Cisco OL-5490-01 User manual

Corporate Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
VPN Client User Guide for Mac OS X
Release 4.6
August 2004
Customer Order Number:
Text Part Number: OL-5490-01

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL
STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT
WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT
SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE
OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public
domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH
ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT
LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF
DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,
WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO
OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
VPN Client User Guide for Mac OS X
Copyright © 2004, Cisco Systems, Inc.
All rights reserved.
CCIP, CCSP, the Cisco Arrow logo, the Cisco Powered Network mark, Cisco Unity, Follow Me Browsing, FormShare, and StackWise are trademarks of Cisco Systems, Inc.;
Changing the Way We Work, Live, Play, and Learn, and iQuick Study are service marks of Cisco Systems, Inc.; and Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE, CCNA,
CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, the Cisco IOS logo, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo,
Empowering the Internet Generation, Enterprise/Solver, EtherChannel, EtherSwitch, Fast Step, GigaStack, Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, iQ Net
Readiness Scorecard, LightStream, MGX, MICA, the Networkers logo, Networking Academy, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, RateMUX, Registrar,
ScriptShare, SlideCast, SMARTnet, StrataView Plus, Stratm, SwitchProbe, TeleRouter, The Fastest Way to Increase Your Internet Quotient, TransPath, and VCO are registered
trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and certain other countries.
All other trademarks mentioned in this document or Web site are the property of their respective owners. The use of the word partner does not imply a partnership relationship
between Cisco and any other company. (0304R)

iii
VPN Client User Guide for Mac OS X
OL-5490-01
CONTENTS
About This Guide vii
Audience vii
Contents vii
Related Documentation viii
Terminology viii
Document Conventions viii
Data Formats ix
Obtaining Documentation ix
Cisco.com ix
Documentation CD-ROM ix
Ordering Documentation x
Documentation Feedback x
Obtaining Technical Assistance x
Cisco.com x
Technical Assistance Center xi
Cisco TAC Website xi
Cisco TAC Escalation Center xii
Obtaining Additional Publications and Information xii
CHAPTER 1Understanding the VPN Client 1-1
Connection Technologies 1-1
VPN Client Overview 1-2
VPN Client Features 1-3
Program Features 1-3
Authentication Features 1-5
IPSec Features 1-5
VPN Client IPSec Attributes 1-6
CHAPTER 2Installing the VPN Client 2-1
Verifying System Requirements 2-1
Gathering Information You Need 2-1
Obtaining the VPN Client Software 2-2
Preconfiguring the VPN Client 2-2

Contents
iv
VPN Client User Guide for Mac OS X
OL-5490-01
Preconfiguring the User Profile 2-3
Preconfiguring the Global Profile 2-3
Bundling a Root Certificate with the Installation Package for Darwin 2-4
Installing the VPN Client 2-4
Authentication 2-4
VPN Client Installation Process 2-6
Introduction 2-6
Accepting the License Agreement 2-7
Selecting the Application Destination 2-7
Choosing the Installation Type 2-8
CLI Version Install Script Notes 2-12
Uninstalling the VPN Client 2-12
CHAPTER 3Navigating the User Interface 3-1
VPN Client Menu 3-1
Choosing a Run Mode 3-2
Operating in Simple Mode 3-2
VPN Client Window—Simple Mode 3-2
Main Menus—Simple Mode 3-3
Connection Entries Menu 3-3
Status Menu 3-3
Operating in Advanced Mode 3-4
VPN Client Window—Advanced Mode 3-4
Toolbar Action Buttons—Advanced Mode 3-5
Main Tabs—Advanced Mode 3-5
Main Menus—Advanced Mode 3-6
Connection Entries Menu 3-6
Status Menu 3-7
Certificates Menu 3-7
Log Menu 3-8
Right-Click Menus 3-8
Connection Entries Tab Right-Click Menu 3-9
Certificates Tab Right-Click Menu 3-10
CHAPTER 4Configuring Connection Entries 4-1
Creating a Connection Entry 4-1
Authentication Methods 4-3
Group Authentication 4-3

