aXsGUARD Gatekeeper Open VPN How To v1.4 - Vasco
aXsGUARD Gatekeeper Open VPN How To v1.4 - Vasco
aXsGUARD Gatekeeper Open VPN How To v1.4 - Vasco
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong><br />
<strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong>
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong><br />
Legal Notice<br />
VASCO Products<br />
VASCO Data Security, Inc. and/or VASCO Data Security International GmbH are referred to in this document as<br />
'VASCO'. VASCO Products comprise Hardware, Software, Services and Documentation. This document<br />
addresses potential and existing VASCO customers and has been provided to you and your organization for the<br />
sole purpose of helping you to use and evaluate VASCO Products. As such, it does not constitute a license to<br />
use VASCO Software or a contractual agreement to use VASCO Products.<br />
Disclaimer of Warranties and Limitations of Liabilities<br />
VASCO Products are provided ‘as is’ without warranty or conditions of any kind, whether implied, statutory, or<br />
related to trade use or dealership, including but not limited to implied warranties of satisfactory quality,<br />
merchantability, title, non-infringement or fitness for a particular purpose.<br />
VASCO, VASCO DISTRIBUTORS, RESELLERS AND SUPPLIERS HAVE NO LIABILITY UNDER ANY<br />
CIRCUMSTANCES FOR ANY LOSS, DAMAGE OR EXPENSE INCURRED BY YOU, YOUR ORGANIZATION OR ANY<br />
THIRD PARTY (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS<br />
INTERRUPTION OR LOSS OF DATA) ARISING DIRECTLY OR INDIRECTLY FROM THE USE, OR INABILITY TO USE<br />
VASCO SOFTWARE, HARDWARE, SERVICES OR DOCUMENTATION, REGARDLESS OF THE CAUSE OF THE<br />
LOSS, INCLUDING NEGLIGENCE, EVEN IF VASCO HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH<br />
DAMAGES, OR IF THEY WERE FORESEEABLE. OUR MAXIMUM AGGREGATE LIABILITY TO YOU, AND THAT OF<br />
OUR DISTRIBUTORS, RESELLERS AND SUPPLIERS SHALL NOT EXCEED THE AMOUNT PAID BY YOU FOR THE<br />
PRODUCT. THE LIMITATIONS IN THIS SECTION SHALL APPLY WHETHER OR NOT THE ALLEGED BREACH OR<br />
DEFAULT IS A BREACH OF A FUNDAMENTAL CONDITION OR TERM, OR A FUNDAMENTAL BREACH. THIS<br />
SECTION WILL NOT APPLY ONLY WHEN AND TO THE EXTENT THAT APPLICABLE LAW SPECIFICALLY<br />
REQUIRES LIABILITY DESPITE THE FOREGOING EXCLUSIONS AND LIMITATIONS.<br />
Intellectual Property and Copyright<br />
VASCO Products contain proprietary and confidential information. VASCO Data Security, Inc. and/or VASCO<br />
Data Security International GmbH own or are licensed under all title, rights and interest in VASCO Products,<br />
updates and upgrades thereof, including copyrights, patent rights, trade secret rights, mask work rights,<br />
database rights and all other intellectual and industrial property rights. No part of these Products may be<br />
transferred, disclosed, reproduced or transmitted in any form or by any means, electronic, mechanical or<br />
otherwise, for any purpose, except as expressly permitted by VASCO or its authorized licensee in writing.<br />
This document is protected under US and international copyright law as an unpublished work of authorship. No<br />
part of it may be transferred, disclosed, reproduced or transmitted in any form or by any means, electronic,<br />
mechanical or otherwise, for any purpose, except as expressly permitted in writing by VASCO or its authorized<br />
licensee.<br />
Trademarks<br />
VASCO®, VACMAN®, IDENTIKEY®, <strong>aXsGUARD</strong>®, DIGIPASS®, and ® are registered or unregistered<br />
trademarks of VASCO Data Security, Inc. and/or VASCO Data Security International GmbH in the U.S. and other<br />
countries. Other company brand or product names or other designations, denominations, labels and/or other<br />
tags, titles, as well as all URLs (Internet addresses) linked to such designations or communications (irrespective<br />
of whether protected by intellectual property law or not), mentioned in VASCO Products may be the trademarks<br />
or registered trademarks or be part of any other entitlement of their respective owners.<br />
Radius Disclaimer<br />
Information on the RADIUS server provided in this document relates to its operation in the <strong>aXsGUARD</strong><br />
<strong>Gatekeeper</strong> environment. We recommend that you contact your NAS/RAS vendor for further information.<br />
Copyright © 2009 VASCO Data Security, Inc, VASCO Data Security International GmbH All rights reserved.<br />
© 2009 - VASCO Data Security 2
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> Table of Contents<br />
Table of Contents<br />
1 Introduction...............................................................................................................................................9<br />
1.1 Audience and Purpose of this document.............................................................................................9<br />
1.2 What is the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong>?.................................................................................................11<br />
1.3 About VASCO..................................................................................................................................11<br />
2 <strong>Open</strong> <strong>VPN</strong> General Concept......................................................................................................................12<br />
2.1 Overview.........................................................................................................................................12<br />
2.2 What is <strong>Open</strong><strong>VPN</strong>?..........................................................................................................................12<br />
2.3 Data Encryption...............................................................................................................................13<br />
2.4 Authentication Methods...................................................................................................................13<br />
2.5 Supported Network Protocols...........................................................................................................14<br />
2.6 <strong>How</strong> a Client finds the <strong>Open</strong><strong>VPN</strong> Server.............................................................................................14<br />
3 <strong>Open</strong><strong>VPN</strong> Server Configuration.................................................................................................................15<br />
3.1 Overview.........................................................................................................................................15<br />
3.2 Feature Activation............................................................................................................................15<br />
3.3 Initializing the CA.............................................................................................................................17<br />
3.4 Generating a Server Certificate.........................................................................................................18<br />
3.5 Server Settings................................................................................................................................19<br />
3.5.1 Enabling the <strong>Open</strong><strong>VPN</strong> Server......................................................................................................19<br />
3.5.2 Connection Settings....................................................................................................................20<br />
3.5.3 Encryption and Authentication Settings.........................................................................................21<br />
3.5.4 Keepalive Settings......................................................................................................................22<br />
3.6 Authentication Settings....................................................................................................................23<br />
3.7 Generating Client Certificates...........................................................................................................25<br />
3.8 Exporting Client Certificates..............................................................................................................26<br />
3.9 Revoking Certificates.......................................................................................................................27<br />
3.10 User Settings..................................................................................................................................28<br />
3.10.1 Granting <strong>Open</strong><strong>VPN</strong> Access..........................................................................................................28<br />
3.10.2 <strong>VPN</strong> Firewall Rights....................................................................................................................29<br />
4 <strong>Open</strong><strong>VPN</strong> Client Windows XP Configuration..............................................................................................31<br />
4.1 Overview.........................................................................................................................................31<br />
4.2 Prerequisites...................................................................................................................................31<br />
4.3 Installing the <strong>Open</strong><strong>VPN</strong> Client...........................................................................................................31<br />
4.4 Configuring the <strong>Open</strong><strong>VPN</strong> Client.......................................................................................................32<br />
© 2009 - VASCO Data Security 3
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> Table of Contents<br />
4.5 Starting the <strong>Open</strong><strong>VPN</strong> Connection.....................................................................................................42<br />
5 <strong>Open</strong><strong>VPN</strong> Client Windows Vista Configuration...........................................................................................45<br />
5.1 Overview.........................................................................................................................................45<br />
5.2 Prerequisites...................................................................................................................................45<br />
5.3 Installing the <strong>Open</strong><strong>VPN</strong> Client...........................................................................................................45<br />
5.4 Configuring the <strong>Open</strong><strong>VPN</strong> Client.......................................................................................................46<br />
5.5 Starting the <strong>Open</strong><strong>VPN</strong> Connection.....................................................................................................56<br />
6 <strong>Open</strong><strong>VPN</strong> Client Windows 7 Configuration................................................................................................59<br />
6.1 Overview.........................................................................................................................................59<br />
6.2 Prerequisites...................................................................................................................................59<br />
6.3 Installing the <strong>Open</strong><strong>VPN</strong> Client...........................................................................................................59<br />
6.4 Configuring the <strong>Open</strong><strong>VPN</strong> Client.......................................................................................................60<br />
6.5 Starting the <strong>Open</strong><strong>VPN</strong> Connection.....................................................................................................71<br />
7 Status and Logs.......................................................................................................................................75<br />
7.1 Overview.........................................................................................................................................75<br />
7.2 <strong>Open</strong><strong>VPN</strong> Status..............................................................................................................................75<br />
7.3 <strong>Open</strong><strong>VPN</strong> Logs................................................................................................................................75<br />
8 Troubleshooting.......................................................................................................................................77<br />
9 Support....................................................................................................................................................80<br />
9.1 Overview.........................................................................................................................................80<br />
9.2 If you encounter a problem...............................................................................................................80<br />
9.3 Return procedure if you have a hardware failure................................................................................80<br />
© 2009 - VASCO Data Security 4
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> Table of Contents<br />
Illustration Index<br />
