|
|
This chapter explains the tasks you can perform to manage connection entries, view and manage event reporting, and upgrade or uninstall the VPN Client software. The management features are available from the Cisco Systems VPN Client applications menu. (See Figure 5-1.)
This chapter includes the following sections:
To configure properties of connection entries, see "Configuring the VPN Client."
 |
Note If you are a system administrator, refer to the VPN Client Administrator Guide for information on configuring the VPN 3000 Concentrator and preparing preconfigured profiles for VPN Client users. |
To manage a connection entry, start the Cisco VPN Client and choose VPN Dialer from the menu of applications.
The VPN Client main dialog box appears. (See Figure 5-2.)
Click the Connection Entry drop-down menu arrow and choose an entry.
Click Options to display the menu.
To clone a connection entry with all its properties and use it as the basis for creating a new entry, follow these steps:
Step 1 On the VPN Client's main dialog box, click the Connection Entry drop-down menu and choose the entry you want to clone.
Step 2 On the VPN Client Options menu, choose Clone Entry. (See Figure 5-3.)
The Clone Connection Entry dialog box appears. (See Figure 5-4.)
Step 3 Enter a name for the new connection entry in the field and click OK.
Step 4 The dialog box closes. The new name appears in the Connection Entry list in the VPN Client main dialog box.
Step 5 To configure the properties of this new connection entry, click Options > Properties on the VPN Client main dialog box and see the "Setting or Changing Connection Entry Properties".
To delete a configured connection entry, follow these steps:
Step 1 On the VPN Client's main dialog box, click the Connection Entry drop-down menu arrow and choose the entry you want to delete.
Step 2 On the VPN Client Options menu, choose Delete entry. (See Figure 5-3.)
A confirmation dialog box appears. (See Figure 5-5.)
Step 3 Click Yes or No:
The VPN Client returns to its main dialog box.
You can rename a connection entry and retain all its properties. Each connection entry name must be unique. Since these names are not case-sensitive, be sure the new name differs in content, not just case.
Step 1 On the VPN Client's main dialog box, click the Connection Entry drop-down menu and choose the entry you want to rename.
Step 2 On the VPN Client Options menu, choose Rename Entry. (See Figure 5-3.)
The Rename Connection Entry dialog box appears. (See Figure 5-6.)
Step 3 Enter a new name for this connection entry in the field and click OK.
The dialog box closes. The new name appears in the Connection Entry list in the VPN Client main dialog box.
You can automatically configure your VPN Client with new settings by importing a new configuration file (a file with a .pcf extension, called a profile) that your system administrator supplies.
To automatically configure a VPN Client, perform the following steps:
Step 1 Obtain a new VPN Client profile (.pcf) file from your system administrator.
Step 2 Load the file on your hard disk.
Step 3 On the VPN Client main dialog box, click Options and choose Import Entry from the menu.
The VPN Client opens a window for you to choose the profile file. (See Figure 5-7.)
Step 4 Browse until you locate the profile file and when you have located it, choose it and click Open.
(See Figure 5-8.)
The VPN Client displays a message informing you that your file import was successful. (See Figure 5-9.) If the profile already exists, you receive a message asking if you want to overwrite it.
Step 5 To continue, click OK.
Alternatively, you can copy the .pcf file into the Profiles directory and restart the VPN Dialer application.
Your VPN Client is now configured with the connection entries and parameters specified by this new profile file. You can examine or modify the connection entries by clicking the Connection Entry drop-down menu on the main dialog box, choosing an entry, and clicking Options > Properties.
You or your administrator may have configured an entry to save the authentication password on your PC so you do not have to enter a password when you are connecting to the VPN device. Normally we recommend that you not use this feature, because storing the password on the PC can compromise security, and requiring a password to authenticate you every time you attempt to connect to the VPN device is fundamental to maintaining security on the private network. However, there may be reasons for temporarily bypassing the authentication dialog box, for example, when you want to create a batch file for your PC to log in to a VPN device to accomplish some task that requires using the private network behind the VPN device.
If there is a password saved on your system, and authentication fails, your password might be invalid.
To eliminate a saved password, use the Erase User Password feature on the Options menu. Erase User Password is available only when you have previously checked Save Password on the User Authentication dialog box. (See Figure 5-10.)
When the VPN device allows saving passwords on the remote site and Save Password is in effect, then Erase User Password is available on the Options menu. (See Figure 5-11.)
|
Note If the IPSec group parameter Reauthentication on Rekey is enabled on a VPN 3000 Concentrator, you must enable Erase User Password on the VPN Client. Otherwise during every IKE Phase 1 rekey, the VPN Client user is automatically authenticated (no authentication dialog is displayed). |
To enable this feature, click Erase User Password.