Contents
v
VPN Client User Guide for Mac OS X
OL-5490-01
Mutual Group Authentication 4-4
Certificate Authentication 4-4
Transport Parameters 4-6
Enable Transport Tunneling 4-7
Transparent Tunneling Mode 4-7
Allow Local LAN Access 4-7
Peer Response Timeout 4-8
Backup Servers 4-8
CHAPTER 5Establishing a VPN Connection 5-1
Checking Prerequisites 5-1
Establishing a Connection 5-1
Connecting to a Default Connection Entry 5-3
Choosing Authentication Methods 5-3
Shared Key Authentication 5-3
VPN Group Name and Password Authentication 5-4
RADIUS Server Authentication 5-4
SecurID Authentication 5-5
Using Digital Certificates 5-6
CHAPTER 6Enrolling and Managing Certificates 6-1
Using the Certificate Store 6-1
Enrolling Certificates 6-2
Managing Enrollment Requests 6-5
Viewing the Enrollment Request 6-5
Deleting an Enrollment Request 6-5
Changing the Password on an Enrollment Request 6-6
Retrying an Enrollment Request 6-6
Importing a Certificate 6-7
Viewing a Certificate 6-7
Exporting a Certificate 6-9
Deleting a Certificate 6-10
Verifying a Certificate 6-11
Changing the Password on a Personal Certificate 6-12

Contents
vi
VPN Client User Guide for Mac OS X
OL-5490-01
CHAPTER 7Managing the VPN Client 7-1
Managing Connection Entries 7-1
Importing a Connection Entry 7-1
Modifying a Connection Entry 7-2
Deleting a Connection Entry 7-3
Event Logging 7-4
Enable Logging 7-4
Clear Logging 7-5
Set Logging Options 7-5
Opening the Log Window 7-7
Viewing Statistics 7-8
Tunnel Details 7-9
Route Details 7-10
Notifications 7-11
I NDEX

vii
VPN Client User Guide for Mac OS X
OL-5490-01
About This Guide
This VPN Client User Guide describes how to install, use, and manage the Cisco VPN Client for the
Macintosh operating system, Version 10.2 or later. You can manage the VPN Client for Mac OS X from
the graphical user interface or from the command-line interface.
The VPN Client for Mac OS X installer program installs both the graphical user interface and the
command-line version of the VPN Client.
Audience
This guide is for remote clients who want to set up virtual private network (VPN) connections to a central
site. Network administrators can also use this guide for information about configuring and managing
VPN connections for remote clients. You should be familiar with the Macintosh platform and know how
to use Macintosh applications. Network administrators should be familiar with Macintosh system
configuration and management and know how to install, configure, and manage internetworking
systems.
Contents
This guide contains the following chapters:
•Chapter 1, “Understanding the VPN Client.” This chapter describes how the VPN Client software
works and lists the main features.
•Chapter 2, “Installing the VPN Client.” This chapter describes how to install the VPN Client
software application.
•Chapter 3, “Navigating the User Interface.” This chapter describes the main VPN Client window
and the tools, tabs, menus and icons for navigating the user interface.
•Chapter 4, “Configuring Connection Entries.” This chapter describes how to configure VPN Client
connection entries, including optional parameters.
•Chapter 5, “Establishing a VPN Connection.” This chapter describes how to connect to a private
network using the VPN Client, an Internet connection, and the user authentication methods
supported by the VPN Client.
•Chapter 6, “Enrolling and Managing Certificates.” This chapter describes how to obtain digital
certificates to use for authentication and how to manage these certificates in the VPN Client
certificate store.

