VPN Client User Guide for Linux and Solaris
Contents
1. e Ifyou are using a command line client the message appears on your terminal and is logged in the IPSec log e For IPSec deletes which do not tear down the connection an event message appears in the IPSec log file but no message pops up or appears on the terminal Note The VPN device must be running software version 4 0 or later to support this functionality Single SA The ability to support a single security association SA per VPN connection Rather than creating a host to network SA pair for each split tunneling network this feature provides a host to ALL approach creating one tunnel for all appropriate network traffic apart from whether split tunneling is in use Auto initiation The ability to automatically initiate secure wireless VPN connections seamlessly For information on this feature see VPN Client Administrator Guide Cisco VPN Client User Guide for Linux and Solaris OL 5491 01 _ Chapter 1 Understanding the VPN Client IPSec Features IPSec Attributes VPN Client Features W The VPN Client supports the IPSec features listed in Table 1 3 Table 1 3 IPSec Features IPSec Feature Description Tunnel Protocol IPSec Transparent tunneling e IPSec over UDP for NAT and PAT e IPSec over TCP for NAT and PAT Key Management protocol Internet Key Exchange IKE IKE Keepalives A tool for monitoring the continued presence of a peer and reporting the VPN Client2. eeprom boot file platform sun4u kernel sparcv9 unix Unpacking the VPN Client Files Step 1 Step 2 The VPN Client is shipped as a compressed tar file To unpack the files Download the packed files either from your internal network or the Cisco website to a directory of your choice Copy the VPN Client file to a selected directory Cisco VPN Client User Guide for Linux and Solaris P24 g OL 5491 01 Chapter2 _ Installing the VPN Client Installing the Software W Step3 Unpack the file using the zcat and tar commands For example the command for Linux is zcat vpnclient linux 3 7 xxx K9 tar gz tar xvf The command for Solaris is zcat vpnclient solaris 3 7 xxx K9 tar Z tar xvf This command creates the vpnclient directory in the current directory Installing the Software The following sections describe the installation procedure for the VPN Client for each operating system Installing the VPN Client for Linux Before you install a new version of the VPN Client or before you reinstall your current version you must use the stop command to disable VPN service If you are upgrading from the VPN 5000 Client to the VPN Client use the following stop command etc rce d init d vpn stop If you are upgrading from the VPN 3000 Client to the VPN Client use the following stop command etc rc d init d vpnclient_init stop To install the VPN Client for Linux Step 1 Obtain superuser privileges to r
3. tar xf rm f vpnclient solaris lt version gt K9 tar Z cp f lt path_to_root_cert gt lt root_cert_filename gt vpnclient rootcert tar cf vpnclient compress c gt vpnclient solaris lt version gt K9 tar Z Solaris System Requirements The VPN Client for Solaris runs on any UltraSPARC computer running a 32 bit or 64 bit Solaris kernel OS Version 2 6 or later Changing a Kernel Version You can install the VPN Client running the 32 bit or 64 bit version of the kernel referred to as 32 bit mode and 64 bit mode If you experience problems installing or running the VPN Client in one mode try the other one To see which mode the system is running in enter this command isainfo kv If the cipsec module is loaded correctly the dmesg log displays a message similar to the following Oct 29 11 09 54 sol 2062 cipsec ID 952494 kern notice Cisco Unity IPSec Module Load OK Note If the dmesg log does not show the cipsec log message you should switch to the other mode To switch to 32 bit mode e Temporarily Enter the following command ok is the system prompt ok boot kernel unix e Permanently Enter the following command as root then restart your computer eeprom boot file platform sun4u kernel unix To switch to 64 bit mode e Temporarily Enter the following command ok is the system prompt ok boot kernel sparcv9 unix e Permanently Enter the following command as root then restart your computer
4. commands tar 2 4 zcat 2 4 connection types 1 3 D data compression 1 6 data formats vii delete with reason 1 4 DHCP request 1 4 Diffie Hellman groups 1 6 disconnecting the VPN client 4 3 displaying available commands 4 1 DNS server 1 4 documentation conventions vi related vi enabling VPN service 2 6 encrypt group password 3 3 encryption algorithm 1 6 encrypt user password 3 3 eraseuserpwd parameter 4 2 ESP keepalives 3 4 extended authentication 1 6 I OL 5491 01 Cisco VPN Client User Guide for Linux and Solaris W index F features authentication 1 6 IPSec 1 5 program 1 3 VPN client 1 2 G group name 3 3 group password 3 3 hash 3 5 host name 1 4 3 3 hybrid authentication Linux 2 3 Solaris 2 3 IKE keepalives 1 5 3 4 IKE protocols 1 1 installer contents 2 1 install script Linux 2 6 Solaris 2 8 introduction 1 1 IP chains 2 3 IP protocol 1 3 IPSec attributes 1 5 features 1 5 through NAT 3 4 IPSec group name 3 3 password 3 3 K keepalives 1 5 3 4 kernel version changing 2 4 requirements 2 2 L libraries 2 2 local LAN access 1 3 3 4 logging commands 4 6 main mode 1 5 mode aggressive 1 5 authentication 1 6 configuration 1 6 main 1 5 NAT 3 4 tunnel encapsulation 1 6 MTU size 1 4 mutual authentication Linux 2 3 NAT mode 3 4 NAT transparency 3 4 NAT transversal 3 4 network adapters supported 1 1 E Ci
5. This rule allows UDP port 500 which is required for the VPN Client connection Bundling a Root Certificate with the Installation Package Linux To use mutual authentication the VPN Client system must have a root certificate installed You can bundle a root certificate with the installation package so that the root certificate is installed automatically during installation The following commands place a root certificate with the installation package The root certificate is contained in a file The name of the file must be rootcert with no extension zcat vpnclient linux lt version gt K9 tar gz tar xf rm f vpnclient linux lt version gt K9 tar gz cp f lt path_to_root_cert gt lt root_cert_filename gt vpnclient rootcert tar czf vpnclient linux lt version gt K9 tar gz vpnclient Bundling a Root Certificate with the Installation Package Solaris To use mutual authentication the VPN Client computer must have a root certificate installed You can bundle a root certificate with the installation package so that the root certificate is installed automatically The following commands place a root certificate with the installation package The root certificate is contained in a file The name of the file must be rootcert with no extension OL 5491 01 Cisco VPN Client User Guide for Linux and Solaris E Chapter2 Installing the VPN Client HI Unpacking the VPN Client Files zcat vpnclient solaris lt version gt K9 tar Z
6. be enabled on both the VPN Client and the VPN device you are connecting to EnableNAT 0 1 Specifies whether or not to enable secure transmission between a VPN Client and a VPN device through a router serving as a firewall which might also be using the NAT protocol e 0 the default disables IPSec through NAT mode e 1 enables IPSec through NAT mode TunnelingMode 0 1 Allows you to select which form of NAT transversal is used e 0 the default specifies IPSec over UDP for NAT transparency e 1 specifies IPSec over TCP for NAT transparency You must also have IPSec through NAT enabled TCPTunnelingPort 0 65535 Sets which TCP port to use for the cTCP protocol The default is 10000 You must also have IPSec through NAT enabled and the Tunneling Mode set for IPSec over TCP ForceKeepAlives 0 1 Allows the VPN Client to keep sending IKE and ESP keepalives for a connection at approximately 20 second intervals so that the port on an ESP aware NAT Firewall does not close e 0 the default disables keepalives e 1 enables keepalives PeerTimeout Number The number of seconds to wait before terminating a connection when the VPN device on the other end of the tunnel is not responding The range is 30 to 480 seconds The default is 90 CertStore 0 1 Identifies the type of store containing the configured certificate e 0 default none e 1 Cisco CertName Strin
