HP Sa3110 - VPN Server Appliance How to use

hewlett-packard
sa3000 series
vpn client deployment tool
release notes
Hewlett-Packard Company
HP: 5971-0887
P/N: A01445-003
March 2001

2 Hewlett-Packard SA3000 Series VPN Client Deployment Tool Release Notes
Disclaimer
Information in this document is provided in connection with
Hewlett-Packard Company products. No license, express or
implied, by estoppel or otherwise, to any intellectual property
rights is granted by this document. Except as provided in
Hewlett-Packard Company’s Terms and Conditions of Sale for
such products, Hewlett-Packard Company assumes no liability
whatsoever, and Hewlett-Packard Company disclaims any
express or implied warranty, relating to sale and/or use of
Hewlett-Packard Company products including liability or
warranties relating to fitness for a particular purpose,
merchantability, or infringement of any patent, copyright or
other intellectual property right. Hewlett-Packard Company
products are not intended for use in medical, life saving, or life
sustaining applications.
Hewlett-Packard Company may make changes to specifications
and product descriptions at any time, without notice.
The Hewlett-Packard SA3000 Series VPN Client Deployment
Tool Release Notes as well as the software described in it is
furnished under license and may only be used or copied in
accordance with the terms of the license. The information in this
manual is furnished for informational use only, is subject to
change without notice, and should not be construed as a
commitment by Hewlett-Packard Company. Hewlett-Packard
Company assumes no responsibility or liability for any errors or
inaccuracies that may appear in this document or any software
that may be provided in association with this document.
Except as permitted by such license, no part of this document
may be reproduced, stored in a retrieval system, or transmitted in
any form or by any means without the express written consent of
Hewlett-Packard Company.
Copyright © Hewlett-Packard Company 2001.

Hewlett-Packard SA3000 Series VPN Client Deployment Tool Release Notes 3
Contents
DISCLAIMER...........................................................................................................................2
INTRODUCTION.....................................................................................................................5
SUPPORTED FEATURES.......................................................................................................6
HARDWARE, SOFTWARE, AND SERVICES REQUIREMENTS ......................................7
HARDWARE..............................................................................................................................7
SOFTWARE...............................................................................................................................7
SERVICES.................................................................................................................................7
SUPPORTED CONFIGURATIONS........................................................................................8
SINGLE COMPUTER CONFIGURATION.........................................................................................8
MULTIPLE COMPUTER CONFIGURATION ....................................................................................8
SPECIAL CONSIDERATIONS...............................................................................................9
USING THE VPN CLIENT DEPLOYMENT TOOL ON A JAPANESE WINDOWS NT OR WINDOWS 2000
SERVER....................................................................................................................................9
USING ONLINE HELP ................................................................................................................9
VPN CLIENT DEPLOYMENT TOOL MANAGER AND PRODUCT INSTALLATION UTILITY..................10
REDEPLOY OR WITHDRAW PREVIOUS DEPLOYMENTS................................................................10
VPN CLIENT DEPLOYMENT TOOL MANAGER LOGIN ACCOUNT AND SETPASSWORD COMMAND...10
POLLING A SPECIFIC DEVICE...................................................................................................11
MULTIPLE VPN CLIENT DEPLOYMENT TOOL MANAGERS.........................................................11
FLAT TEXT FILE IMPORT OF USERS .........................................................................................11
VPN CLIENT UPDATES FOR WINDOWS NT USERS ...................................................................12
IMPORT FILE CANNOT CONTAIN EMPTY LINES.........................................................................12
KNOWN PROBLEMS ............................................................................................................13
VIDEO CARD CONFIGURATION AND THEVPN CLIENT DEPLOYMENT TOOL MANAGER ...............13
MULTIPROCESSOR CONFIGURATIONS NOT SUPPORTED ISSUE...................................................13
VPN CLIENT INSTALLATION FORCES USER TO DOUBLE CLICK EXECUTABLE TWICE..................13
VPN CLIENT DEPLOYMENT TOOL MANAGER DOES NOT READ PRODUCT INSTALLATION WHILE
OPEN.....................................................................................................................................13
AUTOLOGON PASSWORD NOT REINITIALIZED AFTER MULTIPLE DEPLOYMENTS.........................14
AUTOLOGON PASSWORD SUPPRESSES PICK LIST......................................................................14
USER NOT PROMPTED FOR AUTHENTICATION PASSWORD ........................................................14
AUTHENTICATION SETTINGS DISTORTED.................................................................................14
MINIMIZE/MAXIMIZE PROBLEM ...............................................................................................15
FIELDS TRUNCATED WITHOUT NOTICE ...................................................................................15
SECURING PASSWORDS...........................................................................................................15
TUNNEL WINDOW PROTOCOL AND PORT NUMBER FIELD INTERACTION ....................................15
DUPLICATED DATA NOT DETECTED........................................................................................16