The VPN Client prompts you to confirm (See Figure 5-12.)
With Erase User Password in effect, the next time you connect, the authentication dialog box prompts you to enter your password: on the Options menu, the Erase User Password feature is no longer available. (See Figure 5-13.)
You can create a shortcut on your desktop to quickly and directly launch a VPN Client connection entry that you use frequently.
Step 1 On the VPN Client's main dialog box, click the Connection Entry drop-down menu and choose an entry.
Step 2 On the VPN Client Options menu, choose Create Shortcut. (See Figure 5-3.)
The shortcut appears on your desktop, as in this example. (See Figure 5-14.)
The VPN Client main dialog box remains open.
Stateful Firewall (Always On) provides even tighter security. When enabled, this feature allows no inbound sessions from all networks, whether or not a VPN connection is in effect. Also, the firewall is active for both encrypted and non encrypted traffic. There are two exceptions to this rule. The first is DHCP, which sends requests to the DHCP server out one port but receives responses from DHCP through a different port. For DHCP, the stateful firewall allows inbound traffic. The second is ESP. The stateful firewall allows ESP traffic from the secure gateway, because ESP rules are packet filters and not session-based filters. For the latest information on other exceptions, if any, refer to Release Notes for Cisco VPN Client for Windows.
To enable the stateful firewall, click Stateful Firewall (Always on). When Stateful Firewall (Always On) is enabled, you see a check in front of the option. This feature is disabled by default. You can enable or disable this feature from the VPN Client Options menu. During a VPN connection, you can view the status of this feature by right-clicking the lock icon in the system tray. You can also enable or disable this feature from the same menu.
You can configure the dialer to automatically launch an application before establishing a connection. Some examples of why you would want to use this feature follow:
To configure the VPN Dialer to launch an application from the logon desktop, use the Application Launcher.
The Application Launcher starts the specified application once per session. To launch an application again, you must exit from the VPN Dialer, restart the VPN Dialer, and launch the application.
|
Note You cannot launch a batch file using Application Launcher. |
To activate Application Launcher, follow these steps:
Step 1 Open the VPN Dialer Options pull-down menu (shown in Figure 5-3) and click Application Launcher. (See Figure 5-15.)
The VPN Dialer displays a dialog box prompting for the name of the application. (See Figure 5-16.)
Step 2 Click Browse to locate and then choose the complete pathname to the application as well as the name of the application. (See Figure 5-17.)
The application name appears in the Application Launcher dialog box. In this example, the VPN Dialer is configured to launch the Log Viewer before a connection.
Step 3 Click Enable and then click OK.
To disable Application Launcher, follow these steps:
Step 1 Open the Options pull-down menu and choose Application Launcher.
Step 2 When the Application Launcher dialog box displays, remove the check from in front of Enable.
This section describes special logon features for the Windows NT platform, which includes Windows NT 4.0, Windows 2000, and Windows XP. These features include:
To access the Windows logon properties, open the VPN Client Options pull-down menu (shown in Figure 5-3) and choose Windows Logon Properties. The VPN Client displays a dialog box containing three parameters. (See Figure 5-18.)
On a Windows NT platform, you can connect to the private network before you log on to your system. This feature is called Start Before Logon and its purpose is primarily to let you log in to the domain and run login scripts.
Your administrator may have set this up for you. Once you establish a VPN connection, your credentials are sent to a domain controller for logging in to your system. If you need to launch an application before you logon, see the section "Launching an Application" for information.
When you have established a successful VPN connection, the VPN Dialer window closes and your logon window displays. If the connection is not successful, the VPN Dialer window continues to display. Your administrator may have set up a banner that lets you know when you have a successful connection.
To activate this feature, follow these two steps:
Step 1 Open the VPN Client Options pull-down menu (shown in Figure 5-3) and choose Windows Logon Properties.
Step 2 Check Enable start before logon. (See Figure 5-18.)
When Start Before Logon is active, the following events occur when your system starts:
You log on to your system.
To turn this feature off, open the Options pull-down menu on the VPN Dialer connection dialog box and uncheck Enable start before logon. The next time you log on to your system, the VPN Dialer connection dialog box does not automatically display on your logon desktop.
|
Note You can use certificates for authentication with Start Before Logon when your personal certificate
along with the CA or intermediary certificate(s) are in your Cisco certificate store but not your
Microsoft store (CAPI certificates). However, to use a CAPI certificate, you can log in using cached
credentials, make a VPN connection using your CAPI certificate, and disable the "Disconnect VPN
connection when logging off" parameter (see
"Disconnecting When Logging Off of a
Windows NT Platform," following). This action keeps your connection open. Now you can log
back in to the system. For information on enrolling certificates and importing certificates into your Cisco store, see "Enrolling and Managing Certificates." For information about using Start Before Logon with the Entrust SignOn feature, see "Connecting with Digital Certificates". |
This parameter controls whether your VPN Client connection automatically disconnects when you log off your Windows NT system.