Image 1: <strong>Open</strong><strong>VPN</strong> Implementation...........................................................................................................................................................................12<br />
Image 2: <strong>Open</strong><strong>VPN</strong> Feature Activation.......................................................................................................................................................................16<br />
Image 3: CA Initialization.......................................................................................................................................................................................... 17<br />
Image 4: Creating a Server Certificate.......................................................................................................................................................................18<br />
Image 5: Enabling the <strong>Open</strong><strong>VPN</strong> Server.....................................................................................................................................................................19<br />
Image 6: <strong>Open</strong><strong>VPN</strong> Connection Settings....................................................................................................................................................................20<br />
Image 7: Encryption and Authentication Settings........................................................................................................................................................22<br />
Image 8: Keepalive Settings.....................................................................................................................................................................................23<br />
Image 9: Selecting the Authentication Method for <strong>Open</strong><strong>VPN</strong>........................................................................................................................................24<br />
Image 10: Creating an <strong>Open</strong><strong>VPN</strong> Client Certificate......................................................................................................................................................25<br />
Image 11: Exporting an <strong>Open</strong><strong>VPN</strong> Certificate.............................................................................................................................................................26<br />
Image 12: Revoking a Client Certificate.....................................................................................................................................................................27<br />
Image 13: Enabling <strong>Open</strong><strong>VPN</strong> for a User ...................................................................................................................................................................28<br />
Image 14: User <strong>VPN</strong> Firewall Settings.......................................................................................................................................................................30<br />
Image 15: Adding or Overruling User <strong>VPN</strong> Firewall Policies.........................................................................................................................................30<br />
Image 16: <strong>Open</strong><strong>VPN</strong> XP Shortcut..............................................................................................................................................................................31<br />
Image 17: Extracting the <strong>Open</strong><strong>VPN</strong> Config and Certificate...........................................................................................................................................32<br />
Image 18: <strong>Open</strong><strong>VPN</strong> Client Configuration Folder.........................................................................................................................................................32<br />
Image 19: Creating an <strong>Open</strong><strong>VPN</strong> Shortcut - Step 1....................................................................................................................................................33<br />
Image 20: Creating an <strong>Open</strong><strong>VPN</strong> Shortcut - Step 2....................................................................................................................................................33<br />
Image 21: Disabling Simple File Sharing....................................................................................................................................................................34<br />
Image 22: Log Folder Security Properties..................................................................................................................................................................35<br />
Image 23: Selecting Users and Groups......................................................................................................................................................................35<br />
Image 24: Adding Group Access – Step 1.................................................................................................................................................................36<br />
Image 25: Adding Group Access - Step 2..................................................................................................................................................................36<br />
Image 26: Log Properties - Setting Permissions.........................................................................................................................................................37<br />
Image 27: Managing your Computer in XP.................................................................................................................................................................38<br />
Image 28: Computer Management Console...............................................................................................................................................................39<br />
Image 29: Network Configuration Operators Properties...............................................................................................................................................39<br />
Image 30: Network Configuration Operators Properties...............................................................................................................................................40<br />
Image 31: Adding a User to the Network Configuration Operators Group......................................................................................................................40<br />
Image 32: Network Configuration Operators Properties Screen....................................................................................................................................41<br />
Image 33: Starting <strong>Open</strong><strong>VPN</strong> GUI..............................................................................................................................................................................42<br />
Image 34: <strong>Open</strong><strong>VPN</strong> Connecting...............................................................................................................................................................................42<br />
Image 35: <strong>Open</strong><strong>VPN</strong> User Credentials.......................................................................................................................................................................43<br />
Image 36: Certificate Passphrase.............................................................................................................................................................................43<br />
© 2009 - VASCO Data Security 5
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> Table of Contents<br />
Image 37: Pinging a Machine in the LAN...................................................................................................................................................................44<br />
Image 38: <strong>Open</strong><strong>VPN</strong> Installation - Windows Vista.......................................................................................................................................................45<br />
Image 39: Vista <strong>Open</strong><strong>VPN</strong> Configuration....................................................................................................................................................................46<br />
Image 40: Config Directory of <strong>Open</strong><strong>VPN</strong> in Vista.........................................................................................................................................................47<br />
Image 41: Disabling UAC.........................................................................................................................................................................................47<br />
Image 42: Turning off UAC in Windows Vista.............................................................................................................................................................48<br />
Image 43: Disabling Simple File Sharing in Windows Vista..........................................................................................................................................48<br />
Image 44: Setting the Security Properties of <strong>Open</strong><strong>VPN</strong> log Folder................................................................................................................................49<br />
Image 45: Setting the Security Options for the log Folder – Step 1...............................................................................................................................49<br />
Image 46: Permissions for the log Folder ..................................................................................................................................................................50<br />
Image 47: Advanced Settings for User and Group Selection........................................................................................................................................50<br />
Image 48: Adding the Network Configuration Operators Group – Step 1.......................................................................................................................51<br />
Image 49: Adding the Network Configuration Operators Group - Step 2.......................................................................................................................51<br />
Image 50: <strong>Open</strong><strong>VPN</strong> Log Folder Permissions.............................................................................................................................................................52<br />
Image 51: Managing your Computer in Vista..............................................................................................................................................................52<br />
Image 52: Computer Management Screen Windows Vista..........................................................................................................................................53<br />
Image 53: Network Configuration Operators Group.....................................................................................................................................................53<br />
Image 54: Selecting Users – Step 1..........................................................................................................................................................................54<br />
Image 55: Selecting Users - Step 2...........................................................................................................................................................................54<br />
Image 56: Selecting Users - Step 3...........................................................................................................................................................................55<br />
Image 57: Selecting Users - Step 4...........................................................................................................................................................................55<br />
Image 58: Starting the <strong>Open</strong><strong>VPN</strong> GUI........................................................................................................................................................................56<br />
Image 59: <strong>Open</strong><strong>VPN</strong> Connecting...............................................................................................................................................................................56<br />
Image 60: Entering your <strong>Open</strong><strong>VPN</strong> User Credentials...................................................................................................................................................57<br />
Image 61: Entering the Certificate's Passphrase........................................................................................................................................................57<br />
Image 62: Pinging a Machine in the Secure LAN........................................................................................................................................................58<br />
Image 63: <strong>Open</strong><strong>VPN</strong> GUI Tray Icon............................................................................................................................................................................59<br />