4 Hewlett-Packard SA3000 Series VPN Client Deployment Tool Release Notes
SERVLET INSTALLATION ON WINDOWS NT WORKSTATION........................................................16
CANCELING A DEPLOYMENT DOWNLOAD FROM THE WEB SERVER............................................16
TROUBLESHOOTING..........................................................................................................17
REMOVING THE VPN CLIENT DEPLOYMENT TOOL....................................................18

Hewlett-Packard SA3000 Series VPN Client Deployment Tool Release Notes 5
Introduction
The Hewlett-Packard SA3000 Series VPN Client Deployment
Tool allows you to deploy software and configuration
information to a large number of users.
These release notes describe the features, special considerations,
and known problems of this release of VPN Client Deployment
Tool.
In particular, there are sections covering:
• Supported Features
• What’s new?
• Hardware, software, and services requirements
• Special considerations
• Known problems
• Troubleshooting
• Removing the VPN Client Deployment Tool
Note: For information on installation see the Hewlett-Packard
SA3000 Series VPN Client Deployment Tool Getting Started
Guide.

6 Hewlett-Packard SA3000 Series VPN Client Deployment Tool Release Notes
Supported Features
The VPN Client Deployment Tool allows you to deploy
software and configuration information to a large number of
users. Specifically, it allows you to:
• Collect device, tunnel, client, product, user, and
corporation information and store it in a database
• Generate a user or group list from which entries are
selected for the deployment process
• Validate the selected user entries for deployment
• Create configuration files and bundle them with the
VPN Client software for deployment to validated users
• Distribute deployment notifications by e-mail
The VPN Client Deployment Tool consists of the following
components:
• VPN Client Deployment Tool Manager
• VPN Client Deployment Tool Database
• VPN Client Deployment Tool Servlet
For more information on the VPN Client Deployment Tool, see
the Hewlett-Packard SA3000 Series VPN Client Deployment
Tool Getting Started Guide and the application’s online Help.

Hewlett-Packard SA3000 Series VPN Client Deployment Tool Release Notes 7
Hardware, Software, and Services
Requirements
The following lists contain the hardware and software
components required for this release.
Hardware
The VPN Client Deployment Tool needs the following
minimum hardware specifications:
• PC with Intel PentiumII 266-MHz processor
performance level
• 64-MB RAM (128 MB recommended)
• 200-MB free hard-disk space
• 1024x768 screen resolution
Software
The VPN Client Deployment Tool supports the following
platforms:
• The VPN Client Deployment Tool Manager and
Database run on Windows NT Workstation 4.0 with
Service Pack 5 or Windows 2000 Professional.
• The VPN Client Deployment Tool Servlet runs on
Windows NT Server 4.0 with a minimum Service Pack
5 and Option Pack 4.0 installed or Windows 2000
Server.
Services
VPN Client Deployment Tool requires the following services:
• Internet Information Server (IIS) 4.0
• IIS/FTP (File Transfer Protocol) server
• An SMTP (Simple Mail Transfer Protocol) server

8 Hewlett-Packard SA3000 Series VPN Client Deployment Tool Release Notes
Supported Configurations
Supported configurations of the VPN Client Deployment Tool
include a single and multiple computer configuration.
Single Computer Configuration
The single computer configuration involves having both the
VPN Client Deployment Tool Manager, Database, and Servlet
running on the same system (Windows NT Server running IIS or
Windows 2000 Server). See “Hardware, Software, and Services
Requirements”earlier in this document for the recommended
minimum system configuration.
Multiple Computer Configuration
The multiple computer configuration involves having the VPN
Client Deployment Tool Manager and Database running on one
computer and the VPN Client Deployment Tool Servlet running
on another (Windows NT or Windows 2000 Servers running
IIS). The Servlet computer must have TCP/IP access to the
database computer. If there is a firewall between the Servlet
computer and the Manager/Database computer, it must permit
the Servlet to access the database using a TCP port. By default
this is port 2638.
See “Hardware, Software, and Services Requirements”earlier in
this document for the recommended minimum system
configuration.

