VPN Client User Guide for Windows - uchile.cl

1 Corporate HeadquartersCisco Systems, West Tasman DriveSan Jose, CA 95134-1706 : 408 526-4000800 553-NETS (6387)Fax: 408 526-4100 VPN Client user Guide for WindowsRelease 2003 Customer Order Number: 78-15383-01 THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB s public domain version of the UNIX operating system.

2 All rights reserved. Copyright 1981, Regents of the University of California. NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED AS IS WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH , the Cisco Arrow logo, the Cisco Powered network mark, the Cisco Systems Verified logo, Cisco Unity, Follow Me Browsing, FormShare, Internet Quotient, iQ Breakthrough, iQ Expertise.

3 IQ FastTrack, the iQ Logo, iQ Net Readiness Scorecard, Networking Academy, ScriptShare, SMARTnet, TransPath, and Voice LAN are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, Discover All That s Possible, The Fastest Way to Increase Your Internet Quotient, and iQuick Study are service marks of Cisco Systems, Inc.; and Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, the Cisco IOS logo, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Empowering the Internet Generation, Enterprise/Solver, EtherChannel, EtherSwitch, Fast Step, GigaStack, IOS, IP/TV, LightStream, MGX, MICA, the Networkers logo, network Registrar, Packet, PIX, Post-Routing, Pre-Routing, RateMUX, Registrar, SlideCast, StrataView Plus, Stratm, SwitchProbe, TeleRouter, and VCO are registered trademarks of Cisco Systems, Inc.

4 And/or its affiliates in the and certain other countries. All other trademarks mentioned in this document or Web site are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0206R)VPN Client user Guide for WindowsCopyright 2003, Cisco Systems, rights reserved. iiiVPN Client user Guide for Windows78-15383-01 CONTENTSA udienceixOrganizationixTerminologyxRelat ed DocumentationxVPN 3000 Series Concentrator DocumentationxiCisco PIX Firewall DocumentationxiConventionsxiiData FormatsxiiObtaining DocumentationxiiiWorld Wide WebxiiiDocumentation CD-ROMxiiiOrdering DocumentationxiiiDocumentation FeedbackxivObtaining Technical Assistance CenterxivCisco TAC Web SitexvCisco TAC Escalation CenterxvUnderstanding the Cisco VPN Client1-1 How the VPN Client Works1-2 Connection Technologies1-2 VPN Client Features1-2 Program Features1-3 Authentication Features1-4 Firewall Features1-5 IPSec Features1-6 VPN Client IPSec Attributes1-6 Windows Features Supported1-7 Installing the VPN Client2-1 Installation

5 Applications2-1 ContentsivVPN Client user Guide for Windows78-15383-01 Verifying System Requirements2-1 Gathering Information You Need2-2 Installing the VPN Client Through InstallShield2-3 Installing the VPN Client Through Microsoft Windows Installer2-4 Removing a VPN Client Version Installed with MSI Installer2-7 What Next?2-8 Navigating the user Interface3-1 Choosing a Run Mode3-1 VPN Client Window Simple Mode3-2 VPN Client Window Advanced Mode3-3 Toolbar Action Buttons Advanced Mode3-3 Main Tabs Advanced Mode3-4 Menus Advanced Mode3-4 Connection Entries Menu3-5 Status Menu3-6 Certificates Menu3-6 Log Menu3-7 Options Menu3-8 Right-Click Menus3-9 Connection Entries Tab Right-Click Menu3-10 Certificates Tab Right-Click Menu3-10 Log Tab Right-Click Menu3-11 How to Get Help3-12 Determining the VPN Client Version3-12 Configuring and Managing Connection Entries4-1 What Is a Connection Entry?

6 4-2 Creating a New Connection Entry4-2 Choosing an Authentication Method4-3 Group Authentication4-3 Certificate Authentication4-4 Sending a Certificate Authority Certificate Chain4-4 Validating a Certificate4-5 Configuring an Entrust Certificate for Authentication4-5 Configuring a Connection Entry for a Smart Card4-5 ContentsvVPN Client user Guide for Windows78-15383-01 Smart Cards Supported4-5 Configuring Microsoft network Access ( Windows 98, and Windows ME)4-6 Configuring Transparent Tunneling4-6 Enabling Transparent Tunneling4-7 Using IPSec over UDP (NAT/PAT)4-8 Using IPSec over TCP (NAT/PAT/Firewall)4-8 Allowing Local LAN Access4-8 Adjusting the Peer Response Timeout Value4-9 Enabling and Adding Backup Servers4-9 Removing Backup Servers4-10 Changing the Order of the Servers4-10 Disabling Backup Servers4-11 Configuring a Connection to the Internet Through Dial-up Networking4-11 Microsoft Dial-up Networking4-12 Third Party Dial-up Program4-12 Completing a Connection Entry4-12 Setting a Default Connection Entry4-12 Creating a Shortcut for a Connection Entry4-13 Duplicating a Connection Entry4-13 Modifying a Connection Entry4-13 Deleting a Connection Entry4-14 Importing a New Connection Entry4-14 Erasing a Saved Password for a Connection Entry4-15 Connecting to a private Network5-1 Starting the VPN Client5-2 Connecting from Simple Mode5-2

