Related Manuals for Nortel VPN Client
Summary of Contents for Nortel VPN Client
- Page 1 Configuring the Contivity VPN Client Version 6.01 Part No. 311644-J Rev 00 August 2005 600 Technology Park Drive Billerica, MA 01821-4130...
-
Page 2: Restricted Rights Legend
In the interest of improving internal design, operational function, and/or reliability, Nortel Networks Inc. reserves the right to make changes to the products described in this document without notice. Nortel Networks Inc. does not assume any liability that may occur due to the use or application of the product(s) or circuit layout(s) described herein. - Page 3 30 days of purchase to obtain a credit for the full purchase price. “Software” is owned or licensed by Nortel Networks, its parent or one of its subsidiaries or affiliates, and is copyrighted and licensed, not sold. Software consists of machine-readable instructions, its components, data, audio-visual content (such as images, text, recordings or pictures) and related licensed materials including all whole or partial copies.
- Page 4 12.212 (for non-DoD entities) and 48 C.F.R. 227.7202 (for DoD entities). Customer may terminate the license at any time. Nortel Networks may terminate the license if Customer fails to comply with the terms and conditions of this license. In either event, upon termination, Customer must either return the Software to Nortel Networks or certify its destruction.
-
Page 5: Table Of Contents
Quiet mode ........... 40 Configuring the Contivity VPN Client... - Page 6 Contivity VPN Client task bar icons ........
- Page 7 Netscape digital certificate retrieval ....... . 69 Configuring Contivity VPN Client for MS stored certificates ....70 Server certificate CRL checking .
- Page 8 8 Contents 311644-J Rev 00...
- Page 9 Contivity VPN Client bitmap ........46...
- Page 10 10 Figures 311644-J Rev 00...
- Page 11 VPN Client support ........
- Page 12 12 Tables 311644-J Rev 00...
-
Page 13: Preface
Preface This guide helps you install the Nortel* Contivity VPN Client. Topics include: • Installing the client • Creating custom icons • Installing a custom client • Using certificates on a client This guide is intended for network managers who are responsible for setting up client software for the Contivity gateway. -
Page 14: Text Conventions
Text conventions This guide uses the following text conventions: angle brackets (< >) bold Courier text braces ({}) brackets ([ ]) ellipsis points (. . . ) 311644-J Rev 00 Indicate that you choose the text to enter based on the description inside the brackets. -
Page 15: Acronyms And Terms
(or subject) to a public key. Collection of de facto standards produced by RSA covering the use and manipulation of public-private keys and certificates. is one variable , you enter either terminal paging on Table Configuring the Contivity VPN Client... -
Page 16: Related Publications
Table 1 Acronyms and terms PKCS #7 PKCS #10 PKCS #12 X.509 Related publications For more information about the Contivity Secure IP Services Gateway, refer to the following publications: • Release notes provide the latest information, including brief descriptions of the new features, problems fixed in this release, and known problems and workarounds. -
Page 17: Hard-Copy Technical Manuals
How to get Help This section explains how to get help for Nortel products and services. Getting Help from the Nortel Web site The best source of support for Nortel products is the Nortel Support Web site: http://www.nortel.com/support This site enables customers to: •... -
Page 18: Getting Help Over The Phone From A Nortel Solutions Center
Getting Help over the phone from a Nortel Solutions Center If you have a Nortel support contract and cannot find the information you require on the Nortel Support Web site, you can get help over the phone from a Nortel Solutions Center. -
Page 19: Chapter 1 Installing The Client
Windows Domain Login and Nortel graphical identification and authentication (NNGINA). Windows installations To install the client, copy the Contivity VPN Client (EAC601D.exe) that is on the Contivity Secure IP Services Gateway CD into the Client folder onto your hard drive. -
Page 20: Figure 2 License Agreement Screen
Click Next. The License Agreement screen appears. Figure 2 License Agreement screen Click Yes to accept the license. The Destination screen appears. Figure 3 Destination screen 311644-J Rev 00 (Figure (Figure... -
Page 21: Figure 4 Program Folder Screen
The Select Program Folder screen appears. Figure 4 Program folder screen Click Next to select the default program folder or choose one of the listed program folders. The Install and run Contivity VPN Client screen appears. (Figure Figure 5 Install and run screen... -
