Managing the VPN Client

This chapter explains the tasks you can perform to manage connection entries, view and manage event reporting, and upgrade or uninstall the VPN Client software. The management features are available from the Cisco Systems VPN Client applications menu. (See Figure 5-1.)

Note If you installed the VPN Client via the Microsoft Windows Installer, the Cisco Systems VPN Client menu does not include the Uninstall VPN Client option.

Note If you are a system administrator, refer to the VPN Client Administrator Guide for information on configuring the VPN 3000 Concentrator and preparing preconfigured profiles for VPN Client users.

Managing VPN Client Connection Entries

To manage a connection entry, start the Cisco VPN Client and choose VPN Dialer from the menu of applications.

Note On a Windows 9x, Windows Me, or Windows XP home system, the VPN Client does not display Windows Logon Properties.

Cloning a Connection Entry

To clone a connection entry with all its properties and use it as the basis for creating a new entry, follow these steps:

Step 1

On the VPN Client's main dialog box, click the Connection Entry drop-down menu and choose the entry you want to clone.

Step 2

On the VPN Client Options menu, choose Clone Entry. (See Figure 5-3.)

Step 4

The dialog box closes. The new name appears in the Connection Entry list in the VPN Client main dialog box.

Deleting a Connection Entry

Step 1

On the VPN Client's main dialog box, click the Connection Entry drop-down menu arrow and choose the entry you want to delete.

Step 2

On the VPN Client Options menu, choose Delete entry. (See Figure 5-3.)

Renaming a Connection Entry

You can rename a connection entry and retain all its properties. Each connection entry name must be unique. Since these names are not case-sensitive, be sure the new name differs in content, not just case.

Step 1

On the VPN Client's main dialog box, click the Connection Entry drop-down menu and choose the entry you want to rename.

Step 2

On the VPN Client Options menu, choose Rename Entry. (See Figure 5-3.)

Step 3

Enter a new name for this connection entry in the field and click OK.

The dialog box closes. The new name appears in the Connection Entry list in the VPN Client main dialog box.

Importing a VPN Client Configuration File

You can automatically configure your VPN Client with new settings by importing a new configuration file (a file with a .pcf extension, called a profile) that your system administrator supplies.

Step 1

Obtain a new VPN Client profile (.pcf) file from your system administrator.

Step 3

On the VPN Client main dialog box, click Options and choose Import Entry from the menu.

The VPN Client opens a window for you to choose the profile file. (See Figure 5-7.)

Step 4

Browse until you locate the profile file and when you have located it, choose it and click Open.
(See Figure 5-8.)

The VPN Client displays a message informing you that your file import was successful. (See Figure 5-9.) If the profile already exists, you receive a message asking if you want to overwrite it.

Alternatively, you can copy the .pcf file into the Profiles directory and restart the VPN Dialer application.

Your VPN Client is now configured with the connection entries and parameters specified by this new profile file. You can examine or modify the connection entries by clicking the Connection Entry drop-down menu on the main dialog box, choosing an entry, and clicking Options > Properties.

Erasing a Saved Password for a Connection Entry

You or your administrator may have configured an entry to save the authentication password on your PC so you do not have to enter a password when you are connecting to the VPN device. Normally we recommend that you not use this feature, because storing the password on the PC can compromise security, and requiring a password to authenticate you every time you attempt to connect to the VPN device is fundamental to maintaining security on the private network. However, there may be reasons for temporarily bypassing the authentication dialog box, for example, when you want to create a batch file for your PC to log in to a VPN device to accomplish some task that requires using the private network behind the VPN device.

If there is a password saved on your system, and authentication fails, your password might be invalid.

To eliminate a saved password, use the Erase User Password feature on the Options menu. Erase User Password is available only when you have previously checked Save Password on the User Authentication dialog box. (See Figure 5-10.)

When the VPN device allows saving passwords on the remote site and Save Password is in effect, then Erase User Password is available on the Options menu. (See Figure 5-11.)

Note If you get a failed-to-authenticate message, you should enable Erase User Password on the VPN Client and verify that your password is valid. When you attempt to connect, the VPN Client prompts you to enter your password.

Note The VPN Client displays Windows Logon Properties only on Windows NT, Windows 2000, and Windows XP.