Image 64: Extracting the <strong>Open</strong><strong>VPN</strong> config and Client certificate...................................................................................................................................60<br />
Image 65: <strong>Open</strong><strong>VPN</strong> Client Config Folder...................................................................................................................................................................60<br />
Image 66: Extracting the Config and Certificate Files..................................................................................................................................................61<br />
Image 67: User Accounts and Family Safety..............................................................................................................................................................61<br />
Image 68: Changing UAC Settings............................................................................................................................................................................62<br />
Image 69: <strong>Open</strong><strong>VPN</strong> Log Folder Properties................................................................................................................................................................63<br />
Image 70: Log Folder Properties Security Options......................................................................................................................................................64<br />
Image 71: Adding Group Permissions to the Log Folder..............................................................................................................................................64<br />
Image 72: Adding the Network Operators Group........................................................................................................................................................65<br />
Image 73: Adding Network Configuration Operators...................................................................................................................................................66<br />
Image 74: Setting the Log Folder Permissions...........................................................................................................................................................66<br />
© 2009 - VASCO Data Security 6
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> Table of Contents<br />
Image 75: Accessing Computer Management............................................................................................................................................................67<br />
Image 76: Computer Management...........................................................................................................................................................................67<br />
Image 77: Adding a User to the Network Configuration Operators................................................................................................................................68<br />
Image 78: Adding users to the Network Configuration Operators Group........................................................................................................................68<br />
Image 79: Selecting a user to be added to the Network Configuration Operators Group.................................................................................................69<br />
Image 80: Adding a user to the Network Configuration Operators Group......................................................................................................................69<br />
Image 81: Network Configuration Operators Properties...............................................................................................................................................70<br />
Image 82: Starting <strong>Open</strong><strong>VPN</strong> GUI..............................................................................................................................................................................71<br />
Image 83: Connecting to the <strong>Open</strong><strong>VPN</strong> Server...........................................................................................................................................................72<br />
Image 84: User Name and Password Screen.............................................................................................................................................................73<br />
Image 85: Certificate Password................................................................................................................................................................................73<br />
Image 86: Pinging a Machine in the Secure LAN........................................................................................................................................................74<br />
Image 87: <strong>Open</strong><strong>VPN</strong> Status......................................................................................................................................................................................75<br />
Image 88: <strong>Open</strong><strong>VPN</strong> Logs........................................................................................................................................................................................76<br />
Image 89: Route Addition Fails.................................................................................................................................................................................77<br />
© 2009 - VASCO Data Security 7
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> Table of Contents<br />
Index of Tables<br />
Table 1: <strong>Open</strong><strong>VPN</strong> Server Connection Settings.......................................................................................................................................21<br />
Table 2: <strong>Open</strong><strong>VPN</strong> Encryption and Authentication Settings......................................................................................................................22<br />
Table 3: <strong>Open</strong><strong>VPN</strong> Keepalive Settings....................................................................................................................................................23<br />
Table 4: <strong>VPN</strong> Firewall Configuration......................................................................................................................................................30<br />
© 2009 - VASCO Data Security 8
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> Introduction<br />
1 Introduction<br />
1.1 Audience and Purpose of this document<br />
This <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> guide serves as a reference source for technical<br />
personnel and / or system administrators. We start by explaining the basic concepts of <strong>Open</strong><strong>VPN</strong>. Then we<br />
provide step-by-step instructions to configure the <strong>Open</strong><strong>VPN</strong> server on the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong>, including<br />
how to initialize and setup the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> Certificate Authority (CA). Finally, we show you how to<br />
connect to the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong><strong>VPN</strong> server with a freely available <strong>Open</strong><strong>VPN</strong> client in a Windows<br />
environment.<br />
Caution<br />
The installation and some functionalities of the client software require Windows Administrator<br />
privileges.<br />
In sections 1.2 and 1.3, we introduce the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> and VASCO.<br />
In chapter 2, we introduce the concepts of <strong>Open</strong><strong>VPN</strong>.<br />
In chapter 3, we explain how to setup up your <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong><strong>VPN</strong> server. This includes<br />
initializing the CA, generating and issuing certificates, the configuration of the <strong>Open</strong><strong>VPN</strong> service, <strong>Open</strong><strong>VPN</strong><br />
authentication service settings and finally the user-level settings.<br />
In chapter 4, we explain how to install and configure your <strong>Open</strong><strong>VPN</strong> client in Windows XP.<br />
In chapter 5, we explain how to install and configure your <strong>Open</strong><strong>VPN</strong> client in Windows Vista.<br />
In chapter 6, we explain how to install and configure your <strong>Open</strong><strong>VPN</strong> client in a Windows 7 environment.<br />
In chapter 7, we explain how to access the <strong>Open</strong><strong>VPN</strong> server's status and logs for troubleshooting.<br />
In chapter 8, we offer some solutions to solve potential difficulties.<br />
In section 9, we explain how to request support and how to return hardware for replacement.<br />
© 2009 - VASCO Data Security 9
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> Introduction<br />
Other documents in the set of <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> documentation include:<br />
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> Installation Guide, which explains how to set up the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong>, and is<br />
intended for technical personnel and / or system administrators.<br />
'<strong>How</strong> to guides', which provide detailed information on configuration of each of the features available as<br />
'add-on' modules (explained in the next section). These guides cover specific features such as:<br />
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> Authentication<br />
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> Firewall<br />
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> Single Sign-On<br />
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>VPN</strong><br />
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> Reverse Proxy<br />
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> Directory Services<br />
Access to <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> guides is provided through the permanently on-screen Documentation<br />
button in the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> Administrator <strong>To</strong>ol.<br />
Further resources available include:<br />
Context-sensitive help, which is accessible in the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> Administrator <strong>To</strong>ol through the<br />
Help button. This button is permanently available and displays information related to the current screen.<br />
Training courses covering <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> features in detail. These courses address all levels of<br />
expertise. Please see www.vasco.com for further information.<br />
Welcome to <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> security.<br />
© 2009 - VASCO Data Security 10
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> Introduction<br />
1.2 What is the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong>?<br />
The <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> is an authentication appliance, intended for small and medium sized enterprises.<br />
In addition to strong authentication, the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> has the potential to manage all of your Internet<br />
security needs. Its modular design means that optional features can be purchased at any time to support, for<br />
example, e-mail, Web access and <strong>VPN</strong> management. The <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> can easily be integrated into<br />
existing IT infrastructures as a stand-alone authentication appliance or as a gateway providing both<br />
authentication services and Internet Security.<br />
Authentication and other features such as firewall, e-mail and Web access, are managed by security policies,<br />
which implement a combination of rules, for example, whether a user must use a Digipass One-Time<br />
Password in combination with a static password for authentication. Security Policies are applied to specific<br />
users or groups of users and can also be applied to specific computers and the entire system.<br />
1.3 About VASCO<br />
VASCO is a leading supplier of strong authentication and Electronic Signature solutions and services<br />
specializing in Internet Security applications and transactions. VASCO has positioned itself as a global software<br />
company for Internet Security serving customers in more than 100 countries, including many international<br />
financial institutions. VASCO’s prime markets are the financial sector, enterprise security, e-commerce and egovernment.<br />
Over 50 of VASCO’s client authentication technologies, products and services are based on the VASCO’s one<br />
and unique core authentication platform: VACMAN. VASCO solutions comprise combinations of the VACMAN<br />
core authentication platform, IDENTIKEY authentication server, <strong>aXsGUARD</strong> authentication appliances,<br />
DIGIPASS client Password and Electronic Signature software and DIGIPASS PLUS authentication services. For<br />
further information on these security solutions, please see www.vasco.com.<br />
© 2009 - VASCO Data Security 11
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong> <strong>VPN</strong> General Concept<br />
2 <strong>Open</strong> <strong>VPN</strong> General Concept<br />
2.1 Overview<br />
In this chapter, we introduce <strong>Open</strong><strong>VPN</strong> and its related concepts. <strong>To</strong>pics covered in this chapter include:<br />