7. dotted decimal notation for example 192 168 12 34 You can omit leading zeros in a byte position e Host names Use legitimate network host or end system name notation for example VPNO1 Spaces are not allowed A host name must uniquely identify a specific system on a network A host name can be up to 255 characters in length e User names and Passwords Text strings for user names and passwords use alphanumeric characters in both upper and lower case Most text strings are case sensitive For example simon and Simon would represent two different user names The maximum length of user names and passwords is generally 32 characters unless specified otherwise Obtaining Documentation Cisco com Cisco provides several ways to obtain documentation technical assistance and other technical resources These sections explain how to obtain technical information from Cisco Systems You can access the most current Cisco documentation on the World Wide Web at this URL http www cisco com univercd home home htm You can access the Cisco website at this URL http www cisco com International Cisco web sites can be accessed from this URL http www cisco com public countries_languages shtml Documentation CD ROM Cisco documentation and additional literature are available in a Cisco Documentation CD ROM package which may have shipped with your product The Documentation CD ROM is updated monthly and may be more current than printed d
8. install the VPN Client you must have the kernel source that was used to build the kernel that is running on the system If the system is using a kernel that came as part of the Linux distribution or a custom built kernel the kernel code can be obtained in different ways e For users running kernels that came with their distribution You must install the corresponding kernel source rpm The vpn_install script should be able to automatically find the kernel source e For users running a custom built kernel You must use the same copy of the kernel source that was used to build the kernel you are running Unpacking the source code for the version of the kernel you are using is insufficient There are several files generated when the kernel is compiled that the VPN Client uses These files must exactly match with the kernel you are running Otherwise the VPN Client installation might fail amp Note Ifyou install a patch on the workstation kernel you must reinstall the VPN Client using these guidelines VPN Client for Linux Install Script Notes During the installation process 1 The module is compiled linked and copied to either the directory lib modules preferred CiscoVPN if it exists or to lib modules system CiscoVPN where system is the kernel version 2 The application binaries are copied to the specified destination directory 3 The startup file etc rc d init d vpnclient_init is created to enable and disable the VPN
9. is for remote clients who want to set up virtual private network VPN connections to a central site Network administrators can also use this guide for information about configuring and managing VPN connections for remote clients You should be familiar with UNIX platforms and know how to use UNIX applications Network administrators should be familiar with UNIX system configuration and management and know how to install configure and manage internetworking systems This guide contains the following chapters e Chapter 1 Understanding the VPN Client This chapter provides a brief introduction to the VPN Client software e Chapter 2 Installing the VPN Client This chapter describes how to install the VPN Client software on your workstation e Chapter 3 User Profiles This chapter describes how to set up user profiles for connection entries e Chapter 4 Using the Command Line Interface This chapter describes the command line interface and lists the commands and their descriptions e Index I OL 5491 01 Cisco VPN Client User Guide for Linux and Solaris About This Guide HI Related Documentation Related Documentation The following is a list of user guides and other documentation related to the VPN Client for Linux and Solaris and the VPN devices that provide the connection to the private network e Release Notes for the Cisco VPN Client Version 4 6 e Cisco VPN Client Administrator Guide Re
10. s continued presence to the peer This lets the VPN Client notify you when the peer is no longer present Another type of keepalives keeps NAT ports alive Split tunneling The ability to simultaneously direct packets over the Internet in clear text and encrypted through an IPSec tunnel The VPN device supplies a list of networks to the VPN Client for tunneled traffic You enable split tunneling on the VPN Client and configure the network list on the VPN device Support for Split DNS The ability to direct DNS packets in clear text over the Internet to domains served through an external DNS serving your ISP or through an IPSec tunnel to domains served by the corporate DNS The VPN server supplies a list of domains to the VPN Client for tunneling packets to destinations in the private network For example a query for a packet destined for corporate com would go through the tunnel to the DNS that serves the private network while a query for a packet destined for myfavoritesearch com would be handled by the ISP s DNS This feature is configured on the VPN server VPN concentrator and enabled on the VPN Client by default To use Split DNS you must also have split tunneling configured The VPN Client supports the IPSec attributes listed in Table 1 4 Table 1 4 IPSec Attributes IPSec Attribute Description Main Mode and Aggressive Mode Ways to negotiate phase 1 of establishing ISAKMP Security Associations SAs
11. the level of Cisco support services to which your company is entitled for example SMARTnet SMARTnet Onsite or Network Supported Accounts NSA When you call the center please have available your service agreement number and your product serial number Obtaining Additional Publications and Information Information about Cisco products technologies and network solutions is available from various online and printed sources The Cisco Product Catalog describes the networking products offered by Cisco Systems as well as ordering and customer support services Access the Cisco Product Catalog at this URL http www cisco com en US products products_catalog_links_launch html Cisco Press publishes a wide range of networking publications Cisco suggests these titles for new and experienced users Internetworking Terms and Acronyms Dictionary Internetworking Technology Handbook Internetworking Troubleshooting Guide and the Internetworking Design Guide For current Cisco Press titles and other information go to Cisco Press online at this URL http www ciscopress com Packet magazine is the Cisco monthly periodical that provides industry professionals with the latest information about the field of networking You can access Packet magazine at this URL http www cisco com en US about ac 123 ac114 about_cisco_packet_magazine html iQ Magazine is the Cisco monthly periodical that provides business leaders and decision makers with the lates
12. Authentication algorithms e HMAC Hashed Message Authentication Coding with MD5 Message Digest 5 hash function e HMAC with SHA 1 Secure Hash Algorithm hash function OL 5491 01 Cisco VPN Client User Guide for Linux and Solaris Chapter1 Understanding the VPN Client HZ VPN Client Features Table 1 4 IPSec Attributes continued IPSec Attribute Description Authentication Modes e Preshared Keys e Mutual group authentication e X 509 Digital Certificates Diffie Hellman Groups e Group 1 768 bit prime modulus e Group 2 1024 bit prime modulus e Group 5 1536 bit prime modulus amp Note See the Cisco VPN Client Administrator Guide for more information about DH Group 5 Encryption algorithms e 56 bit DES Data Encryption Standard e 168 bit Triple DES e AES 128 bit and 256 bit Extended Authentication XAUTH The capability of authenticating a user within IKE This authentication is in addition to the normal IKE phase 1 authentication where the IPSec devices authenticate each other The extended authentication exchange within IKE does not replace the existing IKE authentication Mode Configuration Also known as ISAKMP Configuration Method Tunnel Encapsulation Modes e IPSec over UDP NAT PAT e IPSec over TCP NAT PAT IP compression IPCOMP using Data compression algorithm LZS Authentication Features The VPN Client supports t
