User manual ZYXEL THEGREENBOW VPN-CLIENT

[. . . ] Our offer is specially designed to target OEM clients and System Integrators. We provide a fully functional VPN Client solution to complete existing offers. Our IPSec VPN Client can be re-branded and source code license is available on demand. The VPN IPSec Client completes our range of network security products and like all our products is easy to use and to install. [. . . ] Click on "Open Tunnel" for establishing the IPSec VPN tunnel (only in "IPSec Configuration" window) 4. 3. 2 Several Authentication or IPSec Configuration Phases Several Authentication Phases can be configured. Therefore, one computer can establish IPSec VPN connections with several gateways or other computers (peer to peer). Similarly, several IPSec Configuration (phase 2) can be created for a same Authentication Phase (Phase 1). 4. 3. 3 Active or Non Active phase A phase can be either "active" or "non active". If a phase is "non active", its settings will not be applied. This feature can be used with a configuration composed of several VPN tunnels that do not need to be enabled simultaneously. Changing "active" to "non activate" state for a specific Phase can be achieved by a right-click on the phase name: Active (or Non active) All active Active Only Enable or disable the phase Enable all phases Disable every phase except the phase selected with the mouse. 4. 4 Authentication or Phase 1 'Authentication' window will concern settings for Authentication Phase or Phase 1. It is also called IKE Negotiation Phase. IPSec VPN Client User Manual Property of Sistech SA - © Sistech 2004 11/11 Doc. Ref Doc. version VPN version TgbVpn25x_en 1. 2 ­ Nov. 2004 2. 50 4. 4. 1 Settings description Name Label for Authentication phase used only the configuration user interface. It is possible to change this name at any time and read it in the tree control. IP address of the network interface of the computer, through which VPN connection is established. If the IP address may change (when it is received dynamically by an ISP), select "*". IP address or DNS address of the remote gateway (in our example: gateway. mydomain. com). X509 certificate used by the VPN client (see certificate configuration). Encryption algorithm used during Authentication phase (3DES, AES, . . . ). Authentication algorithm used during Authentication phase (MD5, SHA, . . . ). Diffie-Hellman key length. Interface Remote Gateway Pre-shared key Certificate IKE encryption IKE authentication IKE key group Once the parameters are set, click on "Save & Apply" to save and to take into account the new configuration. 4. 4. 2 Advanced configuration ("Advanced" Button) 4. 4. 3 Settings description Aggressive Mode Nat port Local ID If checked, the VPN client will used aggressive mode as negociation mode with the remote gateway Negociation port for IKE. Local ID is the identity the VPN client is sending during Phase 1 to VPN gateway. ? IPSec VPN Client User Manual an IP address (type = IP address), for example: 195. 100. 205. 101 an domaine name (type = DNS), e. g. support@thegreenbow. com Property of Sistech SA - © Sistech 2004 12/12 Doc. Ref Doc. version VPN version TgbVpn25x_en 1. 2 ­ Nov. 2004 2. 50 Remote ID a string (type = KEY ID), e. g. 123456 a certificate issuer (type=DER ASN1 DN) (see Certificates configuration) If this identity is not set, VPN client's IP address is used. Remote ID is the identity the VPN client is expecting to receive during Phase 1 from the VPN gateway. This identity can be: an IP address (type = IP address), for example: 80. 2. 3. 4 an domaine name (type = DNS), e. g. 123456 a certificate issuer (type=DER ASN1 DN) (see Certificates configuration) If this identity is not set, VPN gateway's IP address is used. [. . . ] To close a tunnel, select one tunnel in the tunnel list and click on "Close tunnel". 5. 3 Configuration tools Several configuration tools are available on our web site : www. thegreenbow. com/vpn_tool. html. Those tools are meant to be used by IT managers to change the IPSec VPN Client behaviour to their need. IPSec VPN Client User Manual Property of Sistech SA - © Sistech 2004 17/17 Doc. Ref Doc. version VPN version TgbVpn25x_en 1. 2 ­ Nov. 2004 2. 50 5. 3. 1 Stopping IPSec VPN Client: option "/stop" TheGreenBow VPN Client can be stopped at any time by the command line: " [path]\vpnconf. exe /stop " where [path] is the client installation directory. This feature can be used, for example, in a script that launch the VPN Client after establishing a dialup connection and exit it just before the disconnection. 5. 3. 2 IPSec VPN Client Startup mode: VPNSTART VpnStart. exe is a configuration tool that sets up the client startup mode. TheGreenBow VPN Client can start with 3 different modes: During PC boot: this mode can be used for secure remote action At Windows login ("login" mode) Launched by user or from a script ("manual" mode) The latest version of this tool is available on our website: www. thegreenbow. com/vpn_tool. html 5. 3. 3 Hiding IPSec VPN Client configuration user interface: VPNHIDE VpnHide. exe is a configuration tool that hides TheGreenBow Client VPN interface. [. . . ]