2.2 What is <strong>Open</strong><strong>VPN</strong>?<br />
An introduction to and a definition of <strong>Open</strong><strong>VPN</strong><br />
The Encryption used by <strong>Open</strong><strong>VPN</strong><br />
Authentication Methods<br />
Supported Network Protocols<br />
<strong>How</strong> the <strong>Open</strong><strong>VPN</strong> server is detected by the client<br />
<strong>Open</strong><strong>VPN</strong> is an open source virtual private network (<strong>VPN</strong>) program for creating point-to-point or server-tomulticlient<br />
encrypted tunnels between hosts. It is capable of establishing direct links between computers<br />
across networks which use network address translation (NAT) and firewalls.<br />
Image 1: <strong>Open</strong><strong>VPN</strong> Implementation<br />
© 2009 - VASCO Data Security 12
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong> <strong>VPN</strong> General Concept<br />
The <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong><strong>VPN</strong> server allows peers to authenticate via client certificates or via a<br />
combination of client certificates and username/password authentication, such as a DIGIPASS OTP.<br />
When used in a multiclient-server configuration, it allows the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong><strong>VPN</strong> server to<br />
release an authentication certificate for every client, via a Signature and Certificate Authority. It uses the<br />
<strong>Open</strong>SSL encryption library extensively, as well as the SSLv3/TLSv1 protocol.<br />
2.3 Data Encryption<br />
<strong>Open</strong><strong>VPN</strong> uses <strong>Open</strong>SSL to provide encryption for the data and the control channel.<br />
<strong>Open</strong>SSL is an open source implementation of the SSL and TLS protocols. The core library (written in the C<br />
programming language) implements the basic cryptographic functions and provides various utility functions.<br />
Detailed information about the <strong>Open</strong>SSL core library is outside the scope of this manual. For more details and<br />
specifications, consult the online resources: http://www.openssl.org/<br />
2.4 Authentication Methods<br />
As mentioned in section 2.2, <strong>Open</strong><strong>VPN</strong> offers several methods to authenticate peers. The <strong>aXsGUARD</strong><br />
<strong>Gatekeeper</strong> <strong>Open</strong><strong>VPN</strong> server offers the following authentication methods:<br />
Tips<br />
Certificate-based authentication (PKI); the client is authenticated via a client certificate which is<br />
generated on the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong><strong>VPN</strong> server and exported to the <strong>Open</strong><strong>VPN</strong> client.<br />
Certificate-based authentication, but in combination with username/password authentication (e.g.<br />
DIGIPASS OTP, back-end authentication). This requires extra configuration, since the<br />
Authentication Method has to be selected for the <strong>Open</strong><strong>VPN</strong> service, but it provides extra security in<br />
that physical access to the client is not sufficient to connect to the <strong>Open</strong><strong>VPN</strong> server.<br />
For details about supported Authentication Methods and their configuration, see the<br />
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> Authentication <strong>How</strong> <strong>To</strong>, which can be accessed by clicking on the<br />
permanently available Documentation button in the Administrator <strong>To</strong>ol.<br />
For details about PKI and certificates, see the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> IPsec <strong>How</strong> <strong>To</strong>, which can<br />
be accessed by clicking on the permanently available Documentation button in the<br />
Administrator <strong>To</strong>ol.<br />
© 2009 - VASCO Data Security 13
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong> <strong>VPN</strong> General Concept<br />
2.5 Supported Network Protocols<br />
<strong>Open</strong><strong>VPN</strong> can run over UDP or TCP. It multiplexes all communications over a single TCP/UDP port. It has the<br />
ability to work through most proxy servers (including HTTP) and is effective at working through NAT and getting<br />
out through firewalls.<br />
The server configuration has the ability to "push" certain network configuration options to the clients. These<br />
include IP addresses, routing commands and a few other connection options.<br />
Port 1194 is the official IANA assigned port number for <strong>Open</strong><strong>VPN</strong>. Newer versions of the program now default<br />
to that port.<br />
Cautions<br />
On the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong><strong>VPN</strong> server, port 443 and the TCP protocol are the<br />
recommended default for Firewall traversal.<br />
Verify if you have no other services running on TCP port 443, otherwise the <strong>Open</strong><strong>VPN</strong> server<br />
will not be able to receive connections.<br />
The use of common network protocols (TCP and UDP) makes <strong>Open</strong><strong>VPN</strong> a desirable alternative to IPsec in<br />
situations where an ISP blocks specific <strong>VPN</strong> protocols.<br />
2.6 <strong>How</strong> a Client finds the <strong>Open</strong><strong>VPN</strong> Server<br />
The name of the <strong>Open</strong><strong>VPN</strong> server on the Internet can be entered in the <strong>Open</strong><strong>VPN</strong> server configuration or the<br />
<strong>Open</strong><strong>VPN</strong> server certificate, which needs to be imported to the <strong>Open</strong><strong>VPN</strong> server. The configuration can include<br />
either the public IP address or the FQDN of the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong><strong>VPN</strong> server.<br />
When a client certificate is issued for an <strong>Open</strong><strong>VPN</strong> user, two files (the client certificate and the <strong>Open</strong><strong>VPN</strong><br />
configuration file) are compressed in a zip file when exporting the client certificate (see section 3.8). Since<br />
these files are needed on the client software and the <strong>Open</strong><strong>VPN</strong> configuration file includes the public IP address<br />
or the external FQDN of the <strong>Open</strong><strong>VPN</strong> server (either based on the information in the server certificate, as<br />
explained in section 3.4 or the information entered in the <strong>Open</strong><strong>VPN</strong> server configuration, as explained in<br />
section 3.5.2), the client automatically knows where it should connect.<br />
© 2009 - VASCO Data Security 14
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Server Configuration<br />
3 <strong>Open</strong><strong>VPN</strong> Server Configuration<br />
3.1 Overview<br />
In this chapter, we explain how to configure the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong><strong>VPN</strong> server. <strong>To</strong>pics covered in<br />
this chapter include:<br />
3.2 Feature Activation<br />
<strong>How</strong> to activate the <strong>Open</strong><strong>VPN</strong> server<br />
<strong>How</strong> to initialize the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> Certificate Authority (CA)<br />
<strong>How</strong> to create a server certificate<br />
<strong>How</strong> to configure the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong><strong>VPN</strong> server<br />
<strong>How</strong> to create, assign and export client certificates<br />
<strong>How</strong> to configure authentication for the <strong>Open</strong><strong>VPN</strong> service<br />
<strong>How</strong> to configure user-level settings, such as Firewall rights.<br />
Before you can configure and use the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong><strong>VPN</strong> server, you first need to activate the<br />
<strong>Open</strong><strong>VPN</strong> feature:<br />
1. Log on to the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> Administrator <strong>To</strong>ol, as explained in the <strong>aXsGUARD</strong><br />
<strong>Gatekeeper</strong> System Administration <strong>How</strong> <strong>To</strong>, which can be accessed by clicking on the permanently<br />
available Documentation button.<br />
2. Navigate to System > Feature Activation<br />
3. Expand the <strong>VPN</strong> & RAS tree<br />
4. Check Do you use <strong>Open</strong><strong>VPN</strong>?<br />
5. Click on Update<br />
© 2009 - VASCO Data Security 15
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Server Configuration<br />
Image 2: <strong>Open</strong><strong>VPN</strong> Feature Activation<br />
© 2009 - VASCO Data Security 16
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Server Configuration<br />
3.3 Initializing the CA<br />
Before your can generate a server or a client certificate, you first need to initialize the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong><br />
CA. If you already initialized the CA, you may skip to section 3.4, where we explain how to generate a server<br />
certificate.<br />
<strong>To</strong> initialize the CA:<br />
1. Log on to the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> as explained in the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> System<br />
Administration <strong>How</strong> <strong>To</strong>, which can be accessed by clicking on the permanently available<br />
Documentation button in the Administrator <strong>To</strong>ol.<br />
2. Navigate to PKI > CA.<br />
3. Enter the settings as requested on-screen (see the example below).<br />
4. Click on Initialize.<br />
Note<br />
Image 3: CA Initialization<br />
The passphrase used to unitialize the CA is also needed to sign new client certificates.<br />
Please memorize this passphrase carefully.<br />
© 2009 - VASCO Data Security 17
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Server Configuration<br />
3.4 Generating a Server Certificate<br />
This section explains how to generate the necessary <strong>Open</strong><strong>VPN</strong> server certificate. You will need this certificate<br />
to configure the <strong>Open</strong><strong>VPN</strong> server later on (explained in section 3.5). Only a single server certificate is needed<br />
for multiple clients, but you can create as many server certificates as desired. If you already generated a<br />
server certificate, you may skip to section 3.5, where we explain the <strong>Open</strong><strong>VPN</strong> server configuration.<br />
<strong>To</strong> create a new server certificate:<br />
1. Log on to the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> as explained in the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> System<br />
Administration <strong>How</strong> <strong>To</strong>, which can be accessed by clicking on the permanently available<br />
Documentation button in the Administrator <strong>To</strong>ol.<br />
2. Navigate to PKI > Certificates.<br />
3. Click on Issue new certificate. A screen similar to the one shown below appears.<br />
4. Select Server as the Certificate Use from the drop-down list.<br />
5. Enter the external FQDN or the public IP address of the <strong>Open</strong><strong>VPN</strong> server.<br />
6. Specify the duration of the validity of the certificate (the default is 365 days).<br />
7. Enter the passphrase you used to initialize the CA (see section 3.3).<br />
8. Click on Sign.<br />
Note<br />
Image 4: Creating a Server Certificate<br />
If your CA has been correctly initialized (see section 3.3), the first 3 fields should be grayed<br />
out as shown in the image above.<br />
© 2009 - VASCO Data Security 18
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Server Configuration<br />
3.5 Server Settings<br />
This section explains how to set up and configure the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong><strong>VPN</strong> server. <strong>To</strong>pics covered<br />
in this section include:<br />
Enabling the <strong>Open</strong><strong>VPN</strong> server<br />
The <strong>Open</strong><strong>VPN</strong> connection settings<br />
The encryption and authentication settings<br />
The Keepalive settings<br />
3.5.1 Enabling the <strong>Open</strong><strong>VPN</strong> Server<br />
Before your can configure your <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong><strong>VPN</strong> server, you need to enable it first. You need<br />
to enable this option before you can access the <strong>Open</strong><strong>VPN</strong> configuration options explained further.<br />
<strong>To</strong> enable the <strong>Open</strong><strong>VPN</strong> server:<br />
1. Log on to the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> as explained in the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> System<br />
Administration <strong>How</strong> <strong>To</strong>, which can be accessed by clicking on the permanently available<br />
Documentation button in the Administrator <strong>To</strong>ol.<br />
2. Navigate to <strong>VPN</strong> & RAS > <strong>Open</strong><strong>VPN</strong> > General.<br />
3. Check the Enabled box. The other options will appear.<br />
4. Configure the Connection Settings (see section 3.5.2).<br />
Image 5: Enabling the <strong>Open</strong><strong>VPN</strong> Server<br />
© 2009 - VASCO Data Security 19
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Server Configuration<br />
3.5.2 Connection Settings<br />
The connection settings contain the parameters used by the <strong>Open</strong><strong>VPN</strong> server to listen for incoming client<br />
connections. The parameters listed in Table 1 are included in the client configuration file which is generated<br />