To always automatically terminate your connection when you log off, check this parameter. This parameter is checked by default.
To disable auto-disconnect while logging off, remove the check from this parameter. When you remove the check, the VPN Client displays the warning message shown in Figure 5-19.
Disabling this parameter allows your connection to remain up during and after log off, which allows profiles or folders to be synchronized during log off. You would disable this parameter when using the Windows roaming profiles feature.
|
Note With this feature disabled, you must completely shut down your system to disconnect your VPN Client connection. |
Examining the event log can often help a network administrator diagnose problems with an IPSec connection between a VPN Client and a peer device. The log view application collects event messages from all processes that contribute to the client-peer connection. This section shows how to use the Log Viewer to retrieve and manage this information.
To start the Log Viewer, use the following path from the Start menu:
Start > Programs > Cisco Systems VPN Client > Log Viewer. (See Figure 5-20.)
The Log Viewer starts, displaying its main window. (See Figure 5-21.) By default, the filter is set to low, so you may not see any events displayed in this window (see the section "Filtering Events").
For help on this window, press F1.
To display a brief help message that gives you the version number of the software, choose Help from the main menu or click the Help icon.
To start collecting event messages into the log file, choose Options > Capture. When a check mark appears in front of the Capture option, Log Viewer is collecting events. This option is off by default. Alternatively, you can click the Capture icon.
Each message in the log file comprises at least two lines containing the following fields:
Event# Time Date Severity/type/level EventClass/MessageIDMessage text
Table 5-1 describes the fields in an event message. Table 5-2 describes Event types and severity levels.
| Field | Meaning |
|---|---|
Event# | The first field shows the event number. Events are numbered incrementally and never reset. |
Time | The Time field shows the time of the event: hour:minutes:seconds. The hour is based on a 24-hour clock. For example |
Date | The date field shows the date of the event: MM/DD/YYYY. For example, |
Severity/type/level | This field reports the severity type and level of the event; for example, |
Event Class and Message ID | This field shows the module or source of the event and the message identifier associated with the module. For example, |
Message Text | A brief message describing the event. Usually this message is no more than 80 characters. For example, |
| Type | Level | Meaning |
|---|---|---|
Fault | 1 | A system failure or nonrecoverable error. |
Warning | 2 - 3 | Imminent system failure or a serious problem that may require user intervention. |
Informational | 4 - 6 | Level 4 provides the most general type (high level) information. Levels 5 and 6 provide more detailed information about the connection. |
To control the amount of information to view with the Log Viewer, choose Options > Filter. Alternatively, you can click the Filter icon.
The Log Viewer displays the Log Viewer Filter message to let you choose the amount of information you want to capture. (See Figure 5-22.)
To change the filter level, do the following:
Step 1 Double-click on one item, or choose more than one item and right click.
Step 2 Choose from the following options that the Log Viewer displays:
Disable—Inhibits event reporting for the chosen class.
Low—Provides the least amount of information. This choice includes severity levels 1 through 3 (all faults and warnings). Low is the default for all classes.
Medium—Includes severity levels 1 through 4; all in Low plus the first level informational events, which provide general information about the connection. Note that a first level informational event is level 4 and appears in the event display as Info/4.
High—Includes severity levels 1 through 6, thus adding two levels of informational events (Info/5 and
Info/6). This setting can lower the performance of all applications on your system, so use it only when your network administrator or a support engineer suggests that you do so.
Table 5-3 defines the classes (modules) that generate events.
| Class Name | Definition |
|---|---|
CERT | Certificate management process (CERT), which handles getting, validating, and renewing certificates from certificate authorities. CERT also displays errors that occur as you use the application. |
CM | Connection manager (CM), which drives VPN connections. (CM dials a PPP device, configures IKE for establishing secure connections, and manages connection states. |
CVPND | Cisco VPN Daemon (main daemon), which initializes client service and controls messaging process and flow. |
DIALER | Windows-only component, which handles configuring a profile, initiating a connection, and monitoring it. |
IKE | Internet Key Exchange (IKE) module, which manages secure associations. |
IPSEC | IPSec module, which obtains network traffic and applies IPSec rules to it. |
PPP | Point to Point Protocol. |
XAUTH | Extended authorization application, which validates a remote user's credentials. |
To locate specific events or event types in the window, choose Search from the main menu. Alternatively, you can click on the Search icon.
The Log Viewer displays the Find message. (See Figure 5-23.) Enter a string to find and click Find Next. You can match on whole words and on case.