viii
VPN Client User Guide for Mac OS X
OL-5490-01
About This Guide
Related Documentation
•Chapter 7, “Managing the VPN Client.” This chapter describes how to manage VPN Client
connections, use the event log, and view tunnel details, including packet and routing data.
Related Documentation
The following is a list of user guides and other documentation related to the VPN Client for Mac OS X
and the VPN devices that provide the connection to the private network.
•Release Notes for the Cisco VPN Client, Release 4.6
•Cisco VPN Client Administrator Guide, Release 4.6
•Cisco VPN 3000 Series Concentrator Getting Started Guide, Release 4.6
•Cisco VPN 3000 Series Concentrator Reference Volume I: Configuration, Release 4.1
•Cisco VPN 3000 Series Concentrator Reference Volume II: Administration and Monitoring, Release
4.1
Terminology
In this user guide:
•The term Cisco VPN device refers to the following Cisco products:
– Cisco IOS devices that support Easy VPN server functionality
– Cisco VPN 3000 Series Concentrators
– Cisco PIX Firewall Series
•The term “PC” refers generically to any personal computer.
•The term click means click the left button on a normally-configured multi-button mouse. The term
right-click means click the right button on a normally-configured multi-button mouse. If your mouse
has only one button, use Ctrl-Click to access the right-click menus.
Document Conventions
This guide uses the following typographic conventions:
•Boldface font—Describes user actions and commands.
•Italic font—Describes arguments that you supply the values for.
•Screen font—Describes terminal sessions and information displayed by the system.
•Boldface screen font—Describes information that you must enter.
Notes use the following conventions:
Note Means reader take note. Notes contain helpful suggestions or references to material not covered in the
publication.
Cautions use the following conventions:

ix
VPN Client User Guide for Mac OS X
OL-5490-01
About This Guide
Obtaining Documentation
Caution Means reader be careful. Cautions alert you to actions or conditions that could result in equipment
damage or loss of data.
Data Formats
When you configure the VPN Client, enter data in these formats unless the instructions indicate
otherwise.
•IP Address—Use standard 4-byte dotted decimal notation (for example, 192.168.12.34). You can
omit leading zeros in a byte position.
•Hostnames—Use legitimate network host or end-system name notation (for example, VPN01).
Spaces are not allowed. A hostname must uniquely identify a specific system on a network. A
hostname can be up to 255 characters in length.
•User names and Passwords—Text strings for user names and passwords use alphanumeric characters
in both upper- and lower-case. Most text strings are case sensitive. For example, simon and Simon
would represent two different user names. The maximum length of user names and passwords is
generally 32 characters, unless specified otherwise.
Obtaining Documentation
Cisco provides several ways to obtain documentation, technical assistance, and other technical
resources. These sections explain how to obtain technical information from Cisco Systems.
Cisco.com
You can access the most current Cisco documentation on the World Wide Web at this URL:
http://www.cisco.com/univercd/home/home.htm
You can access the Cisco website at this URL:
http://www.cisco.com
International Cisco web sites can be accessed from this URL:
http://www.cisco.com/public/countries_languages.shtml
Documentation CD-ROM
Cisco documentation and additional literature are available in a Cisco Documentation CD-ROM
package, which may have shipped with your product. The Documentation CD-ROM is updated monthly
and may be more current than printed documentation. The CD-ROM package is available as a single unit
or through an annual subscription.
Registered Cisco.com users can order the Documentation CD-ROM (product number
DOC-CONDOCCD=) through the online Subscription Store:
http://www.cisco.com/go/subscription

x
VPN Client User Guide for Mac OS X
OL-5490-01
About This Guide
Obtaining Technical Assistance
Ordering Documentation
You can find instructions for ordering documentation at this URL:
http://www.cisco.com/univercd/cc/td/doc/es_inpck/pdi.htm
You can order Cisco documentation in these ways:
•Registered Cisco.com users (Cisco direct customers) can order Cisco product documentation from
the Networking Products MarketPlace:
http://www.cisco.com/en/US/partner/ordering/index.shtml
•Registered Cisco.com users can order the Documentation CD-ROM (Customer Order Number
DOC-CONDOCCD=) through the online Subscription Store:
http://www.cisco.com/go/subscription
•Nonregistered Cisco.com users can order documentation through a local account representative by
calling Cisco Systems Corporate Headquarters (California, U.S.A.) at 408 526-7208 or, elsewhere
in North America, by calling 800 553-NETS (6387).
Documentation Feedback
You can submit comments electronically on Cisco.com. On the Cisco Documentation home page, click
Feedback at the top of the page.
You can e-mail your comments to b[email protected].
You can submit your comments by mail by using the response card behind the front cover of your
document or by writing to the following address:
Cisco Systems
Attn: Customer Document Ordering
170 West Tasman Drive
San Jose, CA 95134-9883
We appreciate your comments.
Obtaining Technical Assistance
Cisco provides Cisco.com, which includes the Cisco Technical Assistance Center (TAC) Website, as a
starting point for all technical assistance. Customers and partners can obtain online documentation,
troubleshooting tips, and sample configurations from the Cisco TAC website. Cisco.com registered users
have complete access to the technical support resources on the Cisco TAC website, including TAC tools
and utilities.
Cisco.com
Cisco.com offers a suite of interactive, networked services that let you access Cisco information,
networking solutions, services, programs, and resources at any time, from anywhere in the world.
Cisco.com provides a broad range of features and services to help you with these tasks:
•Streamline business processes and improve productivity
•Resolve technical issues with online support