Hewlett-Packard SA3000 Series VPN Client Deployment Tool Release Notes 9
Special Considerations
This section lists special considerations you should be aware of
for the VPN Client Deployment Tool.
Using theVPN Client DeploymentTool on a
JapaneseWindows NT orWindows 2000
Server
The VPN Client Deployment Tool does not run on a Japanese
Windows NT or Windows 2000 Server unless you do the
following:
1. Change the contents of the start manager.bat file to read:
"..\JRE\1.2.2\bin\javaw.exe" -
Xbootclasspath:"..\JRE\1.2.2\lib\rt.jar;
..\JRE\1.2.2\lib\i18n.jar" -cp
"..\SMDT\smdt.jar"
com.shiva.nm.smdt.mdmanager.MDManager
127.0.0.1
Note: The IP address at the end of the path may differ for
your setup.
2. Next, alter the properties of the "Start Manager" shortcut so
that the "Target:" field points to this batch file in the VPN
Client Deployment Tool directory. For example:
"E:\Program Files\HP SA3000 VPN\VPN
Client Deployment Tool\smdt\start
manager.bat"
3. To avoid seeing the unnecessary DOS box... change the
"Run:" drop down menu in the shortcut to "Minimized"
After making these changes, the VPN Client Deployment Tool
should work on a Japanese server.
Using Online Help
You cannot use the F1 key to initiate online Help. Instead,
access Help by clicking the Help button on the main window.
Accessing Help using this method starts the Help Viewer.

10 Hewlett-Packard SA3000 Series VPN Client Deployment Tool Release Notes
Note: If, while running the program, you cannot access Help,
check that you do not have the Help Viewer open and
minimized.
VPN Client DeploymentTool Manager and
Product Installation Utility
If any users are logged in to the VPN Client Deployment Tool
Manager while the Product Installation Utility is running, the
Manager does not immediately display the updated product
codes. You must reopen the manager for the product codes to be
visible in the Product Profiles tab.
Redeploy orWithdraw Previous Deployments
Some users may receive errors when logging in to the VPN
Client Deployment Tool’s Web server and attempting to
download deployments.
Either retract previous deployments using the Withdraw button
on the Deployment window or deploy new configurations to
your users immediately.
VPN Client DeploymentTool Manager Login
Account and Setpassword Command
More than one login account can now be created using the
setpassword command. The setpassword command can
also be used to delete an operator, except for admin.
The setpassword command uses both user name and password
parameters, to add, update, and delete login accounts.
setpassword <username> <password>
or
setpassword –d username
Examples of a correctly formatted command-line entries appear
as follows:
• To add a new operator:
setpassword john mysecret
• To update a password

Hewlett-Packard SA3000 Series VPN Client Deployment Tool Release Notes 11
setpassword john mynewsecret
• To delete a password, use the –d switch:
setpassword –d john
Note: The user name and password are case sensitive.
Polling a Specific Device
The VPN Client Deployment Tool does not allow you to select a
subset of one or more devices to be polled over a specific time
period. Each time you click Poll Devices, all devices that have
been configured for polling are polled. To prevent one or more
devices from being polled, clear the Device can be polled check
box for each devices in the Devices window that you want to
affect.
MultipleVPN Client DeploymentTool
Managers
If you want to run more than one VPN Client Deployment Tool
database on the same LAN, you must modify the Sybase
database name of one of the installations.
To modify the database name of an VPN Client Deployment
Tool Database installation:
Edit the configuration file C:\Program Files\HP SA3000
VPN\VPN Client Deployment Tool\smdt\vcdtdb.txt on the
computer on which you installed the VPN Client Deployment
Tool Manager. Edit the line reading -n smdt_db to replace
smdt_db with a different, unique database name, such as
smdt_db2 or smdt_db<hostname>.
Save the updated file. The new database name takes effect when
you next boot the server or when you stop and restart the
Adaptive Server Anywhere –VCDT service
FlatText File Import of Users
When importing a large number of users in a flat text file (for
example, greater than 2,000), you may receive an Out of
Memory Exception. This renders the VPN Client Deployment
Tool Manager inoperable, even though buttons may appear
active.