With Erase User Password in effect, the next time you connect, the authentication dialog box prompts you to enter your password: on the Options menu, the Erase User Password feature is no longer available. (See Figure 5-13.)

Note The VPN Client displays Windows Logon Properties only on Windows NT, Windows 2000, and Windows XP.

Creating a Shortcut for a Connection Entry

You can create a shortcut on your desktop to quickly and directly launch a VPN Client connection entry that you use frequently.

Step 1

On the VPN Client's main dialog box, click the Connection Entry drop-down menu and choose an entry.

Step 2

On the VPN Client Options menu, choose Create Shortcut. (See Figure 5-3.)

Enabling Stateful Firewall (Always On)

The VPN Client includes an integrated stateful firewall that provides protection when split tunneling is in effect and protects the VPN Client PC from Internet attacks while the VPN Client is connected to a VPN Concentrator through an IPSec tunnel. This integrated firewall includes a feature called Stateful Firewall (Always On).

Stateful Firewall (Always On) provides even tighter security. When enabled, this feature allows no inbound sessions from all networks, whether or not a VPN connection is in effect. Also, the firewall is active for both encrypted and non encrypted traffic. There are two exceptions to this rule. The first is DHCP, which sends requests to the DHCP server out one port but receives responses from DHCP through a different port. For DHCP, the stateful firewall allows inbound traffic. The second is ESP. The stateful firewall allows ESP traffic from the secure gateway, because ESP rules are packet filters and not session-based filters. For the latest information on other exceptions, if any, refer to Release Notes for Cisco VPN Client for Windows.

To enable the stateful firewall, click Stateful Firewall (Always on) on the Options menu. When Stateful Firewall (Always On) is enabled, you see a check in front of the option. This feature is disabled by default. You can enable or disable this feature from the VPN Client Options menu. During a VPN connection, you can view the status of this feature by right-clicking the lock icon in the system tray. You can also enable or disable this feature from the same menu.

Launching an Application

You can configure the dialer to automatically launch an application before establishing a connection. Some examples of why you would want to use this feature follow:

•

You are configured for start before logon and you need to start an authentication application at the logon desktop.

•

You want to launch a monitoring application such as the Log Viewer before each connection.
(See Figure 5-15 to Figure 5-17.)

To configure the VPN Dialer to launch an application from the logon desktop, use the Application Launcher.

The Application Launcher starts the specified application once per session. To launch an application again, you must exit from the VPN Dialer, restart the VPN Dialer, and launch the application.

Step 1

Open the VPN Dialer Options pull-down menu (shown in Figure 5-3) and click Application Launcher. (See Figure 5-15.)

Note The VPN Client displays Windows Logon Properties only on Windows NT, Windows 2000, and Windows XP.

The VPN Dialer displays a dialog box prompting for the name of the application. (See Figure 5-16.)

Step 2

Click Browse to locate and then choose the complete pathname to the application as well as the name of the application. (See Figure 5-17.)

The application name appears in the Application Launcher dialog box. In this example, the VPN Dialer is configured to launch the Log Viewer before a connection.

Turning Off Application Launcher

Step 2

When the Application Launcher dialog box displays, clear the Enable checkbox.

Managing Windows NT Logon Properties

This section describes special logon features for the Windows NT platform, which includes Windows NT 4.0, Windows 2000, and Windows XP. These features include:

•

Permission to launch a third party application before logging on to a Windows NT system

To access the Windows logon properties, open the VPN Client Options pull-down menu (shown in Figure 5-3) and choose Windows Logon Properties. The VPN Client displays a dialog box containing three parameters. (See Figure 5-18.)

Note The VPN Client displays Windows Logon Properties only on Windows NT, Windows 2000, and Windows XP.

Starting a Connection Before Logging on to a Windows NT Platform

On a Windows NT platform, you can connect to the private network before you log on to your system. This feature is called start before logon and its purpose is primarily to let you log in to the domain and run login scripts.

Your administrator may have set this up for you. Once you establish a VPN connection, your credentials are sent to a domain controller for logging in to your system. If you need to launch an application before you log on, see the section " Launching an Application" for information.

When you have established a successful VPN connection, the VPN Dialer window closes, and your logon window displays. If the connection is not successful, the VPN Dialer window continues to display. Your administrator may have set up a banner that lets you know when you have a successful connection.

Step 1

Open the VPN Client Options pull-down menu (shown in Figure 5-3) and choose Windows Logon Properties.

