HP Sa3110 - VPN Server Appliance How to use

hewlett-packard sa3000 series
vpn client
release 6.8.2 release notes
Hewlett-Packard Company
HP: 5971-0874
P/N: A52439-001
March 2001

2Hewlett-Packard SA3000 Series VPN Client

Release 6.8.2 Release Notes 3
Disclaimer
Information in thisdocument is provided in connection
with Hewlett-Packard Company products. No license,
express or implied, by estoppel or otherwise, to any
intellectual property rights is granted by this document.
Except as provided in Hewlett-Packard Company’s Terms
and Conditions of Sale for such products, Hewlett-Packard
Company assumes no liability whatsoever, and Hewlett-
Packard Company disclaims any express or implied
warranty, relating to sale and/or use of Hewlett-Packard
Company products including liability or warranties relating
to fitness for a particular purpose, merchantability, or
infringement of any patent, copyright or other intellectual
property right. Hewlett-Packard Company products are not
intended for use in medical, life saving, or life sustaining
applications.
Hewlett-Packard Company may make changes to
specifications and product descriptions at any time,
without notice.
This Hewlett-Packard SA3000 Series VPN Client Release
6.8.2 Release Notes document as well as the software
described in itis furnished under license and may only be
used or copied in accordance with the termsof the license.
The information in this manual is furnished for
informational use only, is subject to change without notice,
and should not be construed as a commitment by Hewlett-
Packard Company. Hewlett-Packard Company assumes no
responsibility or liability for any errors or inaccuracies that
may appear in this document or any software that may be
provided in association with this document.
Except as permitted by such license, no part of this
document may be reproduced, stored in a retrieval system,
or transmitted in any form or by any means without the
express written consent of Hewlett-Packard Company.
Copyright © Hewlett-Packard Company 2001.

4Hewlett-Packard SA3000 Series VPN Client

Release 6.8.2 Release Notes 5
Contents
DISCLAIMER 3
CONTENTS 5
INTRODUCTION 7
LIMITATIONS TO THIS RELEASE 7
HARDWARE SERVICE AND TELEPHONE SUPPORT NUMBERS 7
SYSTEM REQUIREMENTS 10
RELEASE 6.8.2 FEATURES 12
AUTHENTICATION SUPPORT FOR SST 12
IPSEC SECONDARY AUTHENTICATION IMPLEMENTED 12
PACKETGUARD INCREASES USEFULNESS FOR REMOTE USERS 12
VPN CLIENT CO-OPERATES WITH PACKETPROTECT 13
SPECIAL CONSIDERATIONS 14
KNOWN PROBLEMS 25

6Hewlett-Packard SA3000 Series VPN Client

Release 6.8.2 Release Notes 7
Introduction
This document describes the new features and
improvements in Release 6.8.2 of the HP SA3000 Series
VPN Client.
This document includes the following sections:
• System requirements
• Release 6.8.2
• Special considerations
• Known problems
For information regarding Release 6.8.2 of the HP VPN
Server Appliance SA3110/SA3150/SA3400/SA3450 and the
HP SA3000 Series VPN Manager, refer to the Release Notes
for that firmware and software.
Limitations to This Release
Windows Me Not Supported
Reference Numbers 617, 631, 632, and 760
In Release 6.8.2, the VPN Client on a Microsoft Windows
Millennium Edition (Me) system exhibits degraded
performance or crashes, displaying a fatal exception error
message. Performance problems include not being able to
use IPSec over dial-up connections, and, if your
implementation is for Windows NT domain logon, you will
not see the three-bar logon window until after the VPN
tunnel is connected. Hewlett-Packard Company
recommends you do not use the Release 6.8.2 VPN
products on a Windows Me system.
Hardware Service andTelephone Support
Numbers
Hardware service and telephone support information is
provided next by geographical location.