when you issue (export) an <strong>Open</strong><strong>VPN</strong> client certificate (see section 3.8). <strong>To</strong> configure the connection settings:<br />
1. Log on to the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> as explained in the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> System<br />
Administration <strong>How</strong> <strong>To</strong>, which can be accessed by clicking on the permanently available<br />
Documentation button in the Administrator <strong>To</strong>ol.<br />
2. Navigate to <strong>VPN</strong> & RAS > <strong>Open</strong><strong>VPN</strong> > General.<br />
3. Verify if the Connection Settings tab is selected (see Image 6).<br />
4. Enter the settings as explained in Table 1.<br />
5. Do not click on Update, since you first have to configure the Encryption and Authentication<br />
settings (see section 3.5.3).<br />
Image 6: <strong>Open</strong><strong>VPN</strong> Connection Settings<br />
© 2009 - VASCO Data Security 20
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Server Configuration<br />
Table 1: <strong>Open</strong><strong>VPN</strong> Server Connection Settings<br />
Parameter Description<br />
Protocol (Mandatory) Select the protocol to use for the <strong>Open</strong><strong>VPN</strong> connection. You can select<br />
TCP or UDP. Use TCP if you wish to traverse proxies. Note that changing<br />
this setting requires you to reconfigure all deployed clients too.<br />
<strong>Open</strong><strong>VPN</strong> runs on port (Mandarory) Enter the port to use for the <strong>Open</strong><strong>VPN</strong> connection. Use 443 (system<br />
default) to traverse proxies. Note that changing this setting will require<br />
you to reconfigure all deployed clients.<br />
Unused private IP range for Tunnels<br />
(Mandatory)<br />
This is the range of IP addresses that is distributed to the clients. Use<br />
the CIDR notation, e.g. 10.255.253.0/24. Make sure the entered<br />
range is not used in your network (unique).<br />
Hostname of the server (Optional) Enter the external FQDN or the external IP address of the <strong>Open</strong><strong>VPN</strong><br />
server, e.g. my.server.net or 60.70.80.90<br />
(Only if you did not specify an FQDN or IP address in the server<br />
certificate, see sections 2.6 and section 3.4)<br />
Set <strong>Open</strong><strong>VPN</strong> connection as default<br />
gateway on the client (Optional)<br />
Allow multiple connections from the<br />
same user (Optional)<br />
3.5.3 Encryption and Authentication Settings<br />
If enabled, this option causes the client to route all its outgoing traffic<br />
over the <strong>VPN</strong>. If you disable this setting, you will need to add specific<br />
routes on the client for all the internal networks you wish to make<br />
available for that client.<br />
If enabled, a same <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> user can establish multiple<br />
connections simultaneously.<br />
This section explains how to select your <strong>Open</strong><strong>VPN</strong> server certificate, configure the encryption strength and<br />
whether or not extra authentication (besides the authentication provided by the certificates) is required. <strong>To</strong><br />
configure the connection settings:<br />
<strong>To</strong> configure the Encryption and Authentication settings of the <strong>Open</strong><strong>VPN</strong> server:<br />
1. Navigate to <strong>VPN</strong> & RAS > <strong>Open</strong><strong>VPN</strong> > General.<br />
2. Select the Encryption/Authentication Settings tab (see).<br />
3. Enter the settings as explained in Table 2.<br />
4. Click on Update. The Keepalive Settings (see section 3.5.4) have default (recommended) values.<br />
© 2009 - VASCO Data Security 21
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Server Configuration<br />
Table 2: <strong>Open</strong><strong>VPN</strong> Encryption and Authentication Settings<br />
Parameter Description<br />
Server Certificate Serial (Mandatory) Select a server certificate (see section 3.4) from the<br />
drop-down list.<br />
Encryption (Mandatory) Select the desired encryption cipher (enryption algorithm)<br />
for the connection. Blowfish and AES are both supported.<br />
AES is highly recommended. The higher the selected<br />
value, the stronger the encryption. Note that changing<br />
this setting will require the reconfiguration of all deployed<br />
clients.<br />
Require Clients to authenticate with <strong>Open</strong><strong>VPN</strong><br />
Authentication Service (Optional)<br />
Note<br />
3.5.4 Keepalive Settings<br />
If enabled, this option forces users to authenticate with a<br />
username and a password, e.g. a DIGIPASS OTP. The<br />
authentication method for <strong>Open</strong><strong>VPN</strong> is configured under<br />
Authentication > Services. (see section 3.6).<br />
Once you click on Update, the stat-openvpn Firewall Policy is automatically added /<br />
configured, so the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> is ready to receive <strong>Open</strong><strong>VPN</strong> connection requests.<br />
The purpose of the Keepalive settings are to check whether an <strong>Open</strong><strong>VPN</strong> client is still connected. They allow to<br />
automatically abort the connection if the <strong>Open</strong><strong>VPN</strong> server detects that the client is no longer responding. This<br />
provides an extra layer of security, since idle sessions are terminated.<br />
The values which are pre-configured are recommended by VASCO. You may change these values at your own<br />
risk, however this is not required to get your <strong>Open</strong><strong>VPN</strong> server up and running.<br />
<strong>To</strong> configure the Keepalive settings:<br />
Image 7: Encryption and Authentication Settings<br />
1. Log on to the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> as explained in the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> System<br />
Administration <strong>How</strong> <strong>To</strong>, which can be accessed by clicking on the permanently available<br />
Documentation button in the Administrator <strong>To</strong>ol.<br />
© 2009 - VASCO Data Security 22
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Server Configuration<br />
2. Navigate to <strong>VPN</strong> & RAS > <strong>Open</strong><strong>VPN</strong> > General.<br />
3. Click on the Keepalive Settings Tab.<br />
4. Modify the settings as explained in Table 3 (optional).<br />
5. Click on Update.<br />
Table 3: <strong>Open</strong><strong>VPN</strong> Keepalive Settings<br />
Parameter Description<br />
DPD delay in seconds This is the number of seconds between keep alive pings.<br />
DPD timeout in seconds If no ping replies are received within this period, the<br />
connection is reset.<br />
3.6 Authentication Settings<br />
This section explains how to configure the Authentication Method to be used for <strong>Open</strong><strong>VPN</strong> users. Detailed<br />
information about Authentication is available in the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> Authentication <strong>How</strong> <strong>To</strong>, which can<br />
be accessed by clicking on the permanently available Documentation button in the Administrator <strong>To</strong>ol.<br />
Cautions<br />
The instructions provided in this section only apply if you enabled the authentication option<br />
on the <strong>Open</strong><strong>VPN</strong> server (see section 3.5.3 and the 3rd setting explained in Table 2).<br />
<strong>To</strong> configure the Authentication Method for <strong>Open</strong><strong>VPN</strong>:<br />
1. Log on to the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> as explained in the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> System<br />
Administration <strong>How</strong> <strong>To</strong>, which can be accessed by clicking on the permanently available<br />
Documentation button in the Administrator <strong>To</strong>ol.<br />
2. Navigate to Authentication > Services.<br />
3. Click on <strong>Open</strong><strong>VPN</strong>.<br />
4. Choose the Authentication Policy by clicking on the Select button, e.g. DIGIPASS if you want users<br />
to authenticate with an OTP.<br />
5. Click on Update.<br />
Image 8: Keepalive Settings<br />
© 2009 - VASCO Data Security 23
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Server Configuration<br />
Image 9: Selecting the Authentication Method for <strong>Open</strong><strong>VPN</strong><br />
© 2009 - VASCO Data Security 24
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Server Configuration<br />
3.7 Generating Client Certificates<br />
This section explains how to generate the necessary <strong>Open</strong><strong>VPN</strong> client certificate. You will need to export this<br />
certificate to configure the <strong>Open</strong><strong>VPN</strong> client later on (see section 3.8).<br />
<strong>To</strong> create a new client certificate:<br />
1. Log on to the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> as explained in the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> System<br />
Administration <strong>How</strong> <strong>To</strong>, which can be accessed by clicking on the permanently available<br />
Documentation button in the Administrator <strong>To</strong>ol.<br />
2. Navigate to PKI > Certificates.<br />
3. Click on Issue new certificate. A screen similar to the one shown below appears.<br />
4. Select Client (Sentinel/L2TP/<strong>Open</strong><strong>VPN</strong>) as the Certificate Use from the drop-down list.<br />
5. Select the user for whom the certificate is intended.<br />
6. Specify the duration of the validity of the certificate (the default is 365 days).<br />
7. Enter the passphrase you used to initialize the CA (see section 3.3).<br />
8. Click on Sign.<br />
Image 10: Creating an <strong>Open</strong><strong>VPN</strong> Client Certificate<br />
© 2009 - VASCO Data Security 25
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Server Configuration<br />
3.8 Exporting Client Certificates<br />
<strong>To</strong> import a client certificate to your <strong>Open</strong><strong>VPN</strong> client software, you must first export the generated client<br />
certificate to a location of your choice (e.g. a USB drive). <strong>To</strong> export a client certificate:<br />
1. Log on to the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> as explained in the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> System<br />
Administration <strong>How</strong> <strong>To</strong>, which can be accessed by clicking on the permanently available<br />
Documentation button in the Administrator <strong>To</strong>ol.<br />
2. Navigate to PKI > Certificates.<br />
3. Click on the Export icon of the desired client certificate.<br />
4. Select the <strong>Open</strong><strong>VPN</strong> Configuration Pack option from the drop-down menu (see image below).<br />
5. Enter a password to protect the certificate. The password needs to be entered twice for verification.<br />
(This is not the same password used to initialize the CA as explained in section 3.3). This password<br />
provides protection while the certificate is transported from one location to another. It is required<br />
when connecting with the <strong>Open</strong><strong>VPN</strong> client (see sections 4.5, 6.5).<br />
6. Click on Export.<br />
7. Save the resulting zip file to a desired location, e.g. a USB drive.<br />
Note<br />
The client certificate and the <strong>Open</strong><strong>VPN</strong> server configuration file (see sections 2.6 and 3.5)<br />
are stored together in a zip file.<br />
Image 11: Exporting an <strong>Open</strong><strong>VPN</strong> Certificate<br />
© 2009 - VASCO Data Security 26
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Server Configuration<br />
3.9 Revoking Certificates<br />
<strong>To</strong> revoke a certificate on the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong>:<br />
1. Follow steps 1 and 2 as explained in section 3.8.<br />
2. Click on Valid in the state column of the certificate you wish to revoke. After this, a screen as<br />
shown below appears.<br />
3. Enter the passphrase you used to initialize the CA (see section 3.3).<br />
4. Select the appropriate reason for which the certificate is being revoked from the drop-down list.<br />
5. Click on Revoke.<br />
Tips<br />
Image 12: Revoking a Client Certificate<br />
You should only revoke a client certificate in case a user is no longer authorized to access the<br />
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong><strong>VPN</strong> server.<br />
You can also disable <strong>Open</strong><strong>VPN</strong> access for a user is his/her user settings. Navigate to<br />
Users&Groups > Users. Select the user from the list and click on the Remote Access tab.<br />
Uncheck the <strong>Open</strong><strong>VPN</strong> RAS option (also see section 3.10.1).<br />
© 2009 - VASCO Data Security 27
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Server Configuration<br />
3.10 User Settings<br />
3.10.1 Granting <strong>Open</strong><strong>VPN</strong> Access<br />
Before an <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> user can connect to the <strong>Open</strong><strong>VPN</strong> server, you need to allow this in his/her<br />
user settings. <strong>To</strong> enable <strong>Open</strong><strong>VPN</strong> access for a user:<br />
1. Log on to the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> as explained in the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> System<br />
Administration <strong>How</strong> <strong>To</strong>, which can be accessed by clicking on the permanently available<br />
Documentation button in the Administrator <strong>To</strong>ol.<br />
2. Navigate to Users&Groups > Users.<br />
3. Click on the user who should have access to <strong>Open</strong><strong>VPN</strong>.<br />