To print the events displayed in the current window, choose File > Print from the main menu. Alternatively, you can click the Printer icon. (See Figure 5-23.)
To save the currently displayed events in the ipseclog file on your hard drive, choose File > Save as from the main menu. Alternatively, click the Disk icon. (See Figure 5-23.)
The ipseclog file is a text (.txt) file in DOS format. The Log Viewer saves the information to the Client install directory, which by default is the pathname Program Files\Cisco Systems VPN Client\VPN Client\IPSECLOG.TXT. You can specify any directory and name. (See Figure 5-24.)
To eliminate all the events currently displayed in the Log Viewer main window, choose Options > ClearLog Display from the main menu. Alternatively, you can click the Erase All icon. (See Figure 5-23.)
If you want to store the event messages, be sure you save them before you clear the display. Clearing the display does not reset event numbering, nor does it clear the log file itself.
The VPN device (secure gateway) through which you connect to the private network at your organization can send you notifications. Typically, you might receive a notification from your network administrator when it is time to update the VPN Client software or when the VPN device that requires a specific firewall be running on the VPN Client PC detects that the firewall is not running. A notification typically shows up when you start your dialer connection. You can also display notifications while you are connected by clicking Notifications on the Connection Status dialog box. (See Figure 5-25.)
The notification shown in Figure 5-26 informs a remote user that it is time to upgrade the VPN Client software. The notification includes the location where the remote user can obtain the upgrade. When you receive an upgrade notification that includes a URL, click Launch to go to the site and retrieve the upgrade software. You will receive an upgrade notification every time you connect until you have installed the upgrade software.
If the VPN Client and VPN Concentrator firewall configurations do not match, the VPN Concentrator notifies the VPN Client while negotiating the connection. The notification includes the policy that the VPN Concentrator requires. For example, the notification in Figure 5-27 shows an example firewall notification. The message states that the policy required is AYT and the firewall required is any Zone Labs product.
Upgrading the VPN Client software using this method retains existing connection entries and their parameters.
To install an upgrade of the VPN Client over an existing version on your system, use the following procedure, which first uninstalls the existing version, and then reboots your PC and installs the new version.
Step 1 To begin the procedure, follow the instructions in the "Installing the VPN Client" section in Chapter 2.
When it starts, the installation wizard detects the existing version and asks you to confirm that you want to remove that version and reboot your PC. (See Figure 5-28.)
Step 2 To continue, click Yes.
The installation program removes the old version and asks you to confirm the system restart. (See Figure 5-29.)
Be sure to remove any diskette from its drive before you restart your system.
If you are installing from diskettes, reinsert Disk 1 after your system restarts and displays the Windows logo screen, but before the desktop appears.
Step 3 To restart your system, click Yes (the default) and click Finish.
The installation wizard restarts your system. Once your system has restarted, installation continues automatically.
Step 4 Follow the instructions as if you were installing for the first time. See "Installing the VPN Client."
Uninstalling the VPN Client means completely removing all VPN Client software from your computer. For example, if you are changing or upgrading your PC, you might want to uninstall the VPN Client.
|
Note Do not attempt to uninstall or upgrade the VPN Client software from a mapped network drive. |
Before you run the uninstall program, make sure you have closed all of your remote access (Dial-Up Networking) connections and all VPN Client applications. Then use the following procedure. (See Figure 5-30.)
Step 1 Choose Start > Programs > Cisco Systems VPN Client > Uninstall VPN Client.
The Uninstall Wizard runs and asks if you want to really want to remove the VPN Client applications. (See Figure 5-31.)
Step 2 To completely remove the VPN Client software from your system, click Yes. Otherwise, click No.
Next, the Uninstall Wizard asks if you want to delete your connection profiles. (See Figure 5-32.)
Step 3 To preserve your connection profiles (which contain configured connection entries), click No.
Then the Uninstall Wizard asks if you want to delete your certificates. (See Figure 5-33.)
Step 4 To keep your certificates, click No.
Finally, the Uninstall Wizard prompts you to restart your system. To complete the uninstallation, you must restart your system.
Step 5 To restart your system, click Yes (the default) and then click Finish.
The installation program restarts your system.
Be sure to remove any diskette from its drive before you restart your system.
|
Note When you uninstall the VPN Client software after you have run the Log Viewer and you have clicked yes to remove your certificate and profile directories, the vpnclient.ini and ipseclog.txt files remain on your system. Since these files were generated after you installed the software, they are not removed when you uninstall the software. You have to remove them manually. |
Posted: Wed Sep 25 04:07:30 PDT 2002
All contents are Copyright © 1992--2002 Cisco Systems, Inc. All rights reserved.
Important Notices and Privacy Statement.
