-
VPN Client Administrator Guide, Release 4.6
-
Preface
-
Configuration Information for an Administrator
-
Preconfiguring the VPN Client for Remote Users
-
Updating VPN Client Software
-
Configuring Automatic VPN Initiation-- Windows Only
-
Using the VPN Client Command-Line Interface
-
Managing Digital Certificates from the Command Line
-
Customizing the VPN Client Software
-
Troubleshooting and Programmer Notes
-
Windows Installer (MSI) Information
-
Index
-
Table Of Contents
A - B - C - D - E - F - G - H - I - K - L - M - N - O - P - R - S - T - U - V - W - X - Z
Index
A
activating an IKE proposal 1-4
adding an SA 1-4
AppendOriginalSuffix Option parameter 2-16
ApplicationLauncher parameters 2-10
authentication
mutual group
authentication types 1-20
types 2-20
authentication parameters (.pcf file) 2-21
AuthType parameter (.pcf file) 2-20
auto initiation 4-5
AutoInitiationEnable (vpnclient.ini) 2-6, 4-3
AutoInitiationList (vpnclient.ini) 2-7, 4-3
AutoInitiationRetryInterval (vpnclient.ini) 2-6, 4-3
AutoInitiationRetry IntervalType (vpnclient.ini) 2-7
AutoInitiationRetryIntervalType (vpnclient.ini) 4-3
AutoInitiationRetry Limit (vpnclient.ini) 2-7
configuring 4-1
connect parameter 4-3
creating in vpnclient.ini file 4-3
examples 4-4
excluding networks from 4-3
parameters 4-1
automatic browser configuration
configuring on VPN Concentrator 1-17
autoupdating VPN Client software
creating configuration file 3-6
creating profile distribution package 3-7
enabling on VPN Concentrator 3-3
how it works 3-8
managing 3-3
Windows 2000 and Windows XP 3-2
AYT firewall policy 1-7
B
BackupServer parameter (.pcf file) 2-22
backup servers
configured on VPN Concentrator for VPN Client 1-16
Baltimore Technologies 1-5
bitmaps
BlackIce Defender
firewall on remote PC 1-7
bmp files
for installation 7-2
setup 7-5
branding software
see customizing VPN Client software
brand parameters (oem.ini file) 7-6
browser proxy configuration 1-17
bypassing DHCP server 2-8
C
Centralized Protection Policy (CPP) 1-6
certificate
connecting 1-5
contents 6-2
enrolling a CA 6-6
enrollment 6-2
PKI 1-5
example 6-3
management 6-1
management operations 6-4
passwords 6-3
root 6-2
store 6-1
tags 6-4
user 6-1
Certificate Authorities (CA)
supported 1-5
certificates
enrollment
IP address 2-9
parameters (vpnclient.ini) 2-9
Entrust 1-18
group name requirement 1-4
organization unit field 1-4
parameters (.pcf files) 2-24
VPN Client connections
configuring VPN concentrator 1-4
change password operation 6-6
changing method of initializing VA 2-7
changing the MTU size 8-5
Cisco Integrated Client
scenario 1-8
VPN Client software 1-6
Cisco Security Agent
firewall on the remote PC 1-7
client/server firewall 1-7
client update on VPN Concentrator 3-3
command-line interface
error messages 5-11
minimum argument 6-1
command-line switches
vpngui 8-10
commands
logging options 9-3
vpnclient
connect 5-2
disconnect 5-6
displaying a list 5-1
notify 5-4
stat 5-6
verify autoinitconfig 5-5
vpngui
command-line switches 8-10
company logo
logo.png 7-9
configuration parameters
global profile 2-3
individual profiles 2-20
configurations
client/server 1-11
configuring
auto initiation 4-1
backup servers for VPN Client 1-16
browser proxy 1-17
Entrust certificate 1-18
local LAN access for VPN Client 1-14
NAT-T 1-16
personal firewalls 1-5
RADIUS SDI authentication 2-16
connected.png
lock image on active connection entry 7-9
connecting from command line
vpngui command 8-10
connection
ending 5-6
getting status 5-6
profiles 2-17
starting with vpnclient command 5-2
testing 8-9
connection entry
default 2-13
features controlled 2-17
file 2-18
preconfigured
distributing 2-26