Step 2

Check Enable start before logon and then click OK. (See Figure 5-18.)

What Happens When You Use Start Before Logon

When start before logon is active, the following events occur when your system starts:

•

Your system logon dialog box displays. Other messages might display as well, depending on your setup. Wait until you see the VPN Dialer start.

•

The VPN Dialer starts and displays the connection dialog box over the system logon dialog box.

Note You can use certificates for authentication with start before logon when your personal certificate, along with the CA or intermediary certificate(s), are in your Cisco certificate store and the Microsoft local machine but not your personal Microsoft store (CAPI certificates). However, to use a CAPI certificate, you can log on using cached credentials, make a VPN connection using your CAPI certificate, and disable the "Disconnect VPN connection when logging off" parameter (see " Disconnecting When Logging Off of a Windows NT Platform," following). This action keeps your connection open. Now you can log back on to the system.

For information on enrolling certificates and importing certificates into your Cisco store, see " Enrolling and Managing Certificates."

For information about using start before logon with the Entrust SignOn feature, see " Connecting with an Entrust Certificate."

Turning Off Start Before Logon

To turn this feature off, open the Options pull-down menu on the VPN Dialer connection dialog box and uncheck Enable start before logon. The next time you log on to your system, the VPN Dialer connection dialog box does not automatically display on your logon desktop.

Permission to Launch an Application Before Log On

Your system administrator determines whether you can launch applications and third-party dialers before you log on to a Windows NT platform. To protect system and network security, your system administrator might have disabled this feature. If this feature is greyed out, you cannot launch applications and third-party dialers before logging on to a Windows NT platform. You must have system administrator privileges to change this parameter.

Disconnecting When Logging Off of a Windows NT Platform

This parameter controls whether your VPN Client connection automatically disconnects when you log off your Windows NT system.

To always automatically terminate your connection when you log off, check this parameter. This parameter is checked by default.

To disable auto-disconnect while logging off, remove the check from this parameter. When you remove the check, the VPN Client displays the warning message shown in Figure 5-19.

Disabling this parameter allows your connection to remain up during and after log off, which allows profiles or folders to be synchronized during log off. You would disable this parameter when using the Windows roaming profiles feature.

Note With this feature disabled, you must completely shut down your system to disconnect your VPN Client connection.

Managing Auto Initiation

When your network administrator has configured your VPN Client for auto initiation (by including it in the vpnclient.ini file), the Options menu includes the option Automatic VPN Initiation. (See Figure 5-20.) When you select this option, the VPN Dialer displays a dialog box that lets you enable/disable auto initiation and change the setting of the retry interval. Disabling auto initiation in this way does not remove it from your configuration. If you need to enable auto initiation after you have disabled it, you can return to this dialog box and enable it again. The only way you can remove auto initiation from your configuration is through editing the vpnclient.ini file.

Step 2

To disable auto initiation, click to remove the check mark from Enable.

Or to enable auto initiation after it has been disabled, click Enable to check it.

Step 4

If you are enabling auto initiation, you then must close the VPN Dialer. The authentication dialog then prompts you to enter your authentication information.

To change the setting of the retry interval, enter the new value (1 to 10) in the Retry Interval box and click OK.

Viewing and Managing the VPN Client Event Log

Examining the event log can often help a network administrator diagnose problems with an IPSec connection between a VPN Client and a peer device. The log viewer application collects event messages from all processes that contribute to the client-peer connection. This section shows how to use the Log Viewer to retrieve and manage this information.

Starting the Log Viewer

To start the Log Viewer, use the following path from the Start menu:
Start > Programs > Cisco Systems VPN Client > Log Viewer. (See Figure 5-21.)

The Log Viewer starts, displaying its main window. (See Figure 5-22.) By default, the filter is set to low, so you may not see any events displayed in this window (see the section " Filtering Events").

Displaying the Version of the Software

To display a brief help message that gives you the version number of the software, choose Help from the main menu or click the Help icon.

Collecting Events

To start collecting event messages into the log file, choose Options > Capture. When a check mark appears in front of the Capture option, Log Viewer is collecting events. This option is off by default. Alternatively, you can click the Capture icon.

Each message in the log file comprises at least two lines containing the following fields:

Table 5-1 describes the fields in an event message. Table 5-2 describes Event types and severity levels.