Page 22: Figure 6 Start Copying Files Screen
Figure 6 Start Copying Files screen Click Next to continue the installation. When prompted at the end of the installation, reboot your system. 10 Double-click the Contivity VPN Client icon. Enter a new Connection name. b Optionally, enter a description for the connection. -
Page 23: Windows Domain Logon
If you have made any changes in the Network Control Panel, click OK, and then reboot the system. Note: In Windows 2000 and Windows XP, the Contivity VPN Client adapter is not displayed in the Network Control Panel. However, if you run a utility such as IPCONFIG, it will respond. -
Page 24: Graphical Identification And Authentication (Gina)
Note: When you install GINA, Windows disables fast user switching. To install GINA, select the Windows GINA (Connect Before Logon) option on the Install and run Contivity VPN Client screen. When prompted at the end of the installation, reboot your system. -
Page 25: Logging On Through Client Connection
After the client installation is complete, use the following procedure to log on through a Contivity VPN Client connection. Note: Auto domain logon is the default. Press Control + Alt + Delete. The Contivity VPN Client GINA interface appears. This is a Contivity GINA dialog (not the Windows GINA dialog). (Figure... -
Page 26: First Domain Logon
Contivity Client GINA dialog. The Domain logon is established using the existing Contivity VPN tunnel connection. Note: When the Contivity VPN Client is running as a service under Windows 2000 or Windows XP, you may not be able to log off after you log in and log off several times. -
Page 27: Enabling And Disabling Connect Before Logon
Connect Before Logon option. The Contivity VPN Client GINA dialog provides simultaneous Windows NT domain logon when logging on to the workstation. The Contivity VPN Client must be installed with the GINA option to be available. -
Page 28: Uninstalling The Client
28 Chapter 1 Installing the client Uninstalling the client You cannot uninstall NNGINA unless it is at the top of the GINA chain. If it is not on top of the GINA list, uninstalling it could break the GINA chain. The software notifies you that you must uninstall NNGINA before GINA can be uninstalled. -
Page 29: Chapter 2 Customizing The Client
The Contivity VPN Client supports dynamic DNS registration, which you can configure at the group level on the Contivity gateway. The Contivity VPN Client also provides support for IP Security (IPsec) mobility and persistent tunneling. -
Page 30: Configuring Client Profiles
However, there are setup.ini settings that allow you to produce custom clients with modified AES support. Contivity VPN Client AES support is enabled by default. To disable it, use a setup.ini setting that has a corresponding registry setting. This setting appears under the [Options] portion of the setup.ini file:... -
Page 31: Table 3 Supported Usetokens And Tokentype Settings
UsePAPGroup—0 indicates no RADIUS authentication; 1 indicates RADIUS authentication. GroupName—Options > Authentication Options dialog box Group Name • field. • SavePassword—0 indicates that the user did not save the PIN/Password; 1 indicates that the user saved the PIN/Password. (Table Configuring the Contivity VPN Client... -
Page 32: Setup.ini File
(EnableLangDlg=Y). The [ISUPDATE] is an InstallShield update URL. It is not used by the Contivity VPN Client. The AesDisabled setting disables AES support. If set to 1, AES is disabled. The default is enabled. The setup.ini variable maps directly to a new registry key... -
Page 33: Customizing The Setup.ini File
[HKEY_LOCAL_MACHINE\SOFTWARE\NortelNetworks\Extranet Access Client] “AesDisabled”=dword:00000001 The Contivity VPN Client uses the registry settings for its run-time decisions. If the key is not present, the default (AES enabled) is assumed. The AES settings cannot be modified through the GUI. AES is visible to the end user only in the Status window where the Security and IKE fields display the appropriate AES information when an AES connection is established. - Page 34 ForcedReboot=0, the Dialog box appears and recommends that you reboot. If set to 1, client is installed with the logging option turned on. The default is 0 and logging is turned off. Creates named folder in the Start Menu. Default is Nortel Networks.
- Page 35 Windows service. If set to 0, it will not be installed or uninstalled if previously installed. Client installs in this directory\folder if specified. Default C:\Program Files\Nortel Networks. To keep the Microsoft Operating System default setting on MS IPsec Service. Configuring the Contivity VPN Client...