8Hewlett-Packard SA3000 Series VPN Client
U.S. and Canada
In the U.S. and Canada, for hardware service and
telephone support, contact an HP-authorized reseller or
the HP Customer Support Center at 1-800-633-3600.
Europe
In Europe, for hardware service and telephone support,
contact an HP-authorized reseller or the HP Customer
Support Center nearest you:
• Austria: 0660 6386
• Belgium: Dutch: 02 626 8806; French: 02 626 8807
• Czech Republic: 420 2 613 07 310
• Denmark: 3929 4099
• English (non-UK; see also: UK): [phone]
• Finland: 02 03 47 288
• France: 01 43 62 3434
• Germany: 0180 525 8143
• Greece: [phone]
• Hungary: 36 1 382 1111
• Ireland: 01 662 5525
• Israel: 972 9 952 4848
• Italy: 02 2 641 0350
• Netherlands: 020 6068751
• Norway: 22 11 6299
• Poland: [phone]
• Portugal: 21 317 6333
• Russia: 7095 797 3520
• South Africa: RSA: 086 000 1030; outside RSA: +27 11
258 9301
• Spain: 902 321 123
• Sweden: 08 619 2170
• Switzerland: 084 880 1111
• Turkey: 90 212 221 6969
• United Kingdom:0870 842 2339

Release 6.8.2 Release Notes 9
Asia
In Asia, for hardware service and telephone support,
contact an HP-authorized reseller or one of the following
support centers:
• Australia: 03-8877-8000
• Hong Kong: 800-96-2598
• India: 91-11-6826035
• Indonesia: 0800-21511
• Japan: 0120-220-119
• Korea: [phone]
• Malaysia: 60 3 2931811 or 1-800-881811
• New Zealand: Upper North Island: 09-356-6640; Lower
North Island: 04-499-2026; South Island: 03-365-9805
• People’s Republic of China: 86-8008105959
• Philippines: 63 2 811-0643
• Singapore: [phone]
• Taiwan: [phone] or 886-2-7170055
• 8324155
Latin America
In Latin America, for hardware service and telephone
support, contact an HP-authorized reseller or one of these
support centers:
• Argentina: (541) 4778-8380
• Brazil: Sao Paulo: (11) 3747-7799; All Others: 0800-15-
77-51
• Chile: 800-360-9999
• Columbia: 9-800-91-9477
• Guatemala: 1-800-999-5305
• Mexico: Ciudad de Mexico: 5258-9922; All Others: 800-
472-6684
• Peru: 0-800-10111
• Puerto Rico: 1-877-232-0589
• Venezuela: 207-8488; All Others: 800-47-777Thailand: 66
2 6613891
• Vietnam: Hanoi: 84 4 9430101; Ho Chi Minh City: 84 8

10 Hewlett-Packard SA3000 Series VPN Client
System Requirements
The system requirements for running the VPN Client
Release 6.8.2 software are as follows:
• PC or PC-compatible desktop computer
• Windows 95 running on:
− Intel Pentium®90-MHz processor performance
level
− 5 MB free disk space
− 32 MB RAM
− Dial-Up Networking (DUN) 1.3
− Winsock 2 (required for protocol 99 and IPSec
features)
• Windows 98 running on:
− Pentium 90-MHz processor performance level
− 5 MB free disk space
− 32 MB RAM
• Windows NT 4.0 (Workstation or Server version with
Service Pack 3, Service Pack 4, Service Pack 5, or
Service Pack 6a) running on:
− Pentium 90-MHz processor performance level
− 5 MB free disk space
− 32 MB RAM
• Windows 2000 Professional running on:
− Pentium 133-MHz processor performance level
− 15 MB free disk space
− 64 MB RAM