Table 5-1 Fields in an Event Message
Field	Meaning
Event#	The first field shows the event number. Events are numbered incrementally and never reset.
Time	The Time field shows the time of the event: hour:minutes:seconds. The hour is based on a 24-hour clock. For example 15:25:09 identifies an event that occurred at 3:25:09 PM.
Date	The date field shows the date of the event: MM/DD/YYYY. For example, 2/03/2001 identifies an event that occurred on February 3, 2001.
Severity/type/level	This field reports the severity type and level of the event; for example, Sev=Info/4, which identifies an informational event, severity level 4. identifies event types and severity levels
Event Class/Message ID	This field shows the module or source of the event and the message identifier associated with the module. For example, IPSEC/0x63700012.
Message Text	A brief message describing the event. Usually, this message is no more than 80 characters. For example, Delete all keys associated with peer 10.10.99.40. In a message containing arrows, the arrows indicate the direction of the transmission: `>>>` for sending and `<<<` for receiving.

Table 5-2 Event Types and Severity Levels
Type	Level	Meaning
Fault	1	A system failure or nonrecoverable error.
Warning	2 - 3	Imminent system failure or a serious problem that may require user intervention.
Informational	4 - 6	Level 4 provides the most general type (high level) information. Levels 5 and 6 provide more detailed information about the connection.

Filtering Events

To control the amount of information to view with the Log Viewer, choose Options > Filter. Alternatively, you can click the Filter icon.

The Log Viewer displays the Log Viewer Filter message to let you choose the amount of information you want to capture. (See Figure 5-23.)

Step 1

Double-click on one item, or choose more than one item and right click.

Low—Provides the least amount of information. This choice includes severity levels 1 through 3 (all faults and warnings). Low is the default for all classes.

Medium—Includes severity levels 1 through 4; all in Low plus the first level informational events, which provide general information about the connection. Note that a first level informational event is level 4 and appears in the event display as Info/4.

High—Includes severity levels 1 through 6, thus adding two levels of informational events (Info/5 and
Info/6). This setting can lower the performance of all applications on your system, so use it only when your network administrator or a support engineer suggests that you do so.

Table 5-3 Classes That Generate Events in the VPN Client
Class Name	Definition
CERT	Certificate management process (CERT), which handles getting, validating, and renewing certificates from certificate authorities. CERT also displays errors that occur as you use the application.
CLI	Command Line Interface, which lets managers start and end connections, get status information and so on through a command line rather than using the VPN Client graphical user interface.
CM	Connection manager (CM), which drives VPN connections. (CM dials a PPP device, configures IKE for establishing secure connections, and manages connection states.
CVPND	Cisco VPN Daemon (main daemon), which initializes client service and controls messaging process and flow.
DIALER	Windows-only component, which handles configuring a profile, initiating a connection, and monitoring it.
FIREWALL	Firewall component, which generates events related to connections through a firewall.
IKE	Internet Key Exchange (IKE) module, which manages secure associations.
IPSEC	IPSec module, which obtains network traffic and applies IPSec rules to it.
PPP	Point-to-Point Protocol.
XAUTH	Extended authorization application, which validates a remote user's credentials.

Searching the Log File

To locate specific events or event types in the window, choose Search from the main menu. Alternatively, you can click on the Search icon.

The Log Viewer displays the Find message. (See Figure 5-24.) Enter a string to find and click Find Next. You can match on whole words and on case.

Printing the Log File

To print the events displayed in the current window, choose File > Print from the main menu. Alternatively, you can click the Printer icon.

Saving the Log File

To save the currently displayed events in the ipseclog file on your hard drive, choose File > Save as from the main menu. Alternatively, click the Disk icon.

The ipseclog file is a text (.txt) file in DOS format. The Log Viewer saves the information to the Client install directory, which by default is the pathname Program Files\Cisco Systems VPN Client\VPN Client\IPSECLOG.TXT. You can specify any directory and name. (See Figure 5-25.)

Clearing the Events Display

To eliminate all the events currently displayed in the Log Viewer main window, choose Options > ClearLog Display from the main menu. Alternatively, you can click the Erase All icon.

If you want to store the event messages, be sure you save them before you clear the display. Clearing the display does not reset event numbering, nor does it clear the log file itself.