- Page 36 In this case, if a user logs off an NT domain while the tunnel is still up (that is, the Contivity VPN Client, run as a service, is still running), a warning dialog will pop up and give 5 seconds to let the user disconnect.
- Page 37 8 and less than or equal to 500. If not set, the default value is 20. Note: Due to characteristics of various networks, satellite networks in particular, a larger number of buffers may be required to achieve optimum results. Configuring the Contivity VPN Client...
- Page 38 The Nortel Software License agreement can be found on Page 3 of this document or the package containing the client software and documentation CD.
-
Page 39: Installation Modes And Options
SkipScreens=1 Silent mode In this mode, no license agreement appears, and the message Setup Complete...Restart the System before using the Contivity VPN Client is shown for 4 seconds. No reboot is performed. In setup.ini set the following: [Options] SkipLicenseAgreement=1 SkipScreens=1... -
Page 40: Quiet Mode
40 Chapter 2 Customizing the client Quiet mode In this mode, the user must dismiss the license agreement and then the reboot/ finish dialog. The user can reboot now or at a later time. In setup.ini set the following: [Options] SkipScreens=1 DisplayReboot=1 Reboot Only mode... -
Page 41: Setting Up The Group.ini File
> under Groups Edit: IPsec Configure settings. Prevents the user from trying to save the user password or PIN; this is also done from Groups > Edit: IPsec Configure settings. Profile name of your connection. Configuring the Contivity VPN Client... -
Page 42: Custom Icons
You use the custom client icon facility to insert your corporate icons in place of the existing icons for the client. There are four Nortel Networks icon groups that you can replicate, and within each of the four, you should create different indicators that imply activities such as sending or receiving data or establishing a connection. -
Page 43: Create Your Icons
There are from two to four different representations of the group icon within each group. You can create icon bitmaps in whatever style you prefer; however, the Nortel Networks icons are intended to convey a message for the given action, such as data transfer activity or establishing a connection. -
Page 44: Contivity Vpn Client Task Bar Icons
This icon is also used as the Desktop Shortcut icon when you create an Auto-Connect shortcut from the Create Shortcut selection under the Contivity VPN Client file menu. Additionally, it appears in the program folder that is created during the installation process: Start >... -
Page 45: Custom Bitmaps
This section describes how to insert custom bitmaps in the main client dialog box message, the client status message, and the Extranet Connection Manager dialog box. Client dialog bitmap (eacdlg.bmp) Figure 17 on page 46 is the bitmap on the main dialog box of the client. Configuring the Contivity VPN Client... -
Page 46: Client Status Bitmap (Eacstats.bmp)
Figure 17 Contivity VPN Client bitmap To replace it with a custom bitmap: Create a 16-color bitmap that is 93 x 279 pixels. Name the bitmap eacdlg.bmp. Copy it into the custom installation directory with the other custom icons and installation files. -
Page 47: Client Gina Bitmap (Nnginadlg.bmp)
The client checks for a new customized bitmap each time the dialog is initialized. The NNGINA looks for a custom bitmap named nnginadlg.bmp in the installation directory under the icons folder. If the Contivity VPN Client was installed into the D:\Program Files\Nortel Networks directory, the NNGINA will look for the custom bitmap as D:\Program Files\Nortel Networks\icons\ nnginadlg.bmp. -
Page 48: Banners
Banners Security banners A Security banner displays a message that is pushed from the server when a VPN tunnel is established, if the banner has been configured on the server. All traffic to the server is blocked until the user acknowledges the banner. The user has three options: Accept/Close —... -
Page 49: Dynamic Domain Name System (Dns)
If TunnelGuard checking is enabled on the server, the server periodically checks for the existence of TunnelGuard Agent. If this check fails, the server sends a message to Contivity VPN Client. The contents of the message are displayed in a message box (Figure 22 on page Configuring TunnelGuard for the Contivity Secure IP Services Gateway. -
Page 50: Installing A Custom Client
Icons. By default, this directory is: C:\Program Files\Nortel Networks\Icons To repackage your custom installation with the new icons and bitmaps into a... - Page 51 To automate the Contivity VPN Client installation, use the command line option AUTO when running the installation. This causes the Contivity VPN Client installation to install with all default options selected. To run the automatic installation, enter the following under Start > Run: eac601d.exe AUTO...