13. Cisco SYSTEMS VPN Client User Guide for Linux and Solaris Release 4 6 August 2004 Corporate Headquarters Cisco Systems Inc 170 West Tasman Drive San Jose CA 95134 1706 USA http www cisco com Tel 408 526 4000 800 553 NETS 6387 Fax 408 526 4100 Text Part Number OL 5491 01 SS THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE ALL STATEMENTS INFORMATION AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND EXPRESS OR IMPLIED USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California Berkeley UCB as part of UCB s public domain version of the UNIX operating system All rights reserved Copyright 1981 Regents of the University of California NOTWITHSTANDING ANY OTHER WARRANTY HEREIN ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED AS IS WITH ALL FAULTS CISCO AND THE ABOVE NAMED SUPPLIERS DISCLAIM ALL WARRANTIES EXPRESSED OR IMPLIED INCLUDIN
14. Cisco Systems Inc All Rights Reserved Client Type s Linux Running on Linux 2 4 2 2 1 Sun Apr 8 20 41 30 EDT 2001 i686 VPN tunnel information Connection Entry basic Client address 10 10 11 214 Server address 10 200 20 21 Encryption 168 bit 3 DES Authentication HMAC SHA IP Compression None NAT passthrough is inactive Local LAN Access is disabled VPN traffic summary Time connected 0 day s 00 00 01 Bytes in 0 Bytes out 0 Packets encrypted 0 Packets decrypted 0 Packets bypassed 17 Packets discarded 0 Cisco VPN Client User Guide for Linux and Solaris maa E OL 5491 01 Chapter4 Using the Command Line Interface Displaying VPN Client Statistics W Configured routes Secured Network Destination Netmask 0 0 0 0 0 0 0 0 Reset Option To reset all connection counters use the vpnclient stat reset command vpnclient stat reset Tunnel statistics have been reset Traffic Option The following is a sample output from the vpnclient stat command with the traffic option vpnclient stat traffic VPN traffic summary Time connected 0 day lt s gt 00 30 04 Bytes out 5460 Bytes in 6090 Packets encrypted 39 Packets decrypted 91 Packets bypassed 159 Packets discarded 1608 Tunnel Option The following is a sample output from the vpnclient stat command with the tunnel option The vpnclient stat tunnel command shows only tunneling information vpnclient stat tunnel IPSec tunnel
15. G WITHOUT LIMITATION THOSE OF MERCHANTABILITY FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING USAGE OR TRADE PRACTICE IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT SPECIAL CONSEQUENTIAL OR INCIDENTAL DAMAGES INCLUDING WITHOUT LIMITATION LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES CCIP CCSP the Cisco Arrow logo the Cisco Powered Network mark Cisco Unity Follow Me Browsing FormShare and StackWise are trademarks of Cisco Systems Inc Changing the Way We Work Live Play and Learn and iQuick Study are service marks of Cisco Systems Inc and Aironet ASIST BPX Catalyst CCDA CCDP CCIE CCNA CCNP Cisco the Cisco Certified Internetwork Expert logo Cisco IOS the Cisco IOS logo Cisco Press Cisco Systems Cisco Systems Capital the Cisco Systems logo Empowering the Internet Generation Enterprise Solver EtherChannel EtherSwitch Fast Step GigaStack Internet Quotient IOS IP TV iQ Expertise the iQ logo iQ Net Readiness Scorecard LightStream MGX MICA the Networkers logo Networking Academy Network Registrar Packet PIX Post Routing Pre Routing RateMUX Registrar ScriptShare SlideCast SMARTnet StrataView Plus Stratm SwitchProbe TeleRouter The Fastest Way to Increase Your Internet Quotient TransPath and VCO are regis
16. PN Client User Guide for Linux and Solaris E OL 5491 01 Displaying CHAPTER Using the Command Line Interface This chapter describes common operations using the command line interface You can create your own script files that use the CLI commands to perform routine tasks such as connect to a corporate server run reports and then disconnect from the server For more detailed information about using the VPN Client command line interface see the Cisco VPN Client Administrator Guide Also that user guide contains instructions on how to manage the Certificate Manager application from the command line a List of Commands To display a list of available VPN Client commands locate the directory that contains the VPN Client software and enter the vpnclient command at the command line prompt The following example shows the command and the information that is displayed root Linux7_1 unity vpnclient Cisco Systems VPN Client Version 4 0 int_84 Copyright C 1998 2003 Cisco Systems Inc All Rights Reserved Client Type s Linux Running on Linux 2 4 2 2 1 Sun Apr 8 20 41 30 EDT 2001 i686 Usage vpnclient connect lt profile gt user lt username gt eraseuserpwd pwd lt password gt nocertpwd vpnclient disconnect vpnclient stat reset traffic tunnel route repeat vpnclient notify Establishing a Connection amp This section describes how to establish a VPN connection using the vpnclient connect co
17. V viewing the logging files 4 6 VPN client defined 1 1 features 1 2 vpnclient connect command 3 2 vpnclient disconnect command 4 3 vpnclient stat command 4 4 VPN devices 1 1 X X 509 certificates 1 2 XAUTH extended authentication 1 6 Z zcat command 2 4 E Cisco VPN Client User Guide for Linux and Solaris OL 5491 01
18. VPN Client Versions 3 7 or earlier to continue using the ipdptp dialup interface Solaris 8 users must apply the patch from SUN that allows them to use the new pppd 4 0 driver amp Note The VPN Client supports only one PPP and one Ethernet adapter Protocol IP Tunnel protocol IPSec User Authentication e RADIUS e RSA SecurID e VPN server internal user list e PKI digital certificates e NT Domain Windows NT Program Features The VPN Client supports the program features listed in Table 1 2 Table 1 2 Program Features Program Feature Description Servers Supported e Cisco IOS devices that support Easy VPN server functionality e VPN 3000 Series Concentrators e Cisco PIX Firewall Series Local LAN access The ability to access resources on a local LAN while connected through a secure gateway to a central site VPN device if the central site grants permission I OL 5491 01 Cisco VPN Client User Guide for Linux and Solaris Chapter1 Understanding the VPN Client HI VPN Client Features Table 1 2 Program Features continued Program Feature Description Automatic VPN Client configuration option The ability to import a configuration file Event logging The VPN Client log collects events for viewing and analysis NAT Transparency NAT T Enables the VPN Client and the VPN device to automatically detect when to use IPSec over UDP to work p
19. allation process are removed If you answer no all binaries and startup scripts are removed but certificates profiles and the vpnclient ini file remain Gathering Information You Need To configure and use the VPN Client you might be required to have the following information This information is normally obtained from the system administrator of the private network you want to access The system administrator might preconfigure much of this data Hostname or IP address of the secure gateway you are connecting to Your IPSec Group Name for preshared keys Your IPSec Group Password for preshared keys The name of the certificate if authenticating with a digital certificate Your username and password if authenticating through The secure gateway s internal server A RADIUS server An NT Domain server Your username and PIN if authenticating through a token vendor The hostnames or IP addresses of the backup servers if you should configure backup server connections Verifying System Requirements This section describes system requirements for the VPN Client for each operating system Linux System Requirements amp The VPN Client for Linux supports Red Hat Version 6 2 Linux Intel or compatible libraries with glibc Version 2 1 1 6 or later using kernel Versions 2 2 12 or later Note Firewall Issues The VPN Client for Linux does not support kernel Version 2 5 prior to VPN Client Release 4 0 1 A and does
20. ble the autopush facility at startup lt dev_name gt 1 0 cipsec where dev_name is the name of the interface without the trailing numbers for example ipdtp le or hme A line is added for every supported network device detected 2 The VPN module is copied to the kernel strmod directory which is in the system s module search path The pkginfo command provides information about the installed packages For more information on other package related commands enter man pkgadd Cisco VPN Client User Guide for Linux and Solaris P28 W OL 5491 01 CHAPTER User Profiles The VPN Client uses parameters that must be uniquely configured for each remote user of the private network Together these parameters make up a user profile which is contained in a profile configuration file pcf file User profiles reside in the default directory etc CiscoSystemsVPNClient Profiles or in the directory specified during the VPN Client installation User profile parameters include the remote server address IPSec group name and password use of a log file use of backup servers and automatic connect upon startup Each connection entry has its own user profile Note User profiles for the VPN Client are interchangeable between platforms Keywords that are specific to the Windows platform are ignored by other platforms This chapter describes how to create a VPN Client user profile To set global profiles for all users refer to the Cis