4. Click on the Remote Access tab.<br />
5. Check the <strong>Open</strong><strong>VPN</strong> RAS option.<br />
6. Click on Update.<br />
Image 13: Enabling <strong>Open</strong><strong>VPN</strong> for a User<br />
© 2009 - VASCO Data Security 28
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Server Configuration<br />
3.10.2 <strong>VPN</strong> Firewall Rights<br />
<strong>To</strong> grant access to your internal network to a user who is connected to your <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong><strong>VPN</strong><br />
server, you must configure that user's <strong>VPN</strong> Firewall options in his/her user settings.<br />
System-Wide Firewall Rights:<br />
System-Wide Firewall Rights apply to all users in the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> network. Since connected<br />
<strong>Open</strong><strong>VPN</strong> users are considered a part of the secure zone, it is extremely important to restrict the System-Wide<br />
Firewall Rights as much as possible.<br />
The default <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> System-Wide Firewall Policies (stat-sec and stat-z-fix) provide appropriate<br />
security for <strong>Open</strong><strong>VPN</strong> access. <strong>How</strong>ever, you can overrule these default Policies simply by creating separate<br />
Firewall Policies which deny the default traffic. The created Firewall Policies should then be added to the Group<br />
or User's <strong>VPN</strong> & RAS Firewall settings (see below for the configuration steps).<br />
This solution allows you to:<br />
Maintain any changes you have made to System-Wide Firewall Policies.<br />
<strong>To</strong> implement even stricter Firewall Policies than the system default Policies.<br />
A list and description of <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> Firewall Rules which are active by default is available in the<br />
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> Firewall <strong>How</strong> <strong>To</strong>, which can be accessed by clicking on the permanently available onscreen<br />
Documentation button in the Administrator <strong>To</strong>ol. You can also click on a Firewall Rule / Policy in the<br />
Administrator <strong>To</strong>ol to view its details.<br />
User / Group Firewall Rights:<br />
VASCO highly recommends the use of a strong client-side firewall and to create dedicated Firewall Policies for<br />
<strong>Open</strong><strong>VPN</strong> access on the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong>.<br />
The configuration of Firewall Rules and Policies is fully explained in the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> Firewall <strong>How</strong><br />
<strong>To</strong>, available by clicking the permanently on-screen Documentation button in the Administrator <strong>To</strong>ol.<br />
A predefined Firewall Policy, fwd-access-lan, is available in case administrators choose not to create their own<br />
Firewall Policies. This Policy allows access from the <strong>VPN</strong> to the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong>'s secure LAN.<br />
<strong>How</strong>ever, VASCO strongly recommends to create your own <strong>Open</strong><strong>VPN</strong>Firewall Policies.<br />
<strong>To</strong> adjust a user's <strong>VPN</strong> Firewall settings:<br />
1. Navigate to Users&Groups > Users.<br />
2. Click on the desired user name.<br />
3. Select the Firewall tab and adjust the <strong>VPN</strong> & RAS Policy Mode as explained in Table 4.<br />
4. Click on Update.<br />
© 2009 - VASCO Data Security 29
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Server Configuration<br />
Table 4: <strong>VPN</strong> Firewall Configuration<br />
<strong>VPN</strong> Firewall setting Description<br />
Use Group Firewall Policies Select this option if you wish to apply the same <strong>VPN</strong> Firewall<br />
policies as defined for the user's group.<br />
Add to Group Firewall Policies Use this option to add additional policies to the <strong>VPN</strong> Firewall<br />
Policies defined for the user's group (see Image 15).<br />
Overrule Groups Firewall<br />
Policies<br />
Image 14: User <strong>VPN</strong> Firewall Settings<br />
Use this option to overrule the user's group <strong>VPN</strong> Firewall<br />
policies (see Image 15).<br />
Image 15: Adding or Overruling User <strong>VPN</strong> Firewall Policies<br />
© 2009 - VASCO Data Security 30
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows XP Configuration<br />
4 <strong>Open</strong><strong>VPN</strong> Client Windows XP Configuration<br />
4.1 Overview<br />
4.2 Prerequisites<br />
In this chapter we explain how to install and configure a free <strong>Open</strong><strong>VPN</strong> client in Windows XP.<br />
You need the following to successfully configure your <strong>Open</strong><strong>VPN</strong> client:<br />
A fully configured <strong>Open</strong><strong>VPN</strong> server with the required client certificate (see chapter 3)<br />
The freely available <strong>Open</strong><strong>VPN</strong> client, which can be downloaded from http://openvpn.net<br />
Windows XP with an active Internet connection<br />
Windows XP administrator privileges<br />
4.3 Installing the <strong>Open</strong><strong>VPN</strong> Client<br />
The <strong>Open</strong><strong>VPN</strong> client installs just like any other Windows program. Download and install the <strong>Open</strong><strong>VPN</strong> Windows<br />
executable to the location of your choice and double-click the file to start the installation. Follow the on-screen<br />
instructions. Make sure you have the required access rights in Windows to install software (Administrator<br />
rights). You can also start the installation of the software package by right-clicking on the executable and<br />
selecting “Run as administrator”. You may safely ignore the warning messages about unsigned drivers and<br />
software.<br />
Once the installation is complete, the <strong>Open</strong><strong>VPN</strong> GUI icon will be accessible on your desktop (see below).<br />
Image 16: <strong>Open</strong><strong>VPN</strong> XP Shortcut<br />
© 2009 - VASCO Data Security 31
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows XP Configuration<br />
4.4 Configuring the <strong>Open</strong><strong>VPN</strong> Client<br />
<strong>To</strong> configure the <strong>Open</strong><strong>VPN</strong> client, you will need the zip file which contains your client certificate and the<br />
<strong>Open</strong><strong>VPN</strong> server configuration (see sections 2.6 and 3.8). Make sure you are logged on as an administrator.<br />
1. Save the zip file containing your <strong>Open</strong><strong>VPN</strong> configuration and client certificate to your desktop.<br />
2. Right click on the file and select Extract All as shown in Image 17.<br />
Image 17: Extracting the <strong>Open</strong><strong>VPN</strong> Config<br />
and Certificate<br />
3. Extract the contents of the zip file to the config folder in the <strong>Open</strong><strong>VPN</strong> directory (Program Files ><br />
<strong>Open</strong><strong>VPN</strong> > config as shown below).<br />
Image 18: <strong>Open</strong><strong>VPN</strong> Client Configuration Folder<br />
© 2009 - VASCO Data Security 32
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows XP Configuration<br />
4. Click on Finish when the file extraction is complete and navigate to your Windows desktop.<br />
5. Add a shortcut to the <strong>Open</strong><strong>VPN</strong> GUI on the user's Desktop as shown below. The default <strong>Open</strong><strong>VPN</strong><br />
directory is Program Files > <strong>Open</strong><strong>VPN</strong> > bin.<br />
Image 19: Creating an <strong>Open</strong><strong>VPN</strong> Shortcut - Step 1<br />
6. Copy / paste the new shortcut to the <strong>Open</strong><strong>VPN</strong> user's Desktop directory (Documents and Settings<br />
> username > Desktop) as shown below.<br />
Image 20: Creating an <strong>Open</strong><strong>VPN</strong> Shortcut - Step 2<br />
© 2009 - VASCO Data Security 33
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows XP Configuration<br />
7. Navigate back to your desktop.<br />
Note<br />
The following steps are only required if you are configuring the <strong>Open</strong><strong>VPN</strong> client for a nonadministrator<br />
account.<br />
8. Click Start, and then click My Computer.<br />
9. On the <strong>To</strong>ols menu, click Folder Options.<br />
10. Click on the View tab.<br />
11. Scroll all the way down and clear the Use simple file sharing (Recommended) check box.<br />
12. Click on Apply, then on OK.<br />
Image 21: Disabling Simple File Sharing<br />
13. Navigate to the <strong>Open</strong><strong>VPN</strong> installation log folder. The default location is Program Files > <strong>Open</strong><strong>VPN</strong>.<br />
© 2009 - VASCO Data Security 34
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows XP Configuration<br />
14. Right-click on the log folder and click on Properties.<br />
15. Select the Security Tab and click on Add.<br />
Image 22: Log Folder Security Properties<br />
16. In the Select Users or Groups screen, click on Advanced as shown below.<br />
Image 23: Selecting Users and Groups<br />
© 2009 - VASCO Data Security 35
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows XP Configuration<br />
17. Click on Find Now as shown below.<br />
18. Highlight the Network Configuration Operators group and click on OK.<br />
Image 24: Adding Group Access – Step 1<br />
19. In the next screen (see below), click on OK again.<br />
Image 25: Adding Group Access - Step 2<br />
© 2009 - VASCO Data Security 36
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows XP Configuration<br />
20. Highlight the Network Configuration Operators group as shown below.<br />
21. Set the permissions exactly as shown below.<br />
22. Click on Apply, then on OK.<br />
Image 26: Log Properties - Setting Permissions<br />
© 2009 - VASCO Data Security 37
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows XP Configuration<br />
23. Navigate back to your desktop.<br />
24. Click on Start and navigate to My Computer.<br />
25. Right-click on My Computer and select Manage as shown below.<br />
Image 27: Managing your Computer in XP<br />
© 2009 - VASCO Data Security 38
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows XP Configuration<br />
26. In the Computer Management console, navigate to Local Users and Groups.<br />
27. Expand the Groups folder.<br />
Image 28: Computer Management Console<br />
28. Right-click on Network Configuration Operators and select Properties, as shown below.<br />
Image 29: Network Configuration Operators Properties<br />
© 2009 - VASCO Data Security 39
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows XP Configuration<br />
29. In the Network Configuration Operators Properties screen, click on Add (see below).<br />
Image 30: Network Configuration Operators Properties<br />
30. Enter the name of the user(s) who will be using the <strong>Open</strong><strong>VPN</strong> client and click on Check Names, as<br />
shown below.<br />
31. When finished, click on the OK button.<br />
Image 31: Adding a User to the Network Configuration Operators Group<br />
© 2009 - VASCO Data Security 40
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows XP Configuration<br />
32. In the Network Configuration Operators Properties Screen, the added user(s) will be listed as shown<br />
below. Click on Apply and then OK to finish.<br />
Image 32: Network Configuration Operators Properties<br />
Screen<br />
© 2009 - VASCO Data Security 41
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows XP Configuration<br />
4.5 Starting the <strong>Open</strong><strong>VPN</strong> Connection<br />
Once you have configured your <strong>Open</strong><strong>VPN</strong> client as explained in section 4.4, you can test the connection by<br />
following the instructions below.<br />
1. Log on to Windows XP with the <strong>Open</strong><strong>VPN</strong> user account (not as an administrator).<br />
2. Start the <strong>Open</strong><strong>VPN</strong> GUI as shown below (Either by right-clicking the shortcut and selecting open or<br />
by double-clicking on the shortcut). An inactive <strong>Open</strong><strong>VPN</strong> GUI icon will appear in the task pane.<br />
Image 33: Starting <strong>Open</strong><strong>VPN</strong> GUI<br />
3. In the task pane, right-click on the <strong>Open</strong><strong>VPN</strong> GUI icon and click on Connect.<br />
Image 34: <strong>Open</strong><strong>VPN</strong> Connecting<br />
© 2009 - VASCO Data Security 42
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows XP Configuration<br />
4. Enter the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> user credentials as requested and click on OK.<br />
Image 35: <strong>Open</strong><strong>VPN</strong> User Credentials<br />
5. Enter the passphrase of the client certificate (this is the passphrase used to export the certificate,<br />
as explained in section 3.8) and click on OK.<br />
Image 36: Certificate Passphrase<br />
© 2009 - VASCO Data Security 43
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows XP Configuration<br />
6. After a few seconds, you should receive a notification message indicating that the connection is<br />
successful. Test your connection by pinging a machine in the LAN of the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong><br />
(see below).<br />
Image 37: Pinging a Machine in the LAN<br />
© 2009 - VASCO Data Security 44
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows Vista Configuration<br />
5 <strong>Open</strong><strong>VPN</strong> Client Windows Vista Configuration<br />
5.1 Overview<br />