Receiving Notifications From a VPN Device

The VPN device (secure gateway) through which you connect to the private network at your organization can send you notifications. Currently you can receive a notification from your network administrator when it is time to update the VPN Client software or when the VPN device that requires a specific firewall be running on the VPN Client PC detects that the firewall is not running. A notification typically shows up when you start your dialer connection. You can also display notifications while you are connected by clicking Notifications on the Connection Status dialog box. (See Figure 5-26.)

Upgrade Notifications

The notification shown in Figure 5-27 informs a remote user that it is time to upgrade the VPN Client software. The notification includes the location where the remote user can obtain the upgrade. When you receive an upgrade notification that includes a URL, click Launch to go to the site and retrieve the upgrade software. You will receive an upgrade notification every time you connect until you have installed the upgrade software.

Firewall Notifications

If the VPN Client and VPN Concentrator firewall configurations do not match, the VPN Concentrator notifies the VPN Client while negotiating the connection. The notification includes the policy that the VPN Concentrator requires. For example, the notification in Figure 5-28 shows an example firewall notification. The message states that the policy required is AYT and the firewall required is any Zone Labs product.

Upgrading the VPN Client Software (InstallShield)

Upgrading the VPN Client software using this method retains existing connection entries and their parameters.

To install an upgrade of the VPN Client over an existing version on your system, use the following procedure, which first uninstalls the existing version, and then reboots your PC and installs the new version.

When it starts, the installation wizard detects the existing version and asks you to confirm that you want to remove that version and reboot your PC. (See Figure 5-29.)

The installation program removes the old version and asks you to confirm the system restart. (See Figure 5-30.)

If you are installing from diskettes, reinsert Disk 1 after your system restarts and displays the Windows logo screen, but before the desktop appears.

Step 3

To restart your system, click Yes (the default) and click Finish.

The installation wizard restarts your system. Once your system has restarted, installation continues automatically.

Upgrading the VPN Client Software (MSI)

Upgrading the VPN Client software using this MSI in this recommended way retains existing connection entries and their parameters.

To install an upgrade of the VPN Client over an existing version on your system, use the following procedure.

Step 1

Remove any existing version of the VPN Client software through the Add/Remove available from the Windows Control Panel.

Uninstalling the VPN Client with the Uninstall Application

This option is available only if you have installed the VPN Client via InstallShield. Uninstalling the VPN Client means completely removing all VPN Client software from your computer. For example, if you are changing or upgrading your PC, you might want to uninstall the VPN Client. Also, if you are getting ready to install Cisco VPN Client 3.6 using Microsoft Windows Installer (MSI), you can run the Uninstall application to remove previous versions of the Cisco VPN Client.

Note Do not attempt to uninstall or upgrade the VPN Client software from a mapped network drive.

Before you run the uninstall program, make sure you have closed all of your remote access (Dial-Up Networking) connections and all VPN Client applications. Then use the following procedure. (See Figure 5-31.)

Note If you installed the VPN Client via the Microsoft Windows Installer, the Cisco Systems VPN Client menu does not include the Uninstall VPN Client option.

Step 1

Choose Start > Programs > Cisco Systems VPN Client > Uninstall VPN Client.

The Uninstall Wizard runs and asks if you want to really want to remove the VPN Client applications. (See Figure 5-32.)

Step 2

To completely remove the VPN Client software from your system, click Yes. Otherwise, click No.

Next, the Uninstall Wizard asks if you want to delete your connection profiles. (See Figure 5-33.)

Step 3

To preserve your connection profiles (which contain configured connection entries), click No.

Then the Uninstall Wizard asks if you want to delete your certificates. (See Figure 5-34.)

Finally, the Uninstall Wizard prompts you to restart your system. To complete the uninstallation, you must restart your system.

Step 5

To restart your system, click Yes (the default) and then click Finish.

Note When you uninstall the VPN Client software after you have run the Log Viewer and you have clicked yes to remove your certificate and profile directories, the vpnclient.ini and ipseclog.txt files remain on your system. Since these files were generated after you installed the software, they are not removed when you uninstall the software. You have to remove them manually.

Removing the VPN Client Software MSI Installation

To remove the VPN Client when it has been installed via MSI, use the Add/Remove utility available from the Control Panel. You must remove any version of the Cisco VPN Client or any other VPN Client before upgrading the Cisco VPN Client with MSI.

Table Of Contents