xi
VPN Client User Guide for Mac OS X
OL-5490-01
About This Guide
Obtaining Technical Assistance
•Download and test software packages
•Order Cisco learning materials and merchandise
•Register for online skill assessment, training, and certification programs
To obtain customized information and service, you can self-register on Cisco.com at this URL:
http://www.cisco.com
Technical Assistance Center
The Cisco TAC is available to all customers who need technical assistance with a Cisco product,
technology, or solution. Two levels of support are available: the Cisco TAC website and the Cisco TAC
Escalation Center. The avenue of support that you choose depends on the priority of the problem and the
conditions stated in service contracts, when applicable.
We categorize Cisco TAC inquiries according to urgency:
•Priority level 4 (P4)—You need information or assistance concerning Cisco product capabilities,
product installation, or basic product configuration.
•Priority level 3 (P3)—Your network performance is degraded. Network functionality is noticeably
impaired, but most business operations continue.
•Priority level 2 (P2)—Your production network is severely degraded, affecting significant aspects
of business operations. No workaround is available.
•Priority level 1 (P1)—Your production network is down, and a critical impact to business operations
will occur if service is not restored quickly. No workaround is available.
Cisco TAC Website
You can use the Cisco TAC website to resolve P3 and P4 issues yourself, saving both cost and time. The
site provides around-the-clock access to online tools, knowledge bases, and software. To access the
Cisco TAC website, go to this URL:
http://www.cisco.com/tac
All customers, partners, and resellers who have a valid Cisco service contract have complete access to
the technical support resources on the Cisco TAC website. Some services on the Cisco TAC website
require a Cisco.com login ID and password. If you have a valid service contract but do not have a login
ID or password, go to this URL to register:
http://tools.cisco.com/RPF/register/register.do
If you are a Cisco.com registered user, and you cannot resolve your technical issues by using the Cisco
TAC website, you can open a case online at this URL:
http://www.cisco.com/en/US/support/index.html
If you have Internet access, we recommend that you open P3 and P4 cases through the Cisco TAC
website so that you can describe the situation in your own words and attach any necessary files.

xii
VPN Client User Guide for Mac OS X
OL-5490-01
About This Guide
Obtaining Additional Publications and Information
Cisco TAC Escalation Center
The Cisco TAC Escalation Center addresses priority level 1 or priority level 2 issues. These
classifications are assigned when severe network degradation significantly impacts business operations.
When you contact the TAC Escalation Center with a P1 or P2 problem, a Cisco TAC engineer
automatically opens a case.
To obtain a directory of toll-free Cisco TAC telephone numbers for your country, go to this URL:
http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml
Before calling, please check with your network operations center to determine the level of Cisco support
services to which your company is entitled: for example, SMARTnet, SMARTnet Onsite, or Network
Supported Accounts (NSA). When you call the center, please have available your service agreement
number and your product serial number.
Obtaining Additional Publications and Information
Information about Cisco products, technologies, and network solutions is available from various online
and printed sources.
•The Cisco Product Catalog describes the networking products offered by Cisco Systems as well as
ordering and customer support services. Access the Cisco Product Catalog at this URL:
http://www.cisco.com/en/US/products/products_catalog_links_launch.html
•Cisco Press publishes a wide range of networking publications. Cisco suggests these titles for new
and experienced users: Internetworking Terms and Acronyms Dictionary, Internetworking
Technology Handbook, Internetworking Troubleshooting Guide, and the Internetworking Design
Guide. For current Cisco Press titles and other information, go to Cisco Press online at this URL:
http://www.ciscopress.com
•Packet magazine is the Cisco monthly periodical that provides industry professionals with the latest
information about the field of networking. You can access Packet magazine at this URL:
http://www.cisco.com/en/US/about/ac123/ac114/about_cisco_packet_magazine.html
•iQ Magazine is the Cisco monthly periodical that provides business leaders and decision makers
with the latest information about the networking industry. You can access iQ Magazine at this URL:
http://business.cisco.com/prod/tree.taf%3fasset_id=44699&public_view=true&kbns=1.html
•Internet Protocol Journal is a quarterly journal published by Cisco Systems for engineering
professionals involved in the design, development, and operation of public and private internets and
intranets. You can access the Internet Protocol Journal at this URL:
http://www.cisco.com/en/US/about/ac123/ac147/about_cisco_the_internet_protocol_journal.html
•Training—Cisco offers world-class networking training, with current offerings in network training
listed at this URL:
http://www.cisco.com/en/US/learning/le31/learning_recommended_training_list.html