21. cating encrypting and decrypting data through the tunnel For example to use a remote PC to read e mail at your organization the connection process might be similar to the following 1 Connect to the Internet Start the VPN Client Establish a secure connection through the Internet to your organization s private network ae N When you open your e mail The Cisco VPN device Uses IPSec to encrypt the e mail message Transmits the message through the tunnel to your VPN Client The VPN Client Decrypts the message so you can read it on your remote PC Uses IPSec to process and return the message to the private network through the Cisco VPN device VPN Client Features The tables in the following sections describe the VPN Client features Main Features Table 1 1 lists the VPN Client main features Cisco VPN Client User Guide for Linux and Solaris OL 5491 01 Chapter 1 Understanding the VPN Client Table 1 1 Main Features Features VPN Client Features Ml Description Operating Systems e Linux Intel e Solaris UltraSPARC 32 and 64 bit e SunBlade Connection types e Linux supports async serial PPP Internet attached Ethernet and ISDN e Solaris supports async serial PPP and Internet attached Ethernet amp Note The VPN Client no longer supports the ipdptp dialup interface used on older versions of the Solaris platform Solaris 6 and 7 users must use
22. co VPN Client Administrator Guide Sample Profile Description There are two ways to create a user profile e Use a text editor to modify the sample profile that comes with the VPN Client installer and rename it e Create a unique user profile using a text editor There is only one user profile per connection The VPN Client software is shipped with a sample user profile The file is named sample pcf The following is an example of a sample user profile that might be shipped with your installer main Description sample user profile Host 10 7 44 1 AuthType 1 GroupName monkeys EnableISPConnect 0 TSPConnectType 0 ISPConnect ISPCommand Username gawf SaveUserPassword 0 EnableBackup 0 OL 5491 01 Cisco VPN Client User Guide for Linux and Solaris Chapter3 User Profiles HZ Modifying the Sample Profile BackupServer EnableNat 0 CertStore 0 CertName CertPath CertSubjectName CertSerialHash 00000000000000000000000000000000 DHGroup 2 ForceKeepAlives 0 Modifying the Sample Profile Step 1 Step 2 Step 3 To modify the sample profile Using a text editor open the sample user profile Modify the keywords you want to change See your administrator for IP addresses user name and any security information Save your new profile with a unique name in the etc CiscoSystems VPNClient Profiles directory When you use the vpnclient connect command to establish a connection use your new profile name C
23. cript Enter the following command pkgadd d vpnclient The default directories for the binaries kernel VPN modules and profiles are listed during the installation process You receive the following prompts during the installation e Directory where binaries will be installed usr local bin e Is the above correct y e If the installer finds a conflict with the VPN Client files and another application you receive this message The following files are already installed on the system and are being used by another package lt installer lists files gt Do you want to install these conflicting files y n q e The following files are being installed with setuid and or setgid permissions lt installer lists files gt Do you want to install these as setuid setgid files y n q e This package contains scripts which will be executed with super user permission during the process of installing this package Do you want to continue with the installation of lt vpnclient gt y n Press Enter to choose the default response At the directory prompts if you do not choose the default you must enter another directory in your user s path Restart your computer I OL 5491 01 Cisco VPN Client User Guide for Linux and Solaris Chapter 2 Installing the VPN Client HZ Installing the Software VPN Client for Solaris Install Script Notes During the installation process 1 The following line is added to the etc iu ap file to ena
24. d Cisco service contract have complete access to the technical support resources on the Cisco TAC website Some services on the Cisco TAC website require a Cisco com login ID and password If you have a valid service contract but do not have a login ID or password go to this URL to register http tools cisco com RPF register register do If you are a Cisco com registered user and you cannot resolve your technical issues by using the Cisco TAC website you can open a case online at this URL http www cisco com en US support index html If you have Internet access we recommend that you open P3 and P4 cases through the Cisco TAC website so that you can describe the situation in your own words and attach any necessary files Cisco TAC Escalation Center The Cisco TAC Escalation Center addresses priority level 1 or priority level 2 issues These classifications are assigned when severe network degradation significantly impacts business operations When you contact the TAC Escalation Center with a P1 or P2 problem a Cisco TAC engineer automatically opens a case To obtain a directory of toll free Cisco TAC telephone numbers for your country go to this URL http www cisco com warp public 687 Directory DirTAC shtml I OL 5491 01 Cisco VPN Client User Guide for Linux and Solaris About This Guide HZ Obtaining Additional Publications and Information Before calling please check with your network operations center to determine
25. e notification from the VPN remote access device it logs the notification but takes no further action To receive auto update messages and other notifications from the network administrator use the vpnclient notify command The following example shows the vpnclient notify command and an example of an auto update notification from the VPN device root Linux8 vpnclient vpnclient notify Cisco Systems VPN Client Version 3 7 Rel Copyright C 1998 2002 Cisco Systems Inc All Rights Reserved Client Type s Linux Running on Linux 2 4 18 14 1 Wed Sep 4 13 35 50 EDT 2002 i686 Notification Your network administrator has placed an update of the Cisco Systems VPN Client at the following location http fake cisco com root Linux8 vpnclient OL 5491 01 Cisco VPN Client User Guide for Linux and Solaris Chapter4 Using the Command Line Interface E Event Logging Cisco VPN Client User Guide for Linux and Solaris mae W OL 5491 01 A aggressive mode 1 5 algorithms authentication 1 5 data compression 1 6 encryption 1 6 authentication algorithms 1 5 extended 1 6 features 1 6 mode 1 6 type 3 3 backup server 3 4 batch files erasing saved password 4 2 Cc certificate distinguished name 3 5 hash of contents 3 5 name 3 4 path name 3 5 peer 1 7 store 3 4 command line interface connect 3 2 disconnect 4 3 displaying commands 4 1 INDEX logging 4 6 notify 4 7 stat 4 4
26. ent window to the background the tunnel disconnects when the first rekey occurs The VPN Client responds to rekey triggers based on time not data If you want VPN Client connections rekeyed you must configure the concentrator so that the IKE proposal is set to rekey every 1800 seconds and IPSec parameters are set to rekey every 600 seconds DNS Server Settings amp You can configure the concentrator to send the IP addresses of DNS servers to the VPN Client to use during tunnel sessions If the client receives the DNS server settings it copies the file etc resolv conf to a backup file etc resolv conf vpnbackup When the tunnel closes the original contents of etc resolv conf are restored Note Refer to the configuration guide for your VPN device for information on DNS server settings Disconnecting the VPN Client This section describes methods for disconnecting the VPN Client To disconnect from your session use one of the following methods e Enter the following command vpnelient disconnect The following example shows the command that disconnects you from your secure connection and the prompts that appear root Linux7_1 clients vpnclient disconnect Cisco Systems VPN Client Version 4 0 int_84 Copyright C 1998 2003 Cisco Systems Inc All Rights Reserved Client Type s Linux Running on Linux 2 4 2 2 1 Sun Apr 8 20 41 30 EDT 2001 i686 Disconnecting the VPN connection Your VPN connection has been term
