VPN Client Administrator Guide - Sprint

1 Corporate HeadquartersCisco Systems, West Tasman DriveSan Jose, CA 95134-1706 : 408 526-4000800 553-NETS (6387)Fax: 408 526-4100 VPN Client Administrator GuideRelease 2003 Customer Order Number: DOC-7815404=Text Part Number: 78-15404-01 THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE.

2 IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB s public domain version of the UNIX operating system. All rights reserved. Copyright 1981, Regents of the University of California. NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED AS IS WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL.

3 EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH , CCSP, the Cisco Arrow logo, the Cisco Powered Network mark, the Cisco Systems Verified logo, Cisco Unity, Follow Me Browsing, FormShare, iQ Net Readiness Scorecard, Networking Academy, and ScriptShare are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, The Fastest Way to Increase Your Internet Quotient, and iQuick Study are service marks of Cisco Systems, Inc.; and Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, the Cisco IOS logo, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Empowering the Internet Generation, Enterprise/Solver, EtherChannel, EtherSwitch, Fast Step, GigaStack, Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, LightStream, MGX, MICA, the Networkers logo, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, RateMUX, Registrar, SlideCast, SMARTnet, StrataView Plus.

4 Stratm, SwitchProbe, TeleRouter, TransPath, and VCO are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the and certain other countries. All other trademarks mentioned in this document or Web site are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0303R)VPN Client Administrator GuideCopyright 2003 Cisco Systems, rights reserved. iiiVPN Client Administrator Guide78-15404-01 CONTENTSP refaceviiAudienceviiOrganizationviiiRela ted DocumentationixVPN 3000 Series Concentrator DocumentationixOther ReferencesixConventionsxData FormatsxObtaining CD-ROMxiOrdering DocumentationxiDocumentation FeedbackxiiObtaining Technical Assistance CenterxiiiCisco TAC WebsitexiiiCisco TAC Escalation CenterxiiiObtaining Additional Publications and InformationxivCHAPTER 1 Configuration Information for an Administrator1-1 VPN 3000 Series Concentrators Configuration Information1-1 Configuring a

5 VPN 3000 Concentrator for Remote Access Users1-1 Completing Quick Configuration1-2 Creating an IPSec Group1-2 Creating VPN Client user Profiles1-3 Configuring VPN Client Users for Digital Certificate Authorization1-3 Configuring VPN Client Firewall Policy Windows Only1-5 Overview1-5 Firewall Configuration Scenarios1-8 Defining a Filter and Rules to Use with Firewalls for CPP1-10 Configuring the VPN 3000 Concentrator to Enforce Firewall Usage on the VPN Client1-11 ContentsivVPN Client Administrator Guide78-15404-01 Setting up Cisco Integrated Client Firewall (CIC)

6 For CPP1-12 Custom Vendor Codes 1-12 Obtaining Firewall Troubleshooting Information1-13 Notifying Remote Users of a Client Update1-14 Setting up Local LAN Access for the VPN Client1-15 Configuring the VPN Concentrator for Client Backup Servers1-17 Configuring NAT Traversal for the VPN Client1-17 Global Configuration1-17 Configuring Entrust Entelligence for the VPN Client Windows Only1-18 Setting up the VPN Client for Authentication using Smart Cards Windows Only1-20 CHAPTER 2 Preconfiguring the VPN Client for Remote Users2-1 Profiles2-1 File Format for All Profile Files2-2 Making a Parameter Read Only2-2 Creating a Global Profile2-2 Features Controlled by Global Profile2-2 Global Profile Configuration Parameters2-4 DNS Suffixes and the VPN Client Windows 2000 and Windows XP Only2-13 Setting Up RADIUS SDI Extended Authentication2-16 Creating Connection Profiles2-16 Features Controlled by Connection Profiles2-17 Creating a.

7 Pcf file for a Connection Profile2-19 Naming the Connection Profile2-19 Connection Profile Configuration Parameters2-19 Distributing Configured VPN Client Software to Remote Users2-26 Separate Distribution2-26 Distribution with the VPN Client Software2-27 CHAPTER 3 Configuring Automatic VPN Initiation Windows Only3-1 Creating Automatic VPN Initiation in the File3-3 Preparation3-3 What You Have to Do3-3 Verifying Automatic VPN Initiation Configuration3-5 CHAPTER 4 Using the VPN Client Command-Line Interface4-1 CLI Commands4-1 Displaying a List of VPN Client Commands4-1 Starting a Connection vpnclient connect4-1 ContentsvVPN Client Administrator Guide78-15404-01 Displaying a Notification vpnclient notify4-4 Displaying an Automatic VPN Initiation Configuration Windows Only4-4 Suspending/Resuming Stateful Firewall (Windows Only)

8 4-5 Ending a Connection vpnclient disconnect4-6 Displaying Information About Your Connection vpnclient stat4-6 Return Codes4-10 Application Example Windows Only4-12 CHAPTER 5 Customizing the VPN Client Software5-1 Customizing the VPN Client GUI for Windows5-2 Areas Affected by Customizing the VPN Client5-2 Installation Bitmap 5-2 Program Menu Titles and Text 5-3 VPN Client 5-4 Setup Bitmap the File 5-5 Sample File Keywords and Values5-6 Customizing the VPN Client Using an MSI Transform5-10 Creating the File and MSI5-11 Installing the VPN Client using the Transform5-11 Installing the VPN Client Without user Interaction5-12 Silent Installation Using InstallShield5-12 Silent Installation Using MSI5-13 Launching SetMTU with Silent Installation5-13 Customizing the VPN Client GUI for Mac OS X5-14 CHAPTER 6 Troubleshooting and Programmer Notes6-1 Troubleshooting the VPN Client6-1 Gathering Information for Customer Support6-1If Your Operating System is Windows 98, 98 SE, ME, 2000.

9 Or XP6-1If Your Operating System is Windows NT or Windows 20006-2If Your Operating System is Mac OS X6-3 Solving Common Problems6-4 Shutting Down on Windows 986-4 Booting Automatically Starts up Dial-up Networking on Windows 956-4 ContentsviVPN Client Administrator Guide78-15404-01 Changing the MTU Size6-4 Changing the MTU Size Windows6-4 Changing the MTU Size Linux, Solaris, and Mac OS X6-5 Delete With Reason6-6 Configuring Delete with Reason on the VPN Concentrator6-7 Start Before Logon and GINAs Windows Only6-7 Fallback Mode6-7 Incompatible GINAs6-8 Programmer Notes6-8 Testing the Connection6-8 Command Line Switches for ipsecdialer Command Windows Only6-9 IKE Proposals6-9 CHAPTER 7 Windows Installer (MSI)

10 Information7-1 Differences Between InstallShield and MSI7-1 Starting the VPN Client MSI7-2 Alternative Ways to Launch MSI 7-2 Launching MSI via Command Line7-2 Launching MSI via the MSI Icon7-2 Logging During Installation7-2 INDEX viiVPN Client Administrator Guide78-15404-01 PrefaceThis VPN Client Administrator Guide tells you how to set up selected features of the Cisco VPN Client for users. This manual supplements th