CHAPTER
1-1
VPN Client User Guide for Mac OS X
OL-5490-01
1
Understanding the VPN Client
The Cisco VPN Client for Mac OS X is a software application that runs on any Macintosh computer
using operating system Version 10.2 or later. The VPN Client on a remote PC, communicating with a
Cisco VPN device on an enterprise network or with a service provider, creates a secure connection over
the Internet. This connection allows you to access a private network as if you were an on-site user,
creating a Virtual Private Network (VPN).
The following VPN devices can terminate VPN connections from VPN Clients:
•Cisco IOS devices that support Easy VPN server functionality
•VPN 3000 Series Concentrators
•Cisco PIX Firewall Series, Version 6.2 or later
With the graphical user interface for the VPN Client for Mac OS X, you can establish a VPN connection
to a private network; manage connection entries, certificates, events logging; and view tunnel routing
data.
You can also manage the VPN Client for Mac OS X using the command-line interface (CLI). If you are
running Darwin, or if you prefer to manage the VPN Client from the CLI, refer to the Cisco VPN Client
Administration Guide.
Connection Technologies
The VPN Client lets you use any of the following technologies to connect to the Internet:
•POTS (Plain Old Telephone Service)—Uses a dial-up modem to connect.
•ISDN (Integrated Services Digital Network)—May use a dial-up modem to connect.
•Cable—Uses a cable modem; always connected.
•DSL (Digital Subscriber Line)—Uses a DSL modem; always connected.
You can also use the VPN Client on a PC with a direct LAN connection.

1-2
VPN Client User Guide for Mac OS X
OL-5490-01
Chapter 1 Understanding the VPN Client
VPN Client Overview
VPN Client Overview
The VPN Client works with a Cisco VPN device to create a secure connection, called a tunnel, between
your computer and a private network. It uses Internet Key Exchange (IKE) and Internet Protocol Security
(IPSec) tunneling protocols to establish and manage the secure connection.
The steps used to establish a VPN connection can include:
•Negotiating tunnel parameters (addresses, algorithms, lifetime)
•Establishing VPN tunnels according to the parameters
•Authenticating users (from usernames, group names and passwords, and X.509 digital certificates.)
•Establishing user access rights (hours of access, connection time, allowed destinations, allowed
protocols)
•Managing security keys for encryption and decryption
•Authenticating, encrypting, and decrypting data through the tunnel
For example, to use a remote PC to read e-mail at your organization, the connection process might be
similar to the following:
Step 1 Connect to the Internet.
Step 2 Start the VPN Client.
Step 3 Establish a secure connection through the Internet to your organization’s private network.
Step 4 When you open your e-mail
•The Cisco VPN device
– Uses IPSec to encrypt the e-mail message
– Transmits the message through the tunnel to your VPN Client
•The VPN Client
– Decrypts the message so you can read it on your remote PC
– Uses IPSec to process and return the message to the private network through the Cisco VPN
device.

