an interface fact rather than a compatibility guarantee.

Authentication decides more than transport

A matching transport is only the beginning. The login may need a certificate, a browser handoff, a second factor, or an endpoint posture check that a third-party frontend does not implement. OpenConnect documents several authentication mechanisms, but a feature list is not a promise that every gateway accepts every frontend. A group secret from a legacy profile should never be pasted into an unrelated authentication field just because the password box looked similar.

Obtain a profile and the credential handoff for the approved client. Translating by visual position is how credentials end up in the wrong place.

Maintenance is part of the choice

NetworkManager's own documentation marks the vpnc plugin as unmaintained, and suggests NetworkManager-libreswan as one possible replacement for the same IKEv1 protocol family. It also warns that profiles must be recreated and that per-option parity has not been checked. That is a direction, not a conversion tool.

IKEv1 itself is deprecated. For an approved legacy connection, separate the short-term question of which client to run from the longer-term question of when the gateway moves protocol.

Packages split the service from the editor

A NetworkManager plugin usually ships as two pieces: a service-side component that establishes the tunnel and an editor integration that lets the desktop configure it. Distributions split and name these packages differently, and installing only the command-line client can leave the editor without a form. Check both halves against your distribution's package list, and keep the runtime version compatible with the NetworkManager version it plugs into.

A working standalone client proves the protocol works. It does not prove the desktop integration is installed.

Write the contract down

The administrator's answer should produce five lines: protocol, approved client or plugin, login flow, required packages, and the owner who maintains the gateway. With those written down, the next failure has a starting point instead of a list of plugins to try.

If the answer is "whichever one connects", the environment has a documentation problem that will outlast this ticket. Ask again with the specific menu entries in front of you.