After running into some issues with the Cisco VPN client on later amd64 kernels, I spent some time working on getting the latest vpnc to work.

Here is a template file of what I used (our connection details have been replaced with generic variables). You need to make sure the root certificate you use is in X.509 format. I also had to fake the version string to what the Cisco VPN client sends (or close to it) for our concentrator to accept it :)

Also, I had to recompile vpnc under Debian with OpenSSL support, since OpenSSL is BSD+Advertising and vpnc is GPL. You can find the amd64 deb I built here or the i386 deb here.