sample .pcf file 2-17
connection-specific DNS suffix 2-14
connect on open
activating 2-13
ConnectOnOpen (vpnclient.ini) 2-7
continuous display (stat command) 5-7
CPP
defining filters and rules 1-10
creating 7-10
connection profiles 2-17
Entrust profile 1-18
global profile 2-2
IPSec group in VPN Concentrator 1-2
MSI transform 7-10
oem.ini file 7-5
user profiles in VPN Concentrator 1-3
customizing VPN Client software
areas affected by 7-2
for MSI 7-10
menu titles and text 7-3
oem.ini file 7-5
setup bitmap 7-2
VPN Dialer application 7-4
D
data formats xii
default connection entry
connect on open 2-7
default user profile 2-13
DefGroup parameter (oem.ini file) 7-7
defining rules for firewalls 1-10
delete operation 6-5
Description parameter (.pfc file) 2-20
DHCP inbound traffic
stateful firewall 1-6
DHCP server
bypassing 2-8
DHGroup parameter (.pcf files) 2-25
DialerDisconnect parameter (vpnclient.ini) 2-6
dialer parameters (oem.ini file) 7-7
differences between InstallShield and MSI 9-1
directory
Disable Fast Shutdown option 8-5
DisableKerberosOverTCP (oem.ini file) 7-6
displaying
information continuously 5-7
notifications 5-4
route information 5-7
distributing new profiles 3-7
distributing preconfigured software 2-26
DNS parameters 2-10
DNS suffix
connection-specific 2-14
primary 2-14
Windows platforms 2-13
documentation
additional x
cautions xii
notes xii
E
elevated privileges (installing MSI) 9-2
EnableBackup parameter (.pcf file) 2-22
EnableISPConnect parameter (.pcf file) 2-21
EnableLocalLAN parameter (.pcf file) 2-23
EnableLog parameter (vpnclient.ini) 2-6
EnableNat parameter (.pcf file) 2-23
EnableSplitDNS parameter (.pfc file) 2-25
encGroupPwd parameter (.pcf file) 2-21
ending a connection 5-6
enroll file operation 6-5
enrolling
in a PKI 1-5
enrolling a CA for certificates 6-2, 6-6
enrollment keywords 6-7
enroll operation 6-5
enroll resume operation 6-6
Entrust
Technologies 1-5
Entrust certificates
enabling VPN Client 1-18
EntrustIni parameter (vpnclient.ini) 2-5
error messages 5-11
errors
reporting
faultlog.txt file 8-2
ESP inbound traffic
stateful firewall 1-6
events
severity 1
faultlog.txt file 8-2
excluding networks from auto initiation 4-3
export operation 6-5
F
fallback mode 8-9
faultlog.txt file 8-2
files
.bmp 7-2
.pcf 2-17
.png 7-8
oem.ini 7-5
vpnclient.ini 2-2
sample 2-3
filters
defining for CPP 1-10
firewall information 5-7
firewalls
AYT 1-7
BlackIce Defender 1-7
Cisco Integrated Client 1-6
Cisco Security Agent 1-7
client/server
configuring 1-11
configurations
group 1-11
matching 1-6
scenarios 1-8
CPP 1-6
custom 1-12
defining filters and rules 1-10
Integrity Server 1-7
notifications during negotiations 1-13
personal firewall
enforcement on remote PC 1-7
requiring 1-6
stateful on VPN Client 1-6
Sygate Personal Firewall 1-7
Sygate Personal Firewall Pro 1-7
Sygate Security Agent 1-7
Zone Alarm Firewall 1-7
Zone Alarm Pro Firewall 1-7
ForceNetlogin parameter (.pfc file) 2-26
formats
data xii
FQDN (fully qualified domain name) 6-2
fragmentation
preventing 8-5
G
global profile
creating 2-2
GroupName parameter (.pcf file) 2-20
GroupPwd parameter (.pcf file) 2-20
GUI parameters 2-12
H
hash 6-2
HKEY_LOCAL_MACHINE 8-9
Host parameter (.pcf file) 2-20
I
icons
connected.ico 7-10
disconnecting.ico 7-10
lock 7-4
unconnected.ico 7-10
IKE proposals
activating 1-4
list 8-13
phase 2 8-16
images
lock 7-4
import operation 6-5
incompatible ginas
adding 8-9
fallback mode 8-9
start before logon feature 8-8
IncompatibleGinas parameter (vpnclient.ini file) 2-5
initializing VA
changing method 2-7
Installation
MSI requirements 9-2
installation
automatic 7-1
differences between MSI and Installshield 9-1