5.2 Prerequisites<br />
In this chapter we explain how to install and configure a free <strong>Open</strong><strong>VPN</strong> client in Windows Vista.<br />
You need the following to successfully configure your <strong>Open</strong><strong>VPN</strong> client:<br />
A fully configured <strong>Open</strong><strong>VPN</strong> server with the required client certificate (see chapter 3)<br />
The freely available <strong>Open</strong><strong>VPN</strong> client, which can be downloaded from http://openvpn.net<br />
Windows Vista with an active Internet connection<br />
Windows Vista Administrator privileges<br />
5.3 Installing the <strong>Open</strong><strong>VPN</strong> Client<br />
The <strong>Open</strong><strong>VPN</strong> client installs just like any other Windows program. Download and install the <strong>Open</strong><strong>VPN</strong> Windows<br />
executable to the location of your choice and double-click the file to start the installation. Follow the on-screen<br />
instructions. Make sure you have the required access rights in Windows to install software (Administrator<br />
rights). You can also start the installation of the software package by right-clicking on the executable and<br />
selecting “Run as administrator”. You may safely ignore the warning messages about unsigned drivers and<br />
software.<br />
Once the installation is complete, the <strong>Open</strong><strong>VPN</strong> GUI icon will be accessible on your desktop (see image below).<br />
Image 38: <strong>Open</strong><strong>VPN</strong> Installation - Windows Vista<br />
© 2009 - VASCO Data Security 45
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows Vista Configuration<br />
5.4 Configuring the <strong>Open</strong><strong>VPN</strong> Client<br />
<strong>To</strong> configure the <strong>Open</strong><strong>VPN</strong> client, you will need the zip file which contains your client certificate and the<br />
<strong>Open</strong><strong>VPN</strong> server configuration (see sections 2.6 and 3.8).<br />
1. Log on to Windows Vista with full administrative privileges.<br />
2. Save the zip file containing your <strong>Open</strong><strong>VPN</strong> configuration and client certificate to your desktop.<br />
3. Right click on the file and select Extract All as shown below.<br />
Image 39: Vista <strong>Open</strong><strong>VPN</strong> Configuration<br />
© 2009 - VASCO Data Security 46
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows Vista Configuration<br />
4. Extract the contents of the zip file to the config directory of <strong>Open</strong><strong>VPN</strong>. The default installation<br />
directory is Program Files > <strong>Open</strong><strong>VPN</strong> > config.<br />
Note<br />
Image 40: Config Directory of <strong>Open</strong><strong>VPN</strong> in Vista<br />
The following steps are only required if you are configuring the <strong>Open</strong><strong>VPN</strong> client for a<br />
non-administrator account.<br />
5. Navigate to the Vista Control Panel and double-click on User Accounts.<br />
6. Disable UAC by clicking on Turn User Account Control on or off.<br />
Image 41: Disabling UAC<br />
© 2009 - VASCO Data Security 47
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows Vista Configuration<br />
7. Make sure UAC is unchecked, as shown in the image below.<br />
8. Click on OK.<br />
Image 42: Turning off UAC in Windows Vista<br />
9. Navigate back to your Windows desktop and go to the Control Panel.<br />
10. In the Control Panel, click on Folder Options.<br />
11. Click on the View Tab and scroll all the way down.<br />
12. Disable Use Sharing Wizard and click on Apply, followed by OK.<br />
Image 43: Disabling Simple File Sharing in Windows Vista<br />
© 2009 - VASCO Data Security 48
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows Vista Configuration<br />
13. Navigate to the <strong>Open</strong><strong>VPN</strong> log folder.<br />
14. Right-click on the folder and select Properties.<br />
Image 44: Setting the Security Properties of <strong>Open</strong><strong>VPN</strong> log<br />
Folder<br />
15. Select the Security Tab and click on Edit.<br />
Image 45: Setting the Security Options for the log<br />
Folder – Step 1<br />
© 2009 - VASCO Data Security 49
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows Vista Configuration<br />
16. In the Permissions for log screen, click on the Add button.<br />
Image 46: Permissions for the log Folder<br />
17. In the Select Users or Groups screen, click on Advanced.<br />
Image 47: Advanced Settings for User and Group Selection<br />
© 2009 - VASCO Data Security 50
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows Vista Configuration<br />
18. Click on the Find Now button as shown below.<br />
19. Select the Network Configuration Operators Group and click on OK.<br />
Image 48: Adding the Network Configuration Operators Group – Step 1<br />
20. The screen below will appear, showing that the Network Configuration Operator Group has been<br />
selected. Click on OK.<br />
Image 49: Adding the Network Configuration Operators Group - Step 2<br />
© 2009 - VASCO Data Security 51
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows Vista Configuration<br />
21. Make sure the newly added group (Network Configuration Operators) is highlighted as shown<br />
below.<br />
22. Set the permissions exactly as shown below and click on Apply, then on OK.<br />
Image 50: <strong>Open</strong><strong>VPN</strong> Log Folder Permissions<br />
23. Close the remaining Window and navigate back to the Windows Desktop.<br />
24. Click on start and right-click on Computer. Select Manage (see below).<br />
Image 51: Managing your Computer in Vista<br />
© 2009 - VASCO Data Security 52
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows Vista Configuration<br />
25. In the Computer Management Screen, navigate to Groups in the right pane.<br />
26. Right-click on Network Configuration Operators in the left pane and select Properties.<br />
Image 52: Computer Management Screen Windows Vista<br />
27. Add the user who will be using the <strong>Open</strong><strong>VPN</strong> client as a member to the Network Configuration<br />
Operators Group, by clicking on Add.<br />
Image 53: Network Configuration Operators Group<br />
© 2009 - VASCO Data Security 53
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows Vista Configuration<br />
28. In the Select Users screen, click on the Advanced button.<br />
Image 54: Selecting Users – Step 1<br />
29. Click on Find Now and select the user who will be needing access to the <strong>Open</strong><strong>VPN</strong> client program.<br />
30. Click on OK when the user has been selected.<br />
Image 55: Selecting Users - Step 2<br />
© 2009 - VASCO Data Security 54
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows Vista Configuration<br />
31. The added user is diplayed as shown below. Click on OK.<br />
Image 56: Selecting Users - Step 3<br />
32. In the Network Configuration Operators Screen, click on Apply then on OK.<br />
Image 57: Selecting Users - Step 4<br />
© 2009 - VASCO Data Security 55
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows Vista Configuration<br />
5.5 Starting the <strong>Open</strong><strong>VPN</strong> Connection<br />
Once you have configured your <strong>Open</strong><strong>VPN</strong> client as explained in section 5.4, you can start the connection by<br />
following the instructions below.<br />
1. Log on to Windows as the <strong>Open</strong><strong>VPN</strong> user (not as an administrator).<br />
2. Start the <strong>Open</strong><strong>VPN</strong> GUI by clicking on Start > All Programs > <strong>Open</strong><strong>VPN</strong> > Ope<strong>VPN</strong> GUI (see below).<br />
Image 58: Starting the <strong>Open</strong><strong>VPN</strong> GUI<br />
3. Right-click on the <strong>Open</strong><strong>VPN</strong> GUI icon in the system tray and select Connect.<br />
Image 59: <strong>Open</strong><strong>VPN</strong> Connecting<br />
© 2009 - VASCO Data Security 56
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows Vista Configuration<br />
4. Enter the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> user credentials as requested.<br />
Image 60: Entering your <strong>Open</strong><strong>VPN</strong> User Credentials<br />
5. Enter your certificate passphrase. This is the passphrase you used to export the certificate, as<br />
explained in section 3.8.<br />
Image 61: Entering the Certificate's Passphrase<br />
© 2009 - VASCO Data Security 57
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows Vista Configuration<br />
6. After a few seconds, you should receive a notification message indicating that the connection is<br />
successful. You can tes the connection by pinging a machine in the secure network of the<br />
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong><strong>VPN</strong> server (see below).<br />
Image 62: Pinging a Machine in the Secure LAN<br />
© 2009 - VASCO Data Security 58
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows 7 Configuration<br />
6 <strong>Open</strong><strong>VPN</strong> Client Windows 7 Configuration<br />
6.1 Overview<br />
6.2 Prerequisites<br />
In this chapter we explain how to install and configure a free <strong>Open</strong><strong>VPN</strong> client in a Windows 7 environment.<br />
You need the following to successfully configure your <strong>Open</strong><strong>VPN</strong> client:<br />
A fully configured <strong>Open</strong><strong>VPN</strong> server with the required client certificate (see chapter 3)<br />
The freely available <strong>Open</strong><strong>VPN</strong> client, which can be downloaded from http://openvpn.net<br />
Windows 7 with an active Internet connection<br />
Windows 7 Administrator privileges<br />
6.3 Installing the <strong>Open</strong><strong>VPN</strong> Client<br />
The <strong>Open</strong><strong>VPN</strong> client installs just like any other Windows program. Download and install the <strong>Open</strong><strong>VPN</strong> Windows<br />
executable to the location of your choice and double-click the file to start the installation. Follow the on-screen<br />
instructions. Make sure you have the required access rights in Windows to install software (Administrator<br />
rights). You can start the installation of the software package by right-clicking on the executable and selecting<br />
“Run as administrator”. You may safely ignore the software signature and driver signature warning messages.<br />
Once the installation is complete, the <strong>Open</strong><strong>VPN</strong> GUI icon will be accessible by clicking on the arrow in your<br />
system tray as shown below.<br />
Image 63: <strong>Open</strong><strong>VPN</strong> GUI Tray Icon<br />
© 2009 - VASCO Data Security 59
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows 7 Configuration<br />
6.4 Configuring the <strong>Open</strong><strong>VPN</strong> Client<br />
<strong>To</strong> configure the <strong>Open</strong><strong>VPN</strong> client, you will need the zip file which contains your client certificate and the<br />
<strong>Open</strong><strong>VPN</strong> server configuration (see sections 2.6 and 3.8).<br />
1. Save the zip file containing your <strong>Open</strong><strong>VPN</strong> configuration and client certificate to your desktop.<br />
2. Right click on the file and select Extract All as shown in Image 64.<br />
Image 64: Extracting the <strong>Open</strong><strong>VPN</strong> config<br />
and Client certificate<br />
3. Extract the file to the config folder of your <strong>Open</strong><strong>VPN</strong> installation. The default installation folder is<br />
shown in Image 65.<br />
Image 65: <strong>Open</strong><strong>VPN</strong> Client Config Folder<br />
© 2009 - VASCO Data Security 60
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows 7 Configuration<br />
4. Click on Extract.<br />
5. Once the files are extracted, close all unecessary windows and go back to the Windows desktop.<br />
Note<br />
Image 66: Extracting the Config and Certificate Files<br />
The following steps are only required if you are configuring the <strong>Open</strong><strong>VPN</strong> client for a nonadministrator<br />
account.<br />
6. Go to the Control Panel and click on the User Accounts and Family Safety link to disable UAC.<br />
Image 67: User Accounts and Family Safety<br />
© 2009 - VASCO Data Security 61
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows 7 Configuration<br />
7. Click on the User Accounts Link as shown below.<br />
8. Click on Change User Account Control Settings.<br />
Image 68: Changing UAC Settings<br />
© 2009 - VASCO Data Security 62
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows 7 Configuration<br />
9. Slide the slider bar to the lowest value (towards Never Notify), with the description showing Never<br />
notify me (see below).<br />
10. Reboot your Windows system to make the changes effective (mandatory).<br />
11. Log in as system administrator and navigate to the <strong>Open</strong><strong>VPN</strong> log folder<br />
(Program Files > <strong>Open</strong><strong>VPN</strong> > log).<br />
12. Right-click the log folder and select Properties.<br />
Image 69: <strong>Open</strong><strong>VPN</strong> Log Folder Properties<br />
© 2009 - VASCO Data Security 63
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows 7 Configuration<br />
13. Click on the Security Tab and then on Edit.<br />
14. Click on Add as shown below.<br />
Image 70: Log Folder Properties Security Options<br />
Image 71: Adding Group Permissions to the Log<br />
Folder<br />
© 2009 - VASCO Data Security 64
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows 7 Configuration<br />
15. In the Select Users or Groups screen, click on Advanced.<br />
16. Click on Find Now and select the Network Configuration Operators Group, then click on OK.<br />