1-3
VPN Client User Guide for Mac OS X
OL-5490-01
Chapter 1 Understanding the VPN Client
VPN Client Features
VPN Client Features
The tables in the following sections describe the VPN Client features.
Table 1-1 lists the VPN Client main features.
Program Features
The VPN Client supports the Program features listed in Table 1-2.
Table 1-1 VPN Client Main Features
Features Description
Operating System Mac OS Version 10.2 or later
Connection types •async serial PPP
•Internet-attached Ethernet
•DSL
Note The VPN Client for Mac OS X does not support Bluetooth
wireless technology.
Protocol IP
Tunnel protocol IPSec
User Authentication •RADIUS
•RSA SecurID
•VPN server internal user list
•PKI digital certificates
•NT Domain (Windows NT)
Table 1-2 Program Features
Program Feature Description
Servers Supported •Cisco IOS devices that support Easy VPN server functionality
•VPN 3000 Series Concentrators
•Cisco PIX Firewall Series, Version 6.2 or later
Interfaces supported •Graphical user interface
•Command line interface
Online Help Complete browser-based context-sensitive Help
Note The online help requires MS Internet Explorer.
Local LAN access The ability to access resources on a local LAN while connected
through a secure gateway to a central-site VPN server (if the central
site grants permission).

1-4
VPN Client User Guide for Mac OS X
OL-5490-01
Chapter 1 Understanding the VPN Client
VPN Client Features
Automatic VPN Client
configuration option
The ability to import a configuration file.
Event logging The VPN Client log collects events for viewing and analysis.
NAT Transparency (NAT-T) Enables the VPN Client and the VPN device to automatically detect
when to use IPSec over UDP to work properly in Port Address
Translation (PAT) environments.
Update of a centrally controlled
backup server list
The VPN Client learns the backup VPN server list when the
connection is established. This feature is configured on the VPN
device and pushed to the VPN Client. The backup servers for each
connection entry are listed on the Backup Servers tab.
Set MTU size The VPN Client automatically sets a size that is optimal for your
environment. However, you can also set the MTU size manually. For
information on adjusting the MTU size, see the VPN Client
Administrator Guide.
Support for Dynamic DNS
(DDNS hostname population)
The VPN Client sends its hostname to the VPN device when the
connection is established. If this occurs, the VPN device can send
the hostname in a DHCP request. This causes the DNS server to
update its database to include the new hostname and VPN Client
address.
Notifications Software update notifications from the VPN server upon
connection.
Launching from notification Ability to launch a location site containing upgrade software from a
VPN server notification.
Alerts (Delete with reason) The VPN Client provides you with a reason code or reason text
when a disconnect occurs. The VPN Client supports the delete with
reason function for client-initiated disconnects,
concentrator-initiated disconnects, and IPSec deletes.
•If you are using a GUI VPN Client, a pop-up message appears
stating the reason for the disconnect, the message is appended
to the Notifications log, and is logged in the IPSec log (Log
Viewer window).
•If you are using a command-line client, the message appears on
your terminal and is logged in the IPSec log.
•For IPSec deletes, which do not tear down the connection, an
event message appears in the IPSec log file, but no message
pops up or appears on the terminal.
Note The VPN Concentrator you are connected to must be
running software version 4.0 or later.
Single-SA The ability to support a single security association (SA) per VPN
connection. Rather than creating a host-to-network SA pair for each
split-tunneling network, this feature provides a host-to-ALL approach,
creating one tunnel for all appropriate network traffic apart from
whether split-tunneling is in use.
Table 1-2 Program Features (continued)
Program Feature Description