7 Connecting from Advanced Mode5-3 Authentication Alternatives5-3 Using the VPN Client to Connect to the Internet via Dial-Up Networking5-3 Authenticating to Connect to the private Network5-4 user Authentication5-4 Authenticating Through the VPN Device Internal Server or RADIUS Server5-5 Authenticating Through a Windows NT Domain5-5 Changing your Password5-6 Authenticating Through RSA Data Security (RSA) SecurID (SDI)5-6 RSA user Authentication: SecurID Tokencards (Tokencards, Pinpads, and Keyfobs) and SoftID ( Windows 98, and Windows ME)5-6 ContentsviVPN Client user Guide for Windows78-15383-01 RSA user Authentication: SoftID ( Windows NT Only) and SecurID (All Operating Systems)5-7 RSA New PIN Mode5-8 SecurID Next Cardcode Mode5-9 Connecting with Digital Certificates5-9 Connecting with an Entrust Certificate5-10 Accessing Your Profile5-10 Entrust Inactivity Timeout5-12 Using Entrust SignOn and Start Before Logon Together5-12 Connecting with a Smart Card or Token5-12 Completing the private network Connection5-14 Using Automatic VPN Initiation5-14 Enabling Automatic VPN Initiation5-15 Connecting Through Automatic VPN Initiation5-16 Disconnecting Your Session5-18 Changing Option Values While Auto Initiation is Suspended5-18 Disabling Automatic VPN Initiation5-18 Disabling While Suspended5-19 Restarting After Disabling Automatic VPN Initiation5-19 Connection Failures5-20 Viewing Connection Information5-20 Viewing

8 Tunnel Details5-21 Viewing Routing Information5-22 Local LAN Routes5-23 Secured Routes5-23 Firewall Tab5-23 Configuring the Firewall on the Concentrator5-24 Viewing Firewall Information on the VPN Client5-25 AYT Firewall Tab5-25 Centralized Protection Policy (CPP) Using the Cisco Integrated Client5-26 Firewall Rules5-26 Client /Server Firewall Tab5-28 Resetting Statistics5-29 Disconnecting your VPN Client Connection5-29 Closing the VPN Client5-29 ContentsviiVPN Client user Guide for Windows78-15383-01 Enrolling and Managing Certificates6-1 Using Certificate Stores6-2 Enrolling for a Certificate6-3 Enrolling Through the Network6-3 Enrolling Through a File Request6-6 Managing Personal and CA/RA Certificates6-8 Viewing a Certificate6-9 Importing a Certificate File6-10 Importing a Certificate from a File6-10 Importing a Certificate from the Microsoft Certificate Store6-11 Verifying a Certificate6-12 Deleting a Certificate6-13 Changing the Password on a Personal Certificate6-13 Exporting a Certificate6-14

9 Showing CA/RA Certificates6-15 Managing Enrollment Requests6-15 Viewing the Enrollment Request6-16 Deleting an Enrollment Request6-17 Changing the Password on an Enrollment Request6-17 Completing an Enrollment Request6-18 Managing the VPN Client7-1 Enabling Stateful Firewall (Always On)7-1 Launching an Application7-2 Turning Off Application Launcher7-3 Managing Windows NT Logon Properties7-3 Starting a Connection Before Logging on to a Windows NT Platform7-4 What Happens When You Use Start Before Logon7-4 Turning Off Start Before Logon7-5 Permission to Launch an Application Before Log On7-5 Disconnecting When Logging Off of a Windows NT Platform7-5 Managing Automatic VPN Initiation7-6 Viewing and Managing the VPN Client Event Log7-7 The Log Tab7-7 Enabling or Disabling the Log7-8 Displaying the Log Window7-9 Filtering Events7-11 Searching the Log File7-13 Saving the Log File7-13 ContentsviiiVPN Client user Guide for Windows78-15383-01 Clearing the Events Display in the Log Window and Log Tab7-14 Receiving Notifications

10 From a VPN Device7-14 Upgrade Notifications7-15 Firewall Notifications7-15 Disconnect-with-Reason Messages7-16 Upgrading the VPN Client Software (InstallShield)7-16 Upgrading the VPN Client Software (MSI)7-17 Uninstalling the VPN Client with the Uninstall Application7-18 APPENDIX AClient Software License Agreement of Cisco Systems1 Zone Labs3 INDEX ixVPN Client user Guide for Windows78-15383-01 PrefaceThis VPN Client user Guide tells you how to install, use, and manage the Cisco VPN Client with Cisco Systems Guide is for users of remote clients who want to set up virtual private network (VPN) connections to a central site. network administrators can also use this Guide for information about configuring and managing VPN connections for remote clients .