-
Cisco VPN Client Administrator Guide, Release 5.0
-
About This Guide
-
Configuration Information for an Administrator
-
Configuring the VPN Client Using ASDM
-
Configuring VPN Client Parameters on the ASA Using CLI
-
Configuring the VPN Client on a VPN 3000 Series Concentrator
-
Preconfiguring the VPN Client for Remote Users
-
Updating VPN Client Software on a VPN 3000 Concentrator
-
Configuring Automatic VPN Initiation--Windows Only
-
Using the VPN Client Command-Line Interface
-
Managing Digital Certificates from the Command-Line
-
Customizing the VPN Client Software
-
Troubleshooting and Programmer Notes
-
Windows Installer (MSI) Information
-
Index
-
FeedbackTable Of Contents
Cisco ASA 5500 Series Adaptive Security Appliance Documentation
VPN 3000 Series Concentrator Documentation
Obtaining Documentation and Submitting a Service Request
Obtaining Technical Assistance
About This Guide
This VPN Client Administrator Guide tells you how to set up selected features of the Cisco VPN Client for users. This manual supplements the information provided in accompanying documentation for the Cisco VPN devices that work with the VPN Client. The chapters and sections in this manual apply to all platforms supported by the Cisco VPN Client unless otherwise specified.
The VPN Client is an IPsec software client that lets users:
•
Connect to a Cisco VPN device
•
•
•
For information about how to use this application, see the VPN Client User Guide for your platform.
In this administrator guide, the term Cisco VPN device refers to the following Cisco products:
•
•
•
•
Audience
We assume you are an experienced system administrator or network administrator with appropriate education and training, who knows how to install, configure, and manage internetworking systems. You should be familiar with system configuration and management for the platform you are administering.
Organization
The VPN Administrator Guide is organized as follows:
Chapter 1
Provides administration information common across all platforms.
Chapter 2
Explains how to use ASDM to configure A Cisco Series 5500 Adaptive Security Appliance for VPN Client connections.
Chapter 3
Explains how to use the ASA command-line interface to configure A Cisco Series 5500 Adaptive Security Appliance for VPN Client connections.
Chapter 4
Configuring the VPN Client on a VPN 3000 Series Concentrator
Explains how to configure a VPN 3000 Concentrator for remote access, personal firewalls, local LAN access, backup servers, NAT-T. Also describes how to configure a VPN Client to work with Entrust Entelligence and smart cards.
Chapter 5
Shows how to create global and user profiles.
Chapter 6
Describes how to update VPN Client software manually and automatically for all VPN Client platforms.
Chapter 7
Describes auto initiation and how to configure the vpnclient.ini file for auto initiation.
Chapter 8
Explains how to use the command-line interface (CLI) to connect to a VPN device, how to disconnect from a VPN device, and how to get status information from a VPN device. You can use these commands in batch mode.
Chapter 9
Explains how to use the command-line interface (CLI) to manage digital certificates.
Chapter 10
Describes how to use your own names and icons for the VPN Client applications instead of Cisco Systems names. Also describes how to install and reboot the VPN Client software without user interaction, called silent mode.
Chapter 11
Lists troubleshooting techniques. Describes how to use the SetMTU application.
Chapter 12
Describes alternative ways to start MSI, explains logging and upgrading.
Related Documentation
For the complete list of Cisco VPN Client documentation, see: http://www.cisco.com/en/US/products/sw/secursw/ps2308/tsd_products_support_series_home.html. The VPN Client Administrator Guide is being updated at this time.
This administrator guide is a companion to the following VPN Client user guides:
•
•
•
•
•
To view the latest version of the VPN Client documentation on the Cisco Web site, see: http://www.cisco.com/en/US/products/sw/secursw/ps2308/tsd_products_support_series_home.html
Cisco ASA 5500 Series Adaptive Security Appliance Documentation
For the complete list of Cisco ASA 5500 Series Adaptive Security Appliance documentation, see: http://www.cisco.com/en/US/docs/security/asa/roadmap/asaroadmap.html. In each instance, be sure to check the www.cisco.com documentation website for the specific software and documentation version that you are using.