-
Page 52: Controlling The Client From A Third-Party Application
VPN connection, terminate the connection, and query the status of the connection. To learn more about this feature, contact Nortel Support at 1 800 4Nortel. You can write an application and then have it establish a tunnel with command-line switches. -
Page 53: Table 6 Command Line Parameters
If the application also supplies a Windows message and Windows handle for the application, the Contivity VPN Client notifies the application when the connection is established. Table 6 client recognizes. Table 6 Command line parameters Switch User entry <Windows handle>... - Page 54 For the alttype command line switch, use one of the following: • CN_RFC822_NAME 1 • CN_DNS_NAME 2 • CN_DIRECTORY_NAME 4 • CN_RESOURCE_LOCATOR 6 • CN_IP_ADDRESS 7 • CN_REGISTERED_ID 8 A sample command line string to launch the client and get a message posted back to the launching application is: Extranet.exe -h 1234 -m 1225 -a MyExtraNetConnection Following the example above, when the tunnel either connects or fails to connect,...
-
Page 55: Running In Silent Success Mode
To programmatically disconnect the extranet connection, post a WM_USER Message (PostMessage) to the Windows handle of the IPsec client (call FindWindow for the title of the Contivity VPN Client window). Set lParam to True to disconnect the tunnel. If you set lParam to False and issue a SendMessage instead of a PostMessage, then the IPsec client tells you if it is connected (True) or not (False). -
Page 56: Remotely Changing The Group Password
56 Chapter 2 Customizing the client Remotely changing the group password To provide a method to overwrite the group password information, the Contivity VPN Client has a set of command line options for the different authentication methods. The syntax is: extranet.exe -auth <authentication type>... - Page 57 If you are using an Axent software token: extranet.exe -auth 4 -axentPath <axentpath> -serverip <server ip> -gid <group id> -gpwd <group password> extranet.exe -auth 10 -profile <profilename> -axentPath <axentpath> -serverip <server ip> -gid <group id> -gpwd <group password> Configuring the Contivity VPN Client...
-
Page 58: Gina Chaining
If you are using a SecurID software token: extranet.exe -auth 5 -user <username> -pin <PIN> -serverip <server ip> -gid <group id> -gpwd <group password> extranet.exe -auth 10 -profile <profilename> -user <username> -pin <PIN> -serverip <server ip> -gid <group id> -gpwd <group password> If you are using Entrust: extranet.exe -auth 6 -user <entrust profile path>... -
Page 59: Ipsec Mobility And Persistent Tunneling
Contivity gateway. These messages are encrypted and authenticated based on the IKE SA to ensure security. The Contivity VPN Client logs events to the logfile. This includes events such as Contivity VPN Client sending messages that the IP address changed, and receiving acknowledgement that these messages were received by the Contivity gateway. -
Page 60: Inverse Split Tunneling
When operating in IPsec mobility mode with split tunneling enabled, the Contivity VPN Client does not consider the routing table to be maliciously altered and will not bring down the tunnel in the following cases: • IP address change for any adapter •... -
Page 61: Configuring Tunneling Modes Using The Cli
The tunneling mode is selected in the CLI using the following commands after entering group ipsec configuration mode. split tunneling <enable|inverse|inverse-local> Table 7 shows the options. Network Selection sent to Contivity VPN Client None Split Tunnel networks Inverse Split Tunnel Networks Inverse Split Tunnel Networks... -
Page 62: Co-Existence With Ms Ipsec Service
“16 Net” Persistent tunneling provides a continuous connection. After successfully establishing a tunnel session to the Contivity gateway, the Contivity VPN Client makes every attempt to maintain a viable VPN connection without additional user intervention. -
Page 63: Figure 24 Ipsec Settings Page
IPsec Settings page with NAT Traversal enabled. and the UDP port set to an unused port. Figure 24 IPsec Settings page Select Profiles > Groups > Edit > IPsec. The Groups > Edit > IPsec page opens. Select one NAT Traversal type. Configuring the Contivity VPN Client... -
Page 64: Figure 25 Groups > Edit > Ipsec Page
64 Chapter 2 Customizing the client Figure 25 shows the Group > Edit > IPsec page with one NAT Traversal type selected. Figure 25 Groups > Edit > IPsec page Click OK. 311644-J Rev 00... -
Page 65: Chapter 3 Using Certificates