12 Hewlett-Packard SA3000 Series VPN Client Deployment Tool Release Notes
Users in excess of 2,000 should be imported in one or more
smaller text files to avoid this condition.
VPN Client Updates forWindows NT Users
When the VPN Client is deployed and downloaded by Windows
95/98 users, the update happens automatically. However,
Windows NT and Windows 2000 users must remove the VPN
Client manually, restart their computers, and then install the
update.
Import File Cannot Contain Empty Lines
When you are creating an import file, ensure that there a re no
empty lines contained within it. If empty lines are detected, no
error is reported.

Hewlett-Packard SA3000 Series VPN Client Deployment Tool Release Notes 13
Known Problems
This section lists known problems with this release of VPN
Client Deployment Tool.
Video Card Configuration and theVPN Client
DeploymentTool Manager
An exception may occur when the VPN Client Deployment Tool
Manager is running on a computer with a video card that is
configured to use a resolution of 32,768 colors. Changing the
color resolution to another value such as 256, 65536, or 24-bit
(true-color) eliminates the problem.
Multiprocessor Configurations Not Supported
Issue
Compatibility problems have been reported with third-party
components used by VPN Client Deployment Tool on some
multiprocessor computers. The VPN Client Deployment Tool is
not certified for use in multiprocessor configurations.
VPN Client Installation Forces User to Double
Click ExecutableTwice
When a user downloads the VPNClient.exe file and double-
clicks it, the file extracts all client setup files to the correct
directory. However, in some cases the client setup does not
continue.
To restart the client setup, browse to the directory where the
client setup files are located and double-click the client setup.exe
file to complete the process.
VPN Client DeploymentTool Manager Does
Not Read Product InstallationWhile Open
The VPN Client Deployment Tool Manager does not accept the
product installation from the Product Installation Utility when
the Manager is open. You must install the VPN Client product

14 Hewlett-Packard SA3000 Series VPN Client Deployment Tool Release Notes
when the Manager is closed. Open the manager again for the
product code to be visible in the Product Profiles tab.
Autologon Password Not Reinitialized After
Multiple Deployments
If you deploy an autologon password to users in a client profile,
and then deploy another client profile to the same users with no
autologon password set, the autologon password does not get
reinitialized in the registry. This is a VPN Client installation
limitation.
This option works correctly if you deploy to users multiple times
and use different autologon passwords.
Autologon Password Suppresses Pick List
Setting the autologon password in the VPN Client Deployment
Tool Manager and then initiating a deployment of the VPN
Client causes the default path in the registry to point to the
vpnuser.ini file rather than to the .vpc file. This causes the
incorrect profile to be chosen.
To workaround this problem, delete the user in the
<drive>:\Program Files\HP SA3000 VPN
Client\VPN Client directory, and then remove the VPN
Client. Then you must redeploy the same user, making sure that
autologon password is not set in the users panel. After deploying
and downloading the VPN Client, reboot your computer.
User Not Prompted for Authentication
Password When using the Authentication password setting for a VPN
Client logon, you are not prompted for an Authentication
password. The main window of the VPN Client appears instead.
Authentication Settings Distorted
In the Users window, the authentication settings can become
distorted under the following two conditions:
1. If 800x600 resolution is used, the distortion exists in both
minimized and maximized windows.

Hewlett-Packard SA3000 Series VPN Client Deployment Tool Release Notes 15
2. If resolution higher than 800x600 is used, the distortion only
occurs when the window is minimized.
If possible, adjust the VPN Client Deployment Tool Manager
window to a resolution of greater than 800x600.
Minimize/Maximize Problem
If you minimize VPN Client Deployment Tool from any
window with either the Java cup icon or the Minimize button
and then right-click the systray icon to maximize the application
again, the title bar expands to maximum size, but the application
window retains its previous size.
FieldsTruncatedWithout Notice
If you exceed the maximum allowable characters for certain
VPN Client Deployment Tool Manager fields in the Devices and
Tunnels windows, the value is truncated at the maximum
number of characters, but no error message or notice is
generated.
Effected fields include:
• Login name (Devices window) —15 characters
maximum
• Login password (Devices window) —15 characters
maximum
• Challenge Phrase (Tunnels window) —16 characters
maximum
Securing Passwords
The device, tunnel, and authentication passwords that you enter
into the VPN Client Deployment Tool Database are not
protected from unauthorized access. Restrict access to the
database and any database backups to prevent unauthorized
access to these passwords.
TunnelWindow Protocol and Port Number
Field Interaction