27. g Identifies the certificate used to connect to the VPN device The maximum length is 129 alphanumeric characters E Cisco VPN Client User Guide for Linux and Solaris OL 5491 01 _ Chapter 3 User Profiles Creating a User Profile W Table 3 1 User Profile Keywords continued Keywords Description CertPath String The path name of the directory containing the certificate file The maximum length is 259 alphanumeric characters CertSubjectName String The qualified Distinguished Name DN of the certificate s owner You can either not include this keyword in the user profile or leave this entry blank CertSerialHash String A hash of the certificate s complete contents which provides a means of validating the authenticity of the certificate You can either not include this keyword in the user profile or leave this entry blank DHGroup 1121 5 Allows a network administrator to override the configured group value used to generate Diffie Hellman key pairs on a VPN device e 1 modp group 1 e 2 modp group 2 e 5 modp group 5 The default is 2 The VPN Concentrator configuration for IKE Proposal must match the DHGroup in the VPN Client If the AuthType is set to 3 digital certificate this keyword has no effect on the VPN Client I OL 5491 01 Cisco VPN Client User Guide for Linux and Solaris Chapter3 User Profiles WE Creating a User Profile Cisco V
28. he authentication features listed in Table 1 5 Table 1 5 Authentication Features Authentication Feature Description User authentication through VPN central site device e Internal through the VPN device s database e RADIUS e NT Domain Windows NT e RSA formerly SDI SecurID or SoftID Certificate Management Allows you to manage the certificates in the certificate stores Certificate Authorities CAs CAs that support PKI SCEP enrollment Cisco VPN Client User Guide for Linux and Solaris OL 5491 01 Chapter1 Understanding the VPN Client VPN Client Features W Table 1 5 Authentication Features Authentication Feature Description Ability to authenticate using Physical SecurID cards or keychain fobs for passcode generation smart cards Peer Certificate Distinguished Prevents a VPN Client from connecting to an invalid gateway by Name Verification using a stolen but valid certificate and a hijacked IP address If the attempt to verify the domain name of the peer certificate fails the VPN Client connection also fails Cisco VPN Client User Guide for Linux and Solaris oL 5491 01 EN Chapter1 Understanding the VPN Client HZ VPN Client Features Cisco VPN Client User Guide for Linux and Solaris OL 5491 01 CHAPTER Installing the VPN Client This chapter describes how to install the VPN Client software on your workstation You should be familiar wi
29. in the user profile but it does not create an encrypted version encUserPassword String Displays the user password in the user profile in its encrypted form It is binary data represented as alphanumeric text SaveUserPassword 0 1 Determines if the user password or its encrypted form are valid in the user profile e 0 the default displays the user password in clear text in the user profile and is saved locally e 1 displays the user password in the user profile in its encrypted version and the password is not saved locally This value is set in the VPN device not in the VPN Client I OL 5491 01 Cisco VPN Client User Guide for Linux and Solaris Chapter3 User Profiles WE Creating a User Profile Table 3 1 Keywords User Profile Keywords continued Description EnableBackup 0 1 Specifies to use a backup server if the primary server is not available e 0 the default disables the backup server e 1 enables the backup server You must also specify a BackupServer BackupServer P_Address or hostname List of IP addresses or hostnames of backup servers Separate multiple entries by commas The maximum length of hostname is 255 alphanumeric characters EnableLocalLAN 0 1 Allows you to configure access to your local LAN e 0 the default disables local LAN access e 1 enables local LAN access amp Note To allow local LAN access it must
30. inated e Press Crtl C while you are in the VPN Client window OL 5491 01 Cisco VPN Client User Guide for Linux and Solaris Chapter4 Using the Command Line Interface HZ Displaying VPN Client Statistics Displaying VPN Client Statistics Examples No Options This section describes the VPN Client statistics command vpnclient stat and its optional parameters To generate status information about your connection enter the following command vpnclient stat reset traffic tunnel route repeat If you enter this command without any of the optional parameters the vpnclient stat command displays all status information The optional parameters are described in Table 4 2 Table 4 2 Optional Parameters for the vpnclient stat Command Parameter Description reset Restarts all connection counts from zero traffic Displays a summary of bytes in and out packets encrypted and decrypted and packets bypassed and discarded tunnel Displays IPSec tunneling information route Displays configured routes repeat Provides a continuous display refreshing it every few seconds To end the display press Ctrl C This section shows examples of output from the different options for the vpnclient stat command The following is a sample output from the vpnclient stat command with no options root Linux7_1 clients vpnclient stat Cisco Systems VPN Client Version 4 0 int_84 Copyright C 1998 2003
31. information Client address 220 111 22 30 Server address 10 10 10 1 Encryption 168 bit 3 DES Authentication HMAC MD5 IP Compression None NAT passthrough is active on port 5000 Route Option The following is a sample output from the vpnclient stat command with the route option vpnclient stat route Configured routes Secured Network Destination Netmask Bytes 10 10 02 02 255 255 255 255 17638 0 0 0 0 0 0 0 0 18998 Cisco VPN Client User Guide for Linux and Solaris oL 5491 01 E Chapter4 Using the Command Line Interface HZ Event Logging amp Note The maximum size of any VPN client statistics is 4 294 967 296 Once the VPN Client software reaches this limit the statistics rolls back to zeroand starts again Event Logging This section provides information on event logging including how to capture and view logging information Enabling Logging You must be a system administrator or have access to the global profile vpnclient ini to enable logging To enable logging set EnableLog 1 To disable logging set EnableLog 0 The global profile located in etc CiscoSystems VPNClient vpnclient ini must include the following parameters main BinDirPath usr local bin EnableLog 1 LOG IKE LogLevel 15 LOG CM LogLevel 3 LOG CVPND LogLevel 3 LOG XAUTH LogLevel 3 LOG CERT LogLevel 3 LOG IPSEC LogLevel 15 LOG CLI LogLevel 3 LOG PPP LogLevel 1 LOG DIALER LogLeve
32. ing a Root Certificate with the Installation Package Linux 2 3 Bundling a Root Certificate with the Installation Package Solaris 2 3 Solaris System Requirements 2 4 Changing a Kernel Version 2 4 Unpacking the VPN Client Files 2 4 Installing the Software 2 5 Installing the VPN Client for Linux 2 5 Kernel Source Requirements 2 6 VPN Client for Linux Install Script Notes 2 6 Installing the VPN Client for Solaris 2 7 VPN Client for Solaris Install Script Notes 2 8 User Profiles 3 1 Sample Profile Description 3 1 Modifying the Sample Profile 3 2 Creating a User Profile 3 2 Using the Command Line Interface 4 1 Displaying a List of Commands 4 1 Establishing a Connection 4 1 Authentication Prompts 4 2 Rekeying Issues 4 3 DNS Server Settings 4 3 Disconnecting the VPN Client 4 3 Displaying VPN Client Statistics 4 4 Examples 4 4 No Options 4 4 Reset Option 4 5 Traffic Option 4 5 Tunnel Option 4 5 Route Option 4 5 Event Logging 4 6 Enabling Logging 4 6 Viewing Log Files 4 6 Client Auto Update Messages 4 7 INDEX Cisco VPN Client User Guide for Linux and Solaris a E OL 3272 02 Audience Contents About This Guide This guide describes how to install use and manage the Cisco VPN Client for the following operating systems e Linux for Intel Red Hat Version 6 2 or later or compatible libraries with glibc Version 2 1 1 6 or later using kernel Versions 2 2 12 or later e Solaris UltraSPARC 5 e SunBlade This guide