Release 6.8.2 Release Notes 11
Using Windows 95 (Gold or A) Versions
Because Microsoft Windows 95 Gold and Windows 95 A
use DUN 1.0, these releases do not permit data to transfer
over tunnels established over PPP dial-up connections. To
view your Windows 95 version, select System Properties.
Windows 95 B (OSR2) or Windows 95 C (OSR3) releases
work successfully.
If you use Windows 95 Gold or Windows 95 A and you are
currently using a DUN version earlier than 1.3, upgrade to
DUN version 1.3 before you install the VPN Client.
To check what version of DUN you are using:
1. In the Start menu, select Settings, then select Control
Panel.
The Control Panel window appears.
2. In the Control Panel icon box, select the Add/Remove
Programs icon.
The Add/Remove Programs Properties window
appears.
3. In the Programslist box, look for Dial-Up Networking
N.N, where N.N shows the DUN version you are using.
4. If N.N is less than 1.3, install the upgrade as described
next.
To upgrade to DUN version 1.3:
1. Obtain the Windows95 Dial-Up Networking (DUN) 1.3
upgrade. To obtain this upgrade, using your browser,
go to URL: http://support.microsoft.com/support/
downloads/dp3267.asp. Click the upgrade file,
msdun13.exe, then follow the instructions on your
screen to download the file.
2. Install the Windows95 Dial-Up Networking (DUN) 1.3
upgrade.
3. Reboot your PC.

12 Hewlett-Packard SA3000 Series VPN Client
Release 6.8.2 Features
The following major features are provided in Release 6.8.2
of the VPN Client.
Authentication Support for SST
Reference Numbers 675P2-2 and 670P10GW-1
In Release 6.8.2 of the VPN Client supports RADIUS,
SecurID, and Shiva Certificate Authority and Entrust
certificate authentication in SST-type connections over
unreliable connections.
IPSec Secondary Authentication
Implemented
Release 6.8.2 of the VPN Client supports RADIUS and
SecurID authentication for IPSec tunnels. Accordingly,
changes have been made to the GUI to address the new
IKE secondary authentication capability.
PacketGuard Increases Usefulness for
Remote Users
In essence, PacketGuard is a simple packet-filtering
firewall that functions on the VPN Client’s PC during a
VPN session. The purpose of PacketGuard is to safely
allow home-networking functions during a VPNsession,
specifically to enable local network sharing when a VPN
tunnel is up, for example, allowing local access to shared
printers and files, and so on. In Release 6.8.2,
incorporating PacketGuard with the VPN Client gives
remote users access to shared printers and files when a
VPN tunnel is up.

Release 6.8.2 Release Notes 13
To browse other computers on your local network while
your VPN tunnel is connected, select the Enable Home
network access check box in the Options window. To
restrict traffic on your PC to traffic through the VPN
tunnel, ensure this check box is clear. The default setting
is enabled. This feature only applies to PCs on local
networks, for example, networkswith IP addresses such
as 192.168.n.n and 10.0.n.n that are non-routable across the
Internet; this feature does not apply to standalone PCs, for
which the feature is not enabled. If you change this option,
you must reconnect your VPN tunnel.
To use printing and file sharing with other computers on
your local network while you have a VPN tunnel
connected, select the Enable Home network access check
box and the Enable File and Other Services check box in
the Optionswindow. The default setting is enabled. This
feature only applies to PCs on local networks, not to
standalone PCs, for which the feature is notenabled.
Note: For the PacketGuard feature to work, you must
specify a 0.0.0.0 subnet for the Remote Group tunnel
profile in the VPN Manager GUI or Console window and
you must ensure that the operating system of the PC on
which the VPN Client software resides has a default
gateway defined.
VPN Client Co-operates With PacketProtect
Reference Numbers 209P, 211P, 214P, 654, 655, and 656
PacketProtect is an implementation of VPN on the Intel
PRO/100 S Management or Server Adapter. PacketProtect
helpsprotect IP traffic traveling on a LAN using IPSec,
while offloading security tasksfrom the CPU to the NIC
card. In Release 6.8.2, the VPN Client disables
PacketProtect when connecting a VPN tunnel. The VPN
Client encrypts the packets until it logs off, at which point
it re-enables PacketProtect.