1-5
VPN Client User Guide for Mac OS X
OL-5490-01
Chapter 1 Understanding the VPN Client
VPN Client Features
Authentication Features
The VPN Client supports the authentication features listed in Table 1-3.
IPSec Features
The VPN Client supports the IPSec features listed in Table 1-4
Connect on open This feature lets a user connect to the default user profile when starting
the VPN Client. You can enable this feature on the Preferences menu
under the VPN Client tab.
VPN Client API VPN Client provides an application programming interface for
performing VPN Client tasks without using the command-line or
graphical interfaces that Cisco provides. This API comes with a user
guide for programmers, which is in a format that can be edited.
Table 1-2 Program Features (continued)
Program Feature Description
Table 1-3 Authentication Features
Authentication Feature Description
User authentication through
VPN central-site device
•Internal through the VPN device’s database
•RADIUS (Remote Authentication Dial-In User Service)
•NT Domain (Windows NT)
•RSA (formerly SDI) SecurID or SoftID
Certificate Management Allows you to manage the certificates in the certificate stores.
Certificate Authorities (CAs) CAs that support PKI SCEP enrollment.
Peer Certificate Distinguished
Name Verification
Prevents a VPN Client from connecting to an invalid gateway by
using a stolen but valid certificate and a hijacked IP address. If the
attempt to verify the domain name of the peer certificate fails, the
VPN Client connection also fails.
Ta b l e 1- 4 I P S e c F e a tu r e s
IPSec Feature Description
Tunnel Protocol IPSec
Transparent tunneling •IPSec over UDP for NAT and PAT
•IPSec over TCP for NAT and PAT
Key Management protocol Internet Key Exchange (IKE)
IKE Keepalives A tool for monitoring the continued presence of a peer and report
the VPN Client’s continued presence to the peer. This lets the VPN
Client notify you when the peer is no longer present. Another type
of keepalives keeps NAT ports alive.

1-6
VPN Client User Guide for Mac OS X
OL-5490-01
Chapter 1 Understanding the VPN Client
VPN Client Features
VPN Client IPSec Attributes
The VPN Client supports the IPSec attributes listed in Table 1-5.
Split tunneling The ability to simultaneously direct packets over the Internet in
clear text and encrypted through an IPSec tunnel. The VPN device
supplies a list of networks to the VPN Client for tunneled traffic.
You enable split tunneling on the VPN Client and configure the
network list on the VPN device.
Support for Split DNS The ability to direct DNS packets in clear text over the Internet to
domains served through an external DNS (serving your ISP) or
through an IPSec tunnel to domains served by the corporate DNS.
The VPN server supplies a list of domains to the VPN Client for
tunneling packets to destinations in the private network. For
example, a query for a packet destined for corporate.com would go
through the tunnel to the DNS that serves the private network, while
a query for a packet destined for myfavoritesearch.com would be
handled by the ISP's DNS. This feature is configured on the VPN
server (VPN Concentrator) and enabled on the VPN Client by
default. To use Split DNS, you must also have split tunneling
configured.
Table 1-4 IPSec Features (continued)
IPSec Feature Description
Table 1-5 IPSec Attributes
IPSec Attribute Description
Main Mode and Aggressive
Mode
Ways to negotiate phase one of establishing ISAKMP Security
Associations (SAs)
Authentication algorithms •HMAC (Hashed Message Authentication Coding) with MD5
(Message Digest 5) hash function
•HMAC with SHA-1 (Secure Hash Algorithm) hash function
Authentication Modes •Preshared Keys
•Mutual Group Authentication
•X.509 Digital Certificates
Diffie-Hellman Groups •Group 1 = 768-bit prime modulus
•Group 2 = 1024-bit prime modulus
•Group 5 = 1536 prime modulus
Note See the Cisco VPN Client Administrator Guide for more
information about DH Group 5.
Encryption algorithms •56-bit DES (Data Encryption Standard)
•168-bit Triple-DES
•AES 128-bit and 256-bit

1-7
VPN Client User Guide for Mac OS X
OL-5490-01
Chapter 1 Understanding the VPN Client
VPN Client Features
Extended Authentication
(XAUTH)
The capability of authenticating a user within IKE. This
authentication is in addition to the normal IKE phase 1
authentication, where the IPSec devices authenticate each other.
The extended authentication exchange within IKE does not replace
the existing IKE authentication.
Mode Configuration Also known as ISAKMP Configuration Method
Tunnel Encapsulation Modes •IPSec over UDP (NAT/PAT)
•IPSec over TCP (NAT/PAT)
IP compression (IPCOMP) using
LZS
Data compression algorithm
Table 1-5 IPSec Attributes (continued)
IPSec Attribute Description

1-8
VPN Client User Guide for Mac OS X
OL-5490-01
Chapter 1 Understanding the VPN Client
VPN Client Features