installer
directory 7-18
package 7-18
installing
MSI transform 7-15
InstallPath parameter (oem.ini file) 7-7
InstallShield
installation differences from MSI 9-1
setup.bmp file 7-2
silent install 7-16
Integrity Server firewall
configuring 1-11
feature description 1-7
IP addresses
certificate enrollment 2-9
IPSec group
creating on VPN Concentrator 1-2
IPSec log file
troubleshooting firewall configurations 1-12
ISPCommand parameter (.pcf file) 2-21
ISPConnect parameter (.pcf file) 2-21
ISPConnectType parameter (.pcf file) 2-21
K
key size 6-2
keywords for enrollment operations 6-7
L
Legacy IKE Port
changing 2-26
list operation 6-4
LMHOSTS file 1-16
local LAN access
configuring 1-14
lock image
in title lines 7-4
next to active connection entry 7-9
logging during MSI installation 9-3
LogLevel parameter 2-8
logo.png 7-9
log parameters (vpnclient.ini) 2-8
M
making a parameter read only 2-2
managing
autoupdates 3-3
matching firewall configurations 1-6
maximum transmission unit
Microsoft
Certificate Services 1-5
Windows 2000 1-5
MissingGroupDialog parameter (vpnclient.ini) 2-5
MSI
installation differences from InstallShield 9-1
launching 9-2
logging during installation 9-3
silent install 7-17
msiexec command 7-15
MSI transform
customizing VPN Client 7-10
installing 7-15
MSLogonType parameter (.pcf file) 2-22, 2-23
MTU setting
affects of 8-5
changing 8-5
mutual authentication 2-20
mutual group authentication 1-20
N
NAT Transparency (NAT-T)
configuring on VPN Concentrator 1-16
Net login
forcing 2-26
Netlogin parameters 2-11
new/modify profile dialog
profile_logo.png 7-9
new_update_config.ini file
parameters (table) 3-6
new connection entries
distributing 3-7
notifications
displaying 5-4
firewalls 1-13
notify command 5-4
NTDomain parameter (.pfc file) 2-22
O
oem.ini file
creating 7-5
customizing VPN Client 7-5
keywords and values 7-6
MSI equivalents 7-14
sample 7-5
operations for certificate management 6-4
Organization 7-9
organizational unit field in certificate 1-4
organization logo
logo.png file 7-9
P
parameters
brand (oem.ini file) 7-6
DefGroup (oem.ini file) 7-7
dialer (oem.ini file) 7-7
DisableKerberosOverTCP (oem.ini file) 7-6
global
table 2-5
InstallPath (oem.ini file) 7-7
peer timeout (.pcf file) 2-23
profile (.pcf)
authentication 2-21
AuthType 2-20
BackupServer 2-22
certificate parameters 2-24
Description 2-20
DHGroup 2-25
EnableISPConnect 2-21
EnableLocalLAN 2-23
EnableMSLogon 2-22
EnableNat 2-23
EnableSplitDNS 2-25
encGroupPwd 2-21
ForceNetlogin 2-26
GroupName 2-20
GroupPwd 2-20
Host 2-20
ISPCommand 2-21
ISPConnect 2-21
ISPConnectType 2-21
NTDomain 2-22
PeerTimeout 2-23
RadiusSDI 2-25
SaveUserPassword 2-22
SDIUseHardwareToken 2-25
SendCertChain 2-24
TCPTunnelingPort 2-23
TunnelingMode 2-23
UseLegacyIKEPort 2-26
VerifyCertDN 2-25
read only 2-2
reboot (oem.ini file) 7-7
Set Mtu (oem.ini file) 7-7
SilentMode (oem.ini file) 7-7
vpnclient.ini
AppendOriginalSuffixOption 2-16
ApplicationLauncher 2-10
AutoInitiationEnable 2-6
AutoInitiationList 2-7
AutoInitiationRetry 2-6
AutoInitiationRetrylLimit 2-7
AutoInitiationRetryType 2-7
certificate enrollment 2-9
ConnectOnOpen
configuring 1
DialerDisconnect 2-6
DNS 2-10
EnableLog 2-6
EntrustIni 2-5
GUI 2-12
IncompatibleGinas 2-5
log class 2-8
LogLevel 2-8
MissingGroupDialog 2-5
Netlogin 2-11
RADIUS SDI 2-10
RunAtLogon 2-5
StatefulFirewall 2-6
StatefulFirewallAllowICMP 2-6
table 2-5
vpnclient command 5-7
vpnclient stat command
firewall 5-7
repeat 5-7
reset 5-7
route 5-7
traffic 5-7
tunneling 5-7
password_logo.png
Xauth dialog 7-9
pcf files
creating 2-17
distributing with VPN Client software 2-27
parameters 2-20
sample 2-18
PeerTimeout parameter (.pcf file) 2-23