Microsoft Certificate storage also provides a mechanism to import digital certificates granted by third-party Certification Authorities through the use of standard messages (PKCS #12). This allows the Contivity VPN Client and the Contivity Secure IP Services Gateway to make use of Certification Authorities, such as Netscape, that have not been tightly integrated with the Contivity VPN Client and the Contivity gateway. -
Page 66: Ms-Capi Feature Dependencies And Backward Compatibility
MS-CAPI feature dependencies and backward compatibility The Contivity VPN Client has dependencies on the Microsoft Crypto-API. Due to the varying availability of these required features on the different Windows platforms, there may be some restrictions. When using a Microsoft Enterprise CA, the Contivity VPN Client Version 4.10 installed on Windows XP, Windows 2000... -
Page 67: Microsoft Ca Digital Certificate Generation
Steps from browser running on client system or CA system Attach to your CA through your browser. Select Request a certificate. Select Advanced request. Select Submit a certificate request to this CA using a form. Configuring the Contivity VPN Client... -
Page 68: Netscape Digital Certificate Generation
Fill out Identifying Information: (Subject DN). Fill out Intended Purpose: (Client Authentication Certificate and IPsec Certificate). The CSP is the Crypto Provider that will generate the key pair. Click on Submit. Be sure to remember the request ID. Netscape digital certificate generation Connect to Netscape CA. -
Page 69: Microsoft Ca Digital Certificate Retrieval
To import the certificate into your Netscape client certificate store, go to the bottom of the page and click on Import Your Certificate. Your public/private key material as well as your digital certificate are now stored in the Netscape certificate store. Configuring the Contivity VPN Client... -
Page 70: Configuring Contivity Vpn Client For Ms Stored Certificates
Configuring Contivity VPN Client for MS stored certificates You can use the Connection Wizard from the Contivity VPN Client to configure the client connection to use Microsoft stored certificates. You can also configure MS stored certificates by selecting Options > Authentication. -
Page 71: Entrust Certificate-Based Authentication
Log in to the Entrust Entelligent Client. Create an Entrust profile on the Contivity VPN Client. The password field is grayed out on the Contivity VPN Client because the user is already logged in. Click on Connect to establish VPN connection. -
Page 72: Custom Installation
Client\Custom directory as you would for custom icon files: • The Entrust DLLs, which are on the Contivity VPN Client CD in the Client\Entrust directory. The Entrust DLLs are kmpapi32.dll and enterr.dll. •... -
Page 73: Entrust Certificate Enrollment Procedure
Figure 26 shows the Entrust PKI server placed in each of these three places. Figure 26 An Entrust PKI server can be located in three places Configuring the Contivity VPN Client... -
Page 74: Entrust Certificate Enrollment Tunnel
PKI server. The TCP firewall filter ports are 389 and 709. Nortel has preconfigured a filter rule called Entrust PKI that allows access to the Entrust PKI server. You can choose this filter for any group from the Profiles >... -
Page 75: Entrust Certificate Enrollment Process
Contivity gateway, or behind both the firewall and the Contivity gateway. Double-click on the Contivity VPN Client icon. The Contivity VPN Client screen appears. Select File > Connection Wizard. - Page 76 Enter the reference number and authorization code (provided to the remote user by the administrator — the administrator gets this information after entering a new user into the PKI); then click on Next. The Entrust Certificate PKI Accessibility screen appears. 10 Click on the appropriate button indicating where the Entrust Certificate PKI is located, or click on I Don’t Know, if that is the case.
-
Page 77: Entrust Roaming Profiles Support
The CVC has an online/offline configuration that pertains to where the Certificate Authority (CA) server is in relation to the client. — Online means the CA server is accessible to the client before the tunnel is established. Configuring the Contivity VPN Client... - Page 78 — Offline means the tunnel must be established before the client PC has access to the CA server. • Online/Offline as it pertains to Roaming clients: — Online Roaming means the client logs in with the credentials supplied by the Roaming Profile server. The Roaming Profile server must be accessible to the client PC before tunnel establishment.