33. l 1 LOG FIREWALL LogLevel 1 LOG GUTI LogLevel 1 The VPN Client for Linux and Solaris supports log levels from 1 lowest to 15 highest For more information about the global profile refer to the Cisco VPN Client Administrator Guide Cisco VPN Client User Guide for Linux and Solaris Poe E OL 5491 01 _ Chapter 4 Using the Command Line Interface Event Logging W Viewing Log Files amp To view logging information enter the following command usr local bin ipseclog directory clientlog txt Note If you did not use the default directory usr local bin during installation you must enter logging commands using your chosen path When you launch the ipseclog application it appends any previous ipseclog files To view logging information in real time enter the following command after you start the ipseclog tail f directory clientlog txt The ipseclog does not automatically go to the background To send the ipseclog to the background press Ctrl Z and enter the bg on the command line or enter the ampersand symbol amp at the end of the view command as shown in the following example usr local bin ipseclog directory clientlog txt amp If the ipseclog is in the background you must send it to the foreground before you end the VPN Client application To send the ipseclog to the foreground enter fg on the command line Client Auto Update Messages When the VPN Client receives an auto updat
34. lease 4 6 e Cisco VPN 3000 Series Concentrator Getting Started Guide Release 4 1 e Cisco VPN 3000 Series Concentrator Reference Volume I Configuration Release 4 1 e Cisco VPN 3000 Series Concentrator Reference Volume II Administration and Monitoring Release 4 1 Terminology In this user guide e The term Cisco VPN device refers to the following Cisco products Cisco IOS devices that support Easy VPN server functionality VPN 3000 Series Concentrators Cisco PIX Firewall Series e The term PC refers generically to any personal computer Document Conventions This guide uses the following typographic conventions e Boldface font Describes user actions and commands e Italic font Describes arguments that you supply the values for e Screen font Describes terminal sessions and information displayed by the system e Boldface screen font Describes information that you must enter N Note Means reader take note Notes contain helpful suggestions or references to material not covered in the manual A Caution Means reader be careful In this situation you might do something that could result in equipment damage or loss of data Cisco VPN Client User Guide for Linux and Solaris lt a OL 5491 01 About This Guide Data Formats Obtaining Documentation W When you configure the VPN Client enter data in these formats unless the instructions indicate otherwise e IP Address Use standard 4 byte
35. mmand and optional command parameters Note If you are connecting to a VPN device by using Telnet or SSH check to see if the device allows split tunneling If it does not you lose connectivity to your VPN device after making a VPN connection OL 5491 01 Cisco VPN Client User Guide for Linux and Solaris E Chapter4 Using the Command Line Interface W Establishing a Connection To establish a connection enter the following command vpnclient connect lt profile gt user lt username gt eraseuserpwd pwd lt password gt nocertpwd The parameters for the vpnclient connect command are described in Table 4 2 Table 4 1 Parameters for the vpnclient connect Command Parameter Description lt profile gt required The name of the user profile configured for this connection entry pcf file Enter the profile name without the pcf file extension If your profile name contains spaces enclose it in double quotation marks on the command line user lt username gt optional The username configured for this connection entry If you use this option with the pwd option the username prompt is suppressed in the authentication dialog box eraseuserpwd pwd e eraseuserpwd erases the user password that is saved on the lt password gt optional VPN Client workstation forcing the VPN Client to prompt you for a password each time you establish a connection e pwd lt password gt suppresses the password p
36. not support SMP multiprocessor kernels in any release of the VPN Client If you are running a Linux firewall for example ipchains or iptables be sure that the following types of traffic are allowed to pass through UDP port 500 Cisco VPN Client User Guide for Linux and Solaris P22 E OL 5491 01 Chapter 2 Installing the VPN Client Verifying System Requirements W e UDP port 10000 or any other port number being used for IPSec UDP e IP protocol 50 ESP e TCP port configured for IPSec TCP e NAT T Standards Based NAT Transparency port 4500 Troubleshooting Tip The following two lines might be added by default with your Linux installation in the etc sysconfig ipchains directory For Red Hat this might be written to the etc sysconfig ipchains directory These two commands might prevent UDP traffic from passing through A input p udp s 0 0 d 0 0 0 1023 j REJECT A input p udp s 0 0 d 0 0 2049 j REJECT If you have problems with UDP traffic try one of the following solutions e First delete the above two reject lines then enter the following two commands etc init d ipchains stop etc init d ipchains start amp Note The ipchains might be replaced by iptables or it might be located in a different directory on your Linux distribution e Add the following rule to the default ipchains firewall configuration or add it above any UDP reject line A input p udp s 0 0 d 0 0 500 j ACCEPT
37. o com at this URL http www cisco com Technical Assistance Center The Cisco TAC is available to all customers who need technical assistance with a Cisco product technology or solution Two levels of support are available the Cisco TAC website and the Cisco TAC Escalation Center The avenue of support that you choose depends on the priority of the problem and the conditions stated in service contracts when applicable We categorize Cisco TAC inquiries according to urgency e Priority level 4 P4 You need information or assistance concerning Cisco product capabilities product installation or basic product configuration e Priority level 3 P3 Your network performance is degraded Network functionality is noticeably impaired but most business operations continue e Priority level 2 P2 Your production network is severely degraded affecting significant aspects of business operations No workaround is available e Priority level 1 P1 Your production network is down and a critical impact to business operations will occur if service is not restored quickly No workaround is available Cisco TAC Website You can use the Cisco TAC website to resolve P3 and P4 issues yourself saving both cost and time The site provides around the clock access to online tools knowledge bases and software To access the Cisco TAC website go to this URL http www cisco com tac All customers partners and resellers who have a vali
38. ocumentation The CD ROM package is available as a single unit or through an annual subscription Registered Cisco com users can order the Documentation CD ROM product number DOC CONDOCCD gt through the online Subscription Store http www cisco com go subscription Ordering Documentation You can find instructions for ordering documentation at this URL http www cisco com univercd cc td doc es_inpck pdi htm I OL 5491 01 Cisco VPN Client User Guide for Linux and Solaris About This Guide W Obtaining Technical Assistance You can order Cisco documentation in these ways e Registered Cisco com users Cisco direct customers can order Cisco product documentation from the Networking Products MarketPlace http www cisco com en US partner ordering index shtml e Registered Cisco com users can order the Documentation CD ROM Customer Order Number DOC CONDOCCD through the online Subscription Store http www cisco com go subscription e Nonregistered Cisco com users can order documentation through a local account representative by calling Cisco Systems Corporate Headquarters California U S A at 408 526 7208 or elsewhere in North America by calling 800 553 NETS 6387 Documentation Feedback You can submit comments electronically on Cisco com On the Cisco Documentation home page click Feedback at the top of the page You can e mail your comments to bug doc cisco com You can submit your comments b