personal firewalls
configuring for VPN Client
VPN Concentrator 1-5
phase 2 IKE proposals 8-16
PKIs
supported 1-5
Portable Network Graphic (PNG) files
list 7-8
preconfigured connection entry
distributing 2-26
preconfigured files 7-18
preconfiguring VPN Clients for remote users 2-1
pre-shared key authentication
certificate authentication 2-20
primary DNS suffix 2-14
printing by name on local LAN 1-16
profile
connection entry 2-17
creating user 1-3
directory 2-2
Entrust 1-18
file format 2-2
global 2-2
features controlled 2-2
parameters 2-4
sample 2-3
profile_logo.png
new/modify profile dialog 7-9
profiles
distributing 3-7
programmer notes
testing a connection 8-9
proposals
phase 2 IKE 8-16
Public Key Infrastructure
R
RADIUS SDI authentication
configuring 2-16
RadiusSDI parameter (.pfc file) 2-25
RADIUS SDI parameters 2-10
read-only parameters 2-2
Reboot parameter (oem.ini) file) 7-7
registry
testing a connection 8-9
related documentation xi
Remote Firewall
scenario 1-8
resetting counts 5-7
root certificates 6-2
routing information 5-7
rules
defining for CPP 1-10
RunAtLogon parameter (vpnclient.ini) 2-5
S
SA
adding 1-4
sample files
.pcf file 2-18
oem.ini file 7-5
vpnclient.ini 2-3
SaveUserPassword parameter (.pfc file) 2-22
SDIUseHardwareToken parameter (.pfc file) 2-25
SendCertChain parameter 2-24
Set Mtu parameters 7-7
SetMTU utility 8-5
launching silently 7-17
silent install 7-1
InstallShield 7-16
MSI 7-17
SilentMode parameter (oem.ini file) 7-7
splash screen
splash_screen.png
splash_screen.png 7-9
Split DNS
enabling 2-25
start before logon
gina files 8-8
starting a connection 5-2
stateful firewall (always on) 1-6
StatefulFirewallAllowICMP parameter (vpnclient.ini) 2-6
StatefulFirewall parameter (vpnclient.ini) 2-6
status information
generating 5-6
Sygate Personal Firewall
firewall on remote PC 1-7
Sygate Personal Firewall Pro
firewall on remote PC 1-7
Sygate Security Agent
firewall on remote PC 1-7
system information
Windows 98 8-1
Windows NT 8-3
system security
protecting 2-19
T
TCPTunnelingPort parameter (.pcf file) 2-23
testing a connection 8-9
traffic information 5-7
transform 7-10
installing 7-15
troubleshooting
connectivity application 8-5
generating information 8-1
TunnelEstablished parameter in registry 8-9
tunneling information 5-7
TunnelingMode parameter (.pcf file) 2-23
U
UniCERT 1-5
update files (Table) 3-5
updating VPN Client software
all client types 3-1
automatically (Windows 2000 and Windows XP) 3-2
Linux 3-2
MAC OS X 3-2
Solaris 3-2
upgrade notifications
configured on VPN Concentrator 1-13, 3-1
UseLegacyIKEPort parameter (.pfc file) 2-26
user certificates 6-1
user profiles
certificate
keywords 6-1
creating for distribution 2-17
creating in VPN Concentrator 1-3
V
VAenableAlt 2-7
VerifyCertDN parameter (.pfc file) 2-25
verifying an auto initiation configuration 4-5, 5-5
verify operation 6-5
view operation 6-4
virtual adapter
method of initializing 2-7
VPN Client
applications ix
configuring 2-1
vpnclient.ini file
file format 2-2
sample 2-3
vpnclient_en.msi command 9-2
vpnclient commands
disconnect 5-6
displaying a list 5-1
notify 5-4
stat 5-6
firewall 5-7
repeat 5-7
reset 5-7
route 5-7
traffic 5-7
tunnel 5-7
verify autoinitconfig 5-5
VPN Concentrator
configuring personal firewalls for VPN Client 1-5
creating user profiles 1-3
VPN Dialer
customizing 7-4
W
Windows 98
generating system information 8-3
shut down problem 8-5
Windows NT or Windows 2000
generating system information 8-3
WINMSD utility
Windows NT or Windows 2000 8-3
X
Xauth dialog
password_logo.png 7-9
Z
Zone Alarm Firewall
firewall on remote PC 1-7
Zone Alarm Pro Firewall
firewall on remote PC 1-7