Image 72: Adding the Network Operators Group<br />
© 2009 - VASCO Data Security 65
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows 7 Configuration<br />
17. Click on OK again.<br />
Image 73: Adding Network Configuration Operators<br />
18. Highlight the Network Configuration Operators Group and make sure the permissions are set as<br />
shown below. Click on OK when finished and navigate back to your Windows desktop.<br />
Image 74: Setting the Log Folder Permissions<br />
© 2009 - VASCO Data Security 66
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows 7 Configuration<br />
19. Click on Start and right-click on Computer.<br />
20. Select Manage.<br />
Image 75: Accessing Computer Management<br />
21. In the left pane, click on Local Users and Groups and select Groups.<br />
22. In the right pane, right-click on the Network Configuration Operators and select Properties.<br />
Image 76: Computer Management<br />
© 2009 - VASCO Data Security 67
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows 7 Configuration<br />
23. In the Network Configuration Operators Properties screen, click on Add.<br />
Image 77: Adding a User to the Network Configuration Operators<br />
24. In the Select Users screen, click on Advanced.<br />
Image 78: Adding users to the Network Configuration Operators Group<br />
© 2009 - VASCO Data Security 68
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows 7 Configuration<br />
25. Click on Find Now. Highlight the user who will be using the <strong>Open</strong><strong>VPN</strong> client. Click on OK to finish.<br />
Image 79: Selecting a user to be added to the Network Configuration<br />
Operators Group<br />
26. In the Select Users screen, the added user will be displayed. Click on OK again to add the user to<br />
the Network Configuration Operators Group.<br />
Image 80: Adding a user to the Network Configuration Operators Group<br />
© 2009 - VASCO Data Security 69
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows 7 Configuration<br />
27. In the Network Configuration Operators Properties window, click on OK.<br />
Image 81: Network Configuration Operators Properties<br />
© 2009 - VASCO Data Security 70
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows 7 Configuration<br />
6.5 Starting the <strong>Open</strong><strong>VPN</strong> Connection<br />
Once you have configured your <strong>Open</strong><strong>VPN</strong> client as explained in section 6.4, you can start the connection by<br />
following the instructions below.<br />
1. Log on to Windows 7 as the user who will be using the <strong>Open</strong><strong>VPN</strong> client (not as administrator).<br />
2. Click on the Start Button > All Programs > Ope<strong>VPN</strong> > <strong>Open</strong><strong>VPN</strong> GUI.<br />
Image 82: Starting <strong>Open</strong><strong>VPN</strong> GUI<br />
© 2009 - VASCO Data Security 71
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows 7 Configuration<br />
3. Click on the arrow in the system tray and right-click on the <strong>Open</strong><strong>VPN</strong> icon (see below).<br />
4. Click on Connect as shown below.<br />
Image 83: Connecting to the <strong>Open</strong><strong>VPN</strong> Server<br />
© 2009 - VASCO Data Security 72
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows 7 Configuration<br />
5. Enter the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> user name and password of the connecting use. If you configured<br />
the <strong>Open</strong><strong>VPN</strong> service with DIGIPASS authentication (see sections 3.5.3 and 3.6), enter the OTP<br />
generated by the DIGIPASS in the password field.<br />
6. Click on OK or press Enter. You will be prompted to enter the password of the client certificate.<br />
7. Enter the password of the client certificate (see section 3.8).<br />
8. Click on OK or press Enter.<br />
Image 84: User Name and Password Screen<br />
Image 85: Certificate Password<br />
After a few seconds, you should receive a notification message indicating that the connection is successful.<br />
© 2009 - VASCO Data Security 73
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> <strong>Open</strong><strong>VPN</strong> Client Windows 7 Configuration<br />
9. Once the connection is up, you can test it by pinging a machine in the secure LAN of your<br />
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>VPN</strong> server (see below).<br />
Image 86: Pinging a Machine in the Secure LAN<br />
© 2009 - VASCO Data Security 74
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> Status and Logs<br />
7 Status and Logs<br />
7.1 Overview<br />
In this chapter, we explain how to check the status of connected users and the <strong>Open</strong><strong>VPN</strong> logs.<br />
7.2 <strong>Open</strong><strong>VPN</strong> Status<br />
<strong>To</strong> check the status of a connected <strong>Open</strong><strong>VPN</strong> user:<br />
7.3 <strong>Open</strong><strong>VPN</strong> Logs<br />
1. Log on to the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> as explained in the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> System<br />
Administration <strong>How</strong> <strong>To</strong>, which can be accessed by clicking on the permanently available<br />
Documentation button in the Administrator <strong>To</strong>ol.<br />
2. Navigate to <strong>VPN</strong>&RAS > Status > <strong>Open</strong><strong>VPN</strong>.<br />
Image 87: <strong>Open</strong><strong>VPN</strong> Status<br />
<strong>To</strong> check the logs of the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong><strong>VPN</strong> server:<br />
1. Log on to the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> as explained in the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> System<br />
Administration <strong>How</strong> <strong>To</strong>, which can be accessed by clicking on the permanently available<br />
Documentation button in the Administrator <strong>To</strong>ol.<br />
2. Navigate to <strong>VPN</strong>&RAS > Logs > <strong>Open</strong><strong>VPN</strong>.<br />
3. Click on the desired log date (see Image 88).<br />
© 2009 - VASCO Data Security 75
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> Status and Logs<br />
Image 88: <strong>Open</strong><strong>VPN</strong> Logs<br />
© 2009 - VASCO Data Security 76
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> Troubleshooting<br />
8 Troubleshooting<br />
The connection to the <strong>Open</strong><strong>VPN</strong> server is successful, but I cannot connect to the corporate LAN<br />
Windows XP, Vista and Windows 7 require administrator privileges to execute some functions, such as adding<br />
network routes. Make sure that the Windows user who will be using the <strong>Open</strong><strong>VPN</strong> client is added to the<br />
Network Configuration Operators group.<br />
The <strong>Open</strong><strong>VPN</strong> client indicates that the route addition failed using CreateIpForwardEntry.<br />
See above. Add the connecting Windows user to the Network Configuration Operators group.<br />
Image 89: Route Addition Fails<br />
The <strong>Open</strong><strong>VPN</strong> client indicates that the user cannot write to the log folder<br />
Make sure the Windows user has the necessary permissions (Read / Write and Modify) for the folder.<br />
© 2009 - VASCO Data Security 77
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> Troubleshooting<br />
I would like to authenticate without providing a certificate password.<br />
Caution<br />
This is possible, but not advised by VASCO. The certificate passphrase (see section 3.8)<br />
protects your certificate when it's copied from one location to another. It also prevents abuse<br />
in case it is intercepted or stolen by a third party and provides authentication if no other<br />
authentication method has been selected for the <strong>Open</strong><strong>VPN</strong> service.<br />
This operation requires you to use the command line. Note that the openssl binary, which is needed to remove<br />
the certificate password, is NOT included with the <strong>Open</strong><strong>VPN</strong> client, so this method only works on a Linux<br />
machine or on a Windows machine with the cygnus or openssl package installed.<br />
If a user insists on removing the password of the pkcs12 client certificate, you can retrieve it with the following<br />
command:<br />
openssl pkcs12 -in -nodes -out file.pem<br />
Put this file in C:\Program Files\<strong>Open</strong><strong>VPN</strong>\config Then modify the ovpn config file as follows:<br />
Remove:<br />
pkcs12 <br />
And add:<br />
ca file.pem<br />
cert file.pem<br />
key file.pem<br />
© 2009 - VASCO Data Security 78
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> Troubleshooting<br />
The <strong>Open</strong><strong>VPN</strong> server does not start / does not function<br />
On the <strong>aXsGUARD</strong> <strong>Gatekeeper</strong>, <strong>Open</strong><strong>VPN</strong> uses port 443 by default (see section 2.5). Make sure you have no<br />
other <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> services listening to this port. Such services include:<br />
Note<br />
The SSL <strong>VPN</strong> server<br />
The Webmail server<br />
The Reverse Proxy server<br />
Contact VASCO Support if you need to change your Webmail service port.<br />
© 2009 - VASCO Data Security 79
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> Support<br />
9 Support<br />
9.1 Overview<br />
In this section we provide instructions on what to do if you have a problem, or experience a hardware failure.<br />
9.2 If you encounter a problem<br />
If you encounter a problem with a VASCO product, please follow the steps below:<br />
1. Check whether your problem has already been solved and reported in section 8 or in the Knowledge<br />
Base at the following URL: http://www.vasco.com/support.<br />
2. If there is no solution in the Knowledge Base, please contact the company which supplied you with the<br />
VASCO product.<br />
3. If your supplier is unable to solve your problem, they will automatically contact the appropriate VASCO<br />
expert. If necessary, VASCO experts can access your <strong>aXsGUARD</strong> <strong>Gatekeeper</strong> remotely to solve any<br />
problems.<br />
9.3 Return procedure if you have a hardware failure<br />
If you experience a hardware failure, please contact your VASCO supplier.<br />
© 2009 - VASCO Data Security 80
<strong>aXsGUARD</strong> <strong>Gatekeeper</strong> <strong>Open</strong> <strong>VPN</strong> <strong>How</strong> <strong>To</strong> <strong>v1.4</strong> Support<br />
Alphabetical Index<br />
Accessing Documents........................................................................10<br />
Authentication..............................................................................10, 23<br />
authentication methods.......................................................................13<br />
CA....................................................................................................17<br />
Certificate.........................................................................18, 21, 25pp.<br />
Certificate Authority............................................................................13<br />
client certificate..................................................................................17<br />
DIGIPASS...........................................................................................13<br />
Directory Services..............................................................................10<br />
Documents........................................................................................10<br />
Encryption.........................................................................................21<br />
Firewall.....................................................................................10, 29p.<br />
FQDN................................................................................................14<br />
Keepalive...........................................................................................22<br />
NAT............................................................................................12, 14<br />
<strong>Open</strong>SSL...........................................................................................13<br />
<strong>Open</strong><strong>VPN</strong>......................................................................................12pp.<br />
OTP..................................................................................................13<br />
PKI....................................................................................................13<br />
Return Procedure...............................................................................80<br />
Reverse Proxy....................................................................................10<br />
Single Sign-On...................................................................................10<br />
SSL...................................................................................................13<br />
Support.............................................................................................80<br />
TCP...................................................................................................14<br />
TLS...................................................................................................13<br />
Training Courses................................................................................10<br />
UDP..................................................................................................14<br />
<strong>VPN</strong>............................................................................................10, 30<br />
© 2009 - VASCO Data Security 81