ASA Version 8.0 Documentation Set
Note
Getting Started (5500)—Cisco ASA 5500 Getting Started Guide, Software Version 8.0
http://www.cisco.com/en/US/docs/security/asa/asa80/getting_started/asa5500/quick/guide/5500gsg.htmlGetting Started (5505)—Cisco ASA 5505 Getting Started Guide, 8.0
http://www.cisco.com/en/US/docs/security/asa/asa80/getting_started/asa5505/quick/guide/5505gsg.htmlGUI Configuration—ASDM 6.0 User Guide
http://www.cisco.com/en/US/docs/security/asa/asa80/asdm60/user/guide/usrguide.htmlSelected ASDM Configuration Topics—These documents explain how to use ASDM to configure selected VPN features.
–
http://www.cisco.com/en/US/docs/security/asa/asa80/asdm60/selected_topics/adv_custom.html–
http://www.cisco.com/en/US/docs/security/asa/asa80/asdm60/selected_topics/disp_2lang.htmlCLI Configuration—Cisco Security Appliance Command Line Configuration Guide, Version 8.0
http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/conf_gd.htmlCommand Reference—Cisco Security Appliance Command Reference, Version 8.0
http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/cmd_ref.htmlSyslog Messages—Cisco Security Appliance System Log Messages, Version 8.0
http://www.cisco.com/en/US/docs/security/asa/asa80/system/message/syslog.htmlASA 8.0 Release Notes—Release notes for each maintenance release:
http://www.cisco.com/en/US/products/ps6120/prod_release_notes_list.htmlASDM 6.0 Release Notes—Release notes for each maintenance release:
http://www.cisco.com/en/US/products/ps6121/prod_release_notes_list.htmOpen Source Software Licenses for ASA and PIX Security Appliances, Version 8.0
http://www.cisco.com/en/US/docs/security/asa/asa80/license/opensrce.htmlCisco ASDM Documentation
ASDM is the graphical user interface for the Cisco ASA 5500 Series Adaptive Security Appliance.
Note
ASDM 6.1 Documentation SetConfiguration—Cisco ASDM User Guide, 6.1
http://www.cisco.com/en/US/docs/security/asdm/6_1/user/guide/usergd.htmlRelease Notes—Release notes for each maintenance release:
http://www.cisco.com/en/US/products/ps6121/prod_release_notes_list.htmlVPN 3000 Series Concentrator Documentation
For the complete list of VPN 3000 Series Concentrator documentation, see: http://www.cisco.com/en/US/products/hw/vpndevc/ps2284/tsd_products_support_eol_series_home.html
Note
The VPN 3000 Concentrator Getting Started, Release 4.1 guide explains how to unpack and install the VPN 3000 Concentrator, and how to configure the minimal parameters. This is known as Quick Config.
The VPN 3000 Concentrator Reference Volume I: Configuration, Release 4.1 explains how to start and use the VPN 3000 Concentrator Manager. It details the Configuration screens and explains how to configure your device beyond the minimal parameters you set during quick configuration.
The VPN 3000 Concentrator Reference Volume II: Administration and Monitoring, Release 4.1 provides guidelines for administering and monitoring the VPN 3000 Concentrator. It explains and defines all functions available in the Administration and Monitoring screens of the VPN 3000 Concentrator Manager. Appendixes to this manual provide troubleshooting guidance and explain how to access and use the alternate command-line interface.
The VPN 3000 Concentrator Manager (the Manager) also includes online help that you can access by clicking the Help icon on the toolbar in the Manager window.
IOS Documentation
You can find the IOS documentation set at the following URL:
http://www.cisco.com/en/US/products/ps6350/tsd_products_support_series_home.html
Other References
Other useful references include:
•
•
www.ietf.orgfor Internet Engineering Task Force (IETF) Working Group drafts on IP Security Protocol (IPsec).•
www.whatis.com, a web reference site with definitions for computer, networking, and data communication terms.Conventions
This document uses the following conventions:
Notes use the following conventions:
Note
Cautions use the following conventions:
Caution
Data Formats
As you configure and manage the system, enter data in the following formats unless the instructions indicate otherwise:
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html
Subscribe to the What's New in Cisco Product Documentation as a Really Simple Syndication (RSS) feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service and Cisco currently supports RSS version 2.0.
Obtaining Technical Assistance
Cisco provides Cisco.com, which includes the Cisco Technical Assistance Center (TAC) Website, as a starting point for all technical assistance. Customers and partners can obtain online documentation, troubleshooting tips, and sample configurations from the Cisco TAC website. Cisco.com registered users have complete access to the technical support resources on the Cisco TAC website, including TAC tools and utilities.