39. reating a User Profile You can create your own user profile from scratch by using any text editing program At a minimum you need the following keywords listed in your profile e main e Host e AuthType e GroupName e Username Save your new profile in the etc CiscoSystems VPNClient Profiles directory See your administrator for IP addresses user names and any security information Table 3 1 describes keywords that can be in a user profile User profile keywords are not case sensitive unless indicated in the description Table 3 1 User Profile Keywords Keywords Description main A required keyword that identifies the main section Enter exactly as shown as the first entry in the user profile Description String This optional keyword describes this user profile The maximum length is 246 alphanumeric characters Cisco VPN Client User Guide for Linux and Solaris OL 5491 01 Chapter3 User Profiles Creating a User Profile W Table 3 1 User Profile Keywords continued Keywords Description Host P_Address or hostname The hostname or IP address of the VPN device you want to connect with The maximum length of the hostname is 255 alphanumeric characters AuthType 11315 The authentication type that this user is using e 1is preshared keys e 3isa digital certificate using an RSA signature e 5 is mutual group authentication If you select AuthType 1 or AuthType 5 you m
40. rompt in the authentication dialog box nocertpwd optional Suppresses the prompt for a certificate password and assumes that the password is blank If you use this option you cannot set a password for your certificate For more information see the Managing Digital Certificates from the Command Line in the VPN Client Administrator Guide amp Note If your user profile is configured with the SaveUserPassword keyword set to the default the password is saved locally For more information on profiles see Chapter 3 User Profiles Authentication Prompts Depending on your user profile you are prompted for the following passwords e Group password e User name e User password e Certificate password If your VPN Client has been configured to use SecurID or RADIUS authentication you are also prompted for those passwords See your administrator for security information Cisco VPN Client User Guide for Linux and Solaris P42 E OL 5491 01 Chapter4 Using the Command Line Interface Disconnecting the VPN Client W Rekeying Issues When the connection is established the VPN Client window stays in the foreground to allow the VPN Client to be reauthenticated during a rekey by the VPN device To send the VPN Client window to the background press Ctrl Z and enter the bg command at the command line prompt If the VPN device you are connecting to is configured to support rekeying and you send the VPN Cli
41. roperly in port address translation PAT environments Update of centrally controlled backup server list The VPN Client learns the backup VPN server list when the connection is established This feature is configured on the VPN device and pushed to the VPN Client The backup servers for each connection entry are listed on the Backup Servers tab Set MTU size The VPN Client automatically sets a size that is optimal for your environment However you can also set the MTU size manually For information on adjusting the MTU size see the Cisco VPN Client Administrator Guide Support for Dynamic DNS DDNS host name population The VPN Client sends its host name to the VPN device when the connection is established If this occurs the VPN device can send the host name in a DHCP request This causes the DNS server to update its database to include the new host name and VPN Client address Notifications Software update notifications from the VPN server upon connection Delete with reason The VPN Client provides you with a reason code or reason text when a disconnect occurs The VPN Client supports the delete with reason function for client initiated disconnects concentrator initiated disconnects and IPSec deletes e If you are using a GUI VPN Client a pop up message appears stating the reason for the disconnect the message is appended to the Notifications log and is logged in the IPSec log Log Viewer window
42. sco VPN Client User Guide for Linux and Solaris OL 5491 01 notifications from VPN device 1 4 notify command 4 7 O operating systems supported 1 1 P password group 3 3 IPSec group 3 3 overriding 4 2 string 3 3 user profile 3 3 peer certificate 1 7 peer timeout 3 4 platforms not supported 1 1 ports TCP 3 4 preconfigured keys 2 2 prerequisites passwords 2 2 profiles 3 1 program features 1 3 Index W Red Hat Software 2 2 root certificate installing automatically on Linux 2 3 installing automatically on Solaris 2 3 S SA security association 1 4 save user password 3 3 shared keys authentication type 3 3 Diffie Hellman group 3 5 single SA 1 4 smart cards 1 7 split DNS 1 5 split tunneling 1 4 1 5 statistics 4 4 subinterfaces limitations 1 1 supported VPN devices 1 1 system adminstrator 2 2 system requirements 2 2 T protocols DHCP 1 4 tarcommand 2 4 IKE 1 1 TCP protocol 3 4 IP 1 3 terminate connections 1 1 PPP 1 3 transparent tunneling 1 5 TCP 3 4 tunneling UDP 1 4 2 3 encapsulation mode 1 6 protocol 1 3 split 1 5 Cisco VPN Client User Guide for Linux and Solaris oL 5491 01 Zins W index U UDP protocol 1 4 UltraSPARC computer 2 4 uninstalling an old client 2 1 unpacking the VPN client files 2 4 user authentication 1 3 1 6 user name 3 3 user password 3 3 user profiles creating 3 2 described 3 1 example 3 1 location 3 1 parameters 3 2
43. service 4 The links etc rc3 d s85vpnclient and etc rc5 d s85vpnclient are added to run level 3 and level 5 if startup at boot time is requested These links allow the tunnel server to start at boot time and run in levels 3 and 5 Cisco VPN Client User Guide for Linux and Solaris P26 W OL 5491 01 Chapter2 _ Installing the VPN Client Installing the Software W Installing the VPN Client for Solaris Before you install a new version of the VPN Client or before you reinstall your current version you must uninstall the old VPN Client See the Uninstalling an Old Client section on page 2 1 for more information Note Step 1 Step 2 Step 3 Step 4 If you are installing the VPN Client for Solaris Release 3 7 or later on a Version 2 6 Solaris platform you receive the following message during the VPN Client installation Patch 105181 version 29 or higher to Solaris 2 6 is required for the client to function properly Installing without this patch will cause the kernel to crash as soon as the client kernel module is loaded This patch is available from Sun as part of the Recommended Solaris Patch Cluster If you proceed with installation the kernel module will not be enabled After you have installed the patch you may enable the kernel module by 299 uncommenting all lines in etc iu ap that contain cipsec To install the VPN Client for Solaris Obtain superuser privileges to run the install s
44. t information about the networking industry You can access iQ Magazine at this URL http business cisco com prod tree taf 3fasset_id 44699 amp public_view true amp kbns 1 html Internet Protocol Journal is a quarterly journal published by Cisco Systems for engineering professionals involved in the design development and operation of public and private internets and intranets You can access the Internet Protocol Journal at this URL http www cisco com en US about ac 123 ac 147 about_cisco_the_internet_protocol_journal html Training Cisco offers world class networking training with current offerings in network training listed at this URL http www cisco com en US learning le3 learning_recommended_training_list html Cisco VPN Client User Guide for Linux and Solaris OL 5491 01 Understanding the VPN Client The Cisco VPN Client is a software application that runs on computers using any of the following operating systems e Linux for Intel Red Hat Version 6 2 or later or compatible libraries with glibc Version 2 1 1 6 or later using kernel Versions 2 2 12 or later e Solaris UltraSPARC 5 e SunBlade The following platforms are not supported e SunRay e SunFire Series e Netra Series e Tadpole Solaris and Linux VPN Clients support only single interface FastEthernet network adapters These VPN Clients do not support multiport adapters such as dual and quad FastEthernet Note The VPN Client for Solaris can recei