-
Page 79: Configuring Entrust For Roaming Profiles
From the Registration Authority (RA): Export, Edit, and Import the mastercert.spec file. Edit the entmgr.ini file. Edit the entrust.ini file, place into the C:\WINNT directory. Add a Roaming User. shows PCs connected to a roaming server. Configuring the Contivity VPN Client... - Page 80 80 Chapter 3 Using certificates To edit the mastercert.spec file: It is only necessary to edit this file if Off-line roaming is required. These lines must be added in a specific section of the file. Please read RoamServ60Admin.pdf for the specific details. Profile Use for Roaming Users Setting: offline_prof_use=1.2.840.113533.7.77.20,BitString,<offline_prof_us e>...
-
Page 81: Create A Roaming Profile Administrator From Ra
Select Create Profile. Click the Certificate info property page. Select Enterprise in the Category drop-down list and click Profile Server (Profileserver Certificates) in the Type list. Click OK. Configuring the Contivity VPN Client... - Page 82 10 The Create Profile dialog box appears. Note: This begins the procedure to create a roaming profile administrator from RA. Note: If you did not select Create Profile in Step 6, the New User dialog box closes and you are returned to Entrust/RA. To open the Create Profile dialog box from Entrust/RA, right-click the Roaming Server entry in the right pane and click Create Profile in the pop-up menu.
-
Page 83: Configuring Roaming Profile Clients
Entrust Entellegence or the CVC provides Roaming Profile support independently, or both can co-exist together on the same PC. You do not have to install Entrust Entellegence Client for the CVC to support Roaming Profiles. Configuring the Contivity VPN Client... - Page 84 84 Chapter 3 Using certificates 311644-J Rev 00...
-
Page 85: Appendix A Client Logging
Unable to rename previous session log file. Check for DOS file protection issue. Windows socket initialization failed. Failed to create a DHCP socket; connection will be closed. Secure connection has been lost; click Connect to reestablish connection. Configuring the Contivity VPN Client... - Page 86 Table 8 Client error messages (continued) Message IDS_DHCPFAILEDCONTINUE IDS_DHPCRECVERR IDS_LOGINFAILED IDS_SALOSTDURINGDHCP IDS_SESSION_MAX LOG_CAL_EXPIRED LOG_CONNECTION_LOST LOG_CONNECTION_TERMINATE LOG_CP_VIOLATE LOG_INSTALL_REBOOT LOG_IPSEC_SVC_DISABLED LOG_NO_RESPONSE LOG_NOKEEPALIVE LOG_ONEINSTANCE LOG_SEC_ROUTES_CHANGED 311644-J Rev 00 Description Failed to obtain DNS and WINS configuration information; connection closed. This usually indicates that a firewall is preventing IPsecurity packets from reaching the Contivity gateway.
- Page 87 Windows 9x Clear DNS is set. Client failover invoked. Failover list set to none. NAT traversal forcing use of keep-alives. Server load balancing; client connection redirected. Removing WINS/DNS servers. Adding WINS/DNS servers. Configuring the Contivity VPN Client...
- Page 88 88 Appendix A Client logging 311644-J Rev 00...
-
Page 89: Index
GINA chaining 58 graphical identification and authentication (GINA) group.ini file setting up 41 group.ini file settings 41 GroupIniFile 35 HiddenInstall 35 InstallAsService 35 Installation modes and options Quiet mode 40 Reboot Only mode 40 Silent mode 39 Configuring the Contivity VPN Client... - Page 90 InstallGina 35 IPSec mobility 59 logging 59 License Agreement 38 LockKeepAlives 36 LogoffWarning 36 MSDUN13PATH 37 NoChangeProfiles 37 Nortel Software License Agreement 38 PackageForTheWeb 50 persistent tunneling 62 PKCS #12 65 PreserveTBKFile 37 ProductName 37 publications hard copy 17 README.TXT 51...
Need help?
Do you have a question about the VPN Client and is the answer not in the manual?
Questions and answers