Cisco.com
Cisco.com offers a suite of interactive, networked services that let you access Cisco information, networking solutions, services, programs, and resources at any time, from anywhere in the world.
Cisco.com provides a broad range of features and services to help you with these tasks:
•
•
•
•
•
To obtain customized information and service, you can self-register on Cisco.com at this URL:
Technical Assistance Center
The Cisco TAC is available to all customers who need technical assistance with a Cisco product, technology, or solution. Two levels of support are available: the Cisco TAC website and the Cisco TAC Escalation Center. The avenue of support that you choose depends on the priority of the problem and the conditions stated in service contracts, when applicable.
We categorize Cisco TAC inquiries according to urgency:
•
•
•
•
Cisco TAC Website
You can use the Cisco TAC website to resolve P3 and P4 issues yourself, saving both cost and time. The site provides around-the-clock access to online tools, knowledge bases, and software. To access the Cisco TAC website, go to this URL:
All customers, partners, and resellers who have a valid Cisco service contract have complete access to the technical support resources on the Cisco TAC website. Some services on the Cisco TAC website require a Cisco.com login ID and password. If you have a valid service contract but do not have a login ID or password, go to this URL to register:
http://tools.cisco.com/RPF/register/register.do
If you are a Cisco.com registered user, and you cannot resolve your technical issues by using the Cisco TAC website, you can open a case online at this URL:
http://www.cisco.com/en/US/support/index.html
If you have Internet access, we recommend that you open P3 and P4 cases through the Cisco TAC website so that you can describe the situation in your own words and attach any necessary files.
Cisco TAC Escalation Center
The Cisco TAC Escalation Center addresses priority level 1 or priority level 2 issues. These classifications are assigned when severe network degradation significantly impacts business operations. When you contact the TAC Escalation Center with a P1 or P2 problem, a Cisco TAC engineer automatically opens a case.
To obtain a directory of toll-free Cisco TAC telephone numbers for your country, go to this URL:
http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml
Before calling, please check with your network operations center to determine the level of Cisco support services to which your company is entitled: for example, SMARTnet, SMARTnet Onsite, or Network Supported Accounts (NSA). When you call the center, please have available your service agreement number and your product serial number.
Notices
The following notices pertain to this software license.
OpenSSL/Open SSL Project
This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit (http://www.openssl.org/).
This product includes cryptographic software written by Eric Young (eay@cryptsoft.com).
This product includes software written by Tim Hudson (tjh@cryptsoft.com).
License Issues
The OpenSSL toolkit stays under a dual license, i.e. both the conditions of the OpenSSL License and the original SSLeay license apply to the toolkit. See below for the actual license texts. Actually both licenses are BSD-style Open Source licenses. In case of any license issues related to OpenSSL please contact openssl-core@openssl.org.
OpenSSL License:
Copyright © 1998-2007 The OpenSSL Project. All rights reserved.
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
1.
2.
3.
4.
5.
6.
"This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit (http://www.openssl.org/)".
THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT "AS IS"' AND ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
This product includes cryptographic software written by Eric Young (eay@cryptsoft.com). This product includes software written by Tim Hudson (tjh@cryptsoft.com).
Original SSLeay License:
Copyright © 1995-1998 Eric Young (eay@cryptsoft.com). All rights reserved.
This package is an SSL implementation written by Eric Young (eay@cryptsoft.com).
The implementation was written so as to conform with Netscapes SSL.
This library is free for commercial and non-commercial use as long as the following conditions are adhered to. The following conditions apply to all code found in this distribution, be it the RC4, RSA, lhash, DES, etc., code; not just the SSL code. The SSL documentation included with this distribution is covered by the same copyright terms except that the holder is Tim Hudson (tjh@cryptsoft.com).
Copyright remains Eric Young's, and as such any Copyright notices in the code are not to be removed. If this package is used in a product, Eric Young should be given attribution as the author of the parts of the library used. This can be in the form of a textual message at program startup or in documentation (online or textual) provided with the package.
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
1.
2.
3.
"This product includes cryptographic software written by Eric Young (eay@cryptsoft.com)".
The word `cryptographic' can be left out if the routines from the library being used are not cryptography-related.
4.
THIS SOFTWARE IS PROVIDED BY ERIC YOUNG "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
The license and distribution terms for any publicly available version or derivative of this code cannot be changed. i.e. this code cannot simply be copied and put under another distribution license [including the GNU Public License].