45. tered trademarks of Cisco Systems Inc and or its affiliates in the U S and certain other countries All other trademarks mentioned in this document or Web site are the property of their respective owners The use of the word partner does not imply a partnership relationship between Cisco and any other company 0304R Cisco VPN Client User Guide for Linux and Solaris Copyright 2004 Cisco Systems Inc All rights reserved About This Guide v Audience v Contents v Related Documentation vi Terminology vi Document Conventions vi Data Formats vii Obtaining Documentation vii Cisco com vii Documentation CD ROM vii Ordering Documentation vii Documentation Feedback viii Obtaining Technical Assistance viii Cisco com viii Technical Assistance Center ix Cisco TAC Website ix Cisco TAC Escalation Center ix Obtaining Additional Publications and Information Understanding the VPN Client 1 1 VPN Client Overview 1 1 VPN Client Features 1 2 Main Features 1 2 Program Features 1 3 IPSec Features 1 5 IPSec Attributes 1 5 Authentication Features 1 6 Installing the VPN Client 2 1 Uninstalling an Old Client 2 1 Uninstalling a VPN Client for Solaris 2 1 Uninstalling a VPN Client for Linux 2 1 Gathering Information You Need 2 2 Verifying System Requirements 2 2 Linux System Requirements 2 2 Firewall Issues 2 2 Cisco VPN Client User Guide for Linux and Solaris OL 3272 02 Contents E Contents Troubleshooting Tip 2 3 Bundl
46. th software installation on UNIX computers to perform this procedure The VPN Client consists of e A driver which is a loadable module e A set of commands accessible through your shell which is used to access the applications The commands and some parts of the driver are distributed in binary form only Uninstalling an Old Client This section describes how to uninstall the VPN Client e You must uninstall an old VPN Client for Solaris before you install a new VPN Client e You are not required to uninstall an old VPN Client for Linux before you install a new VPN Client e You must uninstall any VPN 5000 Client before you install a VPN Client Refer to the Cisco VPN 5000 Client documentation for more information Uninstalling a VPN Client for Solaris If a VPN Client for Solaris was previously installed you must remove the old VPN Client before you install a new one To uninstall a package use the pkgrm command For example pkgrm vpnclient Uninstalling a VPN Client for Linux To uninstall the VPN Client for Linux Step 1 Run the following command sudo usr local bin vpn_uninstall Step2 You are prompted to remove all profiles and certificates Cisco VPN Client User Guide for Linux and Solaris oL 5491 01 EN Chapter2 Installing the VPN Client HZ Gathering Information You Need If you answer yes all binaries startup scripts certificates profiles and any directories that were created during the inst
47. un the install script Step2 Enter the following commands cd vpnclient vpn_install The default directories for the binaries kernel VPN modules and profiles are listed during the installation process You receive the following prompts during the installation e Directory where binaries will be installed lib modules lt kernel version gt build e Automatically start the VPN service at boot time yes e Directory containing linux kernel source code usr src linux e Is the above correct y Step3 Press Enter to choose the default response At the directory prompts if you do not choose the default you must enter another directory in your user s path Step4 If the installer cannot auto detect these settings you might receive the following prompts e Directory containing init scripts The directory where scripts that are run at boot time are kept Typically this is etc init d or etc rc d init d Cisco VPN Client User Guide for Linux and Solaris oL 5491 01 EN Chapter 2 Installing the VPN Client HZ Installing the Software e Directory containing run level directories rcX d The directory that contains init s run level directories Typically this is etc or etc re d Step5 Enable the VPN service by using one of the following methods e Restart your computer e Enable the service without restarting Enter the following command etc rce d init d vpnclient_init start Kernel Source Requirements To
48. ust also configure the GroupName and GroupPwd To use AuthType5 you must have a root certificate on your VPN Client system For information on how to install a root certificate automatically on your specific platform see Installing the VPN Client GroupName String The name of the IPSec group configured on the VPN device that contains this user The maximum length is 32 alphanumeric characters This keyword is case sensitive GroupPwd String The password for the IPSec group that contains this user The minimum length is 4 alphanumeric characters The maximum is 32 This keyword is case sensitive and entered in clear text encGroupPwd String Displays the group password in the user profile in its encrypted form It is binary data represented as alphanumeric text Username String The name that identifies a user as a valid member of the IPSec group specified in GroupName The VPN Client prompts the user for this value during user authentication The maximum length is 32 alphanumeric characters This keyword is case sensitive and entered in clear text UserPassword String This password is used during extended authentication e If SaveUserPassword is enabled the first time the VPN Client reads this password it is saved in the user profile as encUserPassword and the clear text version is deleted e If SaveUserPassword is disabled the VPN Client deletes the clear text version of the user password
49. ve no greater than 20 subinterfaces IP addresses assigned to the same machine The VPN Client on a remote PC communicating with a Cisco VPN device on an enterprise network or with a service provider creates a secure connection over the Internet This connection allows you to access a private network as if you were an on site user creating a virtual private network VPN The following VPN devices can terminate VPN connections from VPN Clients e Cisco IOS devices that support Easy VPN server functionality e VPN 3000 Series Concentrators e Cisco PIX Firewall Series VPN Client Overview The VPN Client works with a Cisco VPN device to create a secure connection called a tunnel between your computer and a private network It uses Internet Key Exchange IKE and IP Security IPSec tunneling protocols to establish and manage the secure connection Cisco VPN Client User Guide for Linux and Solaris oL 5491 01 EN Chapter1 Understanding the VPN Client HZ VPN Client Features The steps used to establish a VPN connection can include e Negotiating tunnel parameters addresses algorithms lifetime e Establishing VPN tunnels according to the parameters e Authenticating users from usernames group names and passwords and X 509 digital certificates e Establishing user access rights hours of access connection time allowed destinations allowed protocols e Managing security keys for encryption and decryption e Authenti
50. y mail by using the response card behind the front cover of your document or by writing to the following address Cisco Systems Attn Customer Document Ordering 170 West Tasman Drive San Jose CA 95134 9883 We appreciate your comments Obtaining Technical Assistance Cisco provides Cisco com which includes the Cisco Technical Assistance Center TAC Website as a starting point for all technical assistance Customers and partners can obtain online documentation troubleshooting tips and sample configurations from the Cisco TAC website Cisco com registered users have complete access to the technical support resources on the Cisco TAC website including TAC tools and utilities Cisco com Cisco com offers a suite of interactive networked services that let you access Cisco information networking solutions services programs and resources at any time from anywhere in the world Cisco com provides a broad range of features and services to help you with these tasks e Streamline business processes and improve productivity e Resolve technical issues with online support e Download and test software packages e Order Cisco learning materials and merchandise e Register for online skill assessment training and certification programs Cisco VPN Client User Guide for Linux and Solaris xi OL 5491 01 About This Guide Obtaining Technical Assistance W To obtain customized information and service you can self register on Cisc
Download Pdf Manuals
Related Search