16 Hewlett-Packard SA3000 Series VPN Client Deployment Tool Release Notes
In the Tunnel Window, if the Protocol field is set from UDP to
99, the Port field does not gray out until you press the Save
button.
Duplicated Data Not Detected
If you enter duplicate data, the VPN Client Deployment Tool
only detects it in the Client Profile window by presenting you
with a message.
Servlet Installation onWindows NT
Workstation
If you try to install the VPN Client Deployment Tool Servlet on
a Windows NT Workstation, you may do so without seeing any
error messages. However, the VPN Client Deployment Tool
requires Microsoft IIS 4.0, which only runs on Windows NT
Server 4.0.
Canceling a Deployment Download From the
Web Server
When a deployment download from the VPN Client Deployment
Tool Web server/servlet is canceled, the VPNClient.zip bundled
file is not removed from the hard drive of the computer on which
the Web server is installed. For example, look in <web server
drive letter>:\InetPub\ftproot\smdt directory for folders that are
numbered and delete them.

Hewlett-Packard SA3000 Series VPN Client Deployment Tool Release Notes 17
Troubleshooting
After you set up and configure your VPN Client Deployment
Tool Manager, some users may not be able to download and
install VPN clients.
Note: Write down all the error messages during any
troubleshooting sessions.
Use the following steps to troubleshoot your VPN Client
Deployment Tool:
1. Check all the fields in your Users window to make sure all
of them are properly filled out. If you have an invalid e-mail
address, you may not be able to deploy.
2. In the Services control panel of your Windows NT 4.0
Server, ensure that the following services are properly
installed and running:
• IIS (version 4)
• Web server
• FTP service (There is no need to install SMTP if you
have an alternate SMTP server available.)
3. If all the previous steps failed, reboot your Windows NT 4.0
Server computer and try again.

18 Hewlett-Packard SA3000 Series VPN Client Deployment Tool Release Notes
Removing the VPN Client
Deployment Tool
If you choose to remove the VPN Client Deployment Tool from
your computer, you must do the following.
Note: The following procedure also applies to Windows 2000
Server.
Steps
To remove the VPN Client Deployment Tool Manager and
Servlet:
1. Exit the VPN Client Deployment Tool Manager.
2. Stop all other running Windows applications.
3. The Adaptive Server Anywhere –VCDT Service (database)
and the VCDT Web Server (JRun) are installed as services
and must be stopped in the Service Control Panel. From the
Services Control Panel, double-click Services.
The Windows Services dialog box appears.
4. Stop the Adaptive Server Anywhere - VCDT service and
VCDT Web Server by selecting each service and clicking
Stop.
5. Stop IIS Admin Service, which also stops the FTP, SMTP,
and Web server services of IIS.
6. Create a temporary directory and copy your database files to
this safe place that will not be affected by the removal
procedure (for example, c:\tempdir). The database file is
called smdt.db and is located in \Program Files\HP
SA3000 VPN\VPN Client Deployment
Tool\smdt\ .
7. Remove JRun from your computer by going to an MS-DOS
Command Prompt and using the cd (change directory)
command to change to <drive letter>:/Jrun. (For
example, type cd c:\jrun). This is the directory where
JRun is installed.
8. Type cd bin to change to the bin subdirectory.

Hewlett-Packard SA3000 Series VPN Client Deployment Tool Release Notes 19
9. Type jsm -r jsm-default. (This removes the
NT/2000 service.)
10. In the Windows Control Panel, click Add/Remove
Programs to remove each of the each of the following VPN
Client Deployment Tool components:
• VPN Client Deployment Tool Servlet (when you
remove this, both the servlet and the rest of the JRun
files are removed)
• VPN Client Deployment Tool Manager
Note: The VPN Client Deployment Tool Manager and
Database components could be installed on separate devices
from the VPN Client Deployment Tool Servlet components.
11. Delete the following files and folders (if they exist):
• c:\Inetpub\ftproot\smdt
• c:\Inetpub\wwwroot\smdt
• c:\Inetpub\scripts\jrun.dll
• c:\Inetpub\scripts\jrun.ini
• c:\Inetpub\scripts\jrun*.log
• c:\JRun
• c:\Program Files\HP SA3000 VPN\VPN Client
Deployment Tool\smdt
12. Restart the computer.
If you plan to reinstall the same release of the VPN Client
Deployment Tool, do not empty the Recycle Bin until the
reinstallation is successfully completed.