14 Hewlett-Packard SA3000 Series VPN Client
Special Considerations
Windows 2000 Users Must Have
Administrative Rights to Use Protocol 99
Reference Number 340PDF
It appears that in the latest versions of Windows 2000,
Microsoft has withdrawn the use of the registry key that
allowed non-administrative users access to raw socket
calls. As a result of this change, Protocol 99 now does not
work for non-administrative users on Windows 2000
systems. If non-administrative users attempt to use
Protocol 99 to connect to a device, the following error
message appears:
Error unable transmit
Enabling the Use of Protocol 99 on
Windows NT or Windows 2000 Systems
Reference Number 673DF
On Windows NT and Windows 2000 systems, raw socket
security must be disabled for the VPN Client software to
send out protocol 99 packets. You must have
administrative privileges to disable raw socket security.
You can disable raw socket security on Windows NT and
Windows 2000 systems in one of the following ways:
• In a massdeployment situation, the system
administrator should disable raw socket security by
using the vpnclient.ini file parameter available in
Release 6.8.2 software. Set the disable raw security
parameter to yes.
• In a single installation, the administrator or user must
log on with administrative privileges, and then select
the Disable raw socket security for all users (required
for protocol 99) check box in the Options window

Release 6.8.2 Release Notes 15
Upgrading to Windows 2000 From
Windows 95/98 or Windows NT
If you plan to upgrade from Windows 95/98 or Windows
NT to Windows 2000, ensure that you remove the VPN
Client software before upgrading.
AT&T Dialers Supported for Windows
95/98
If you use the AT&T Business Dialer with Windows 95 or
Windows 98, use version 2.6 or later. If youusethe AT&T
VPNS Dialer with Windows 95 or Windows 98, use version
2.5 or later.
Network Connections Fail When Transport
Mode SA is Connected
Reference Number 514DF
When a transport mode SA is connected to a VPN device or
IPSec-capable workstation, only connections that match
the protocol/portfor that endpoint will be enabled. All
other connections will fail.
To resolve thisproblem, do one of the following:
• Include SAs for all connection types required to the
end-point, such as FTP, ICMP, and so on
• Allow all traffic by assigning a protocol/port
combination that is ALL
VPN Client on Windows NT/Windows 2000
Server With DHCP Server
Windows NT does not support VPN Client software
installed on the same desktop computer as the DHCP
(Dynamic Host Configuration Protocol) server.
The DHCP server installation on a Windows NT or
Windows 2000 server requires a static IP address for the
Ethernet NIC (Network Interface Card). DHCP for its own
adapters is then disabled for this server. The VPN Client
will not run properly if a DHCP server is installed and
running.

16 Hewlett-Packard SA3000 Series VPN Client
VPN Manager and VPN Client Installed on
Same PC
When the VPN Manager and the VPN Client are installed
and configured on the same PC, there is an active tunnel to
a device, and you have either a route statement to the
remote device or a non-bifurcated tunnel, specify the
Client-IP of the tunnel in the VPN Manager's IP Address
window.
Use the Manager Communication command in the
Configure menu of the VPN Manager main window to set
the IP address in the Configure Manager Communication
window.
Browsing Your Network
If you use Microsoft Windows 95 Gold, SR1 (95A), or SR2
(95B) for your operating system and you have trouble
browsing your network, check the version of Dial-Up
Networking (DUN) in your computer. If you are currently
using a DUN version earlier than 1.3, upgrade to DUN
version 1.3.
To check which version of DUN you are using:
1. In the Start menu, select Settings, then select Control
Panel.
The Control Panel window appears.
2. In the Control Panel icon box, select the Add/Remove
Programs icon.
The Add/Remove Programs Properties window
appears.
3. In the Programslist box, look for Dial-Up
Networking N.N, where N.N shows the DUN
version you are using.
4. If N.N is less than 1.3, install the upgrade as described
next.
To upgrade to DUN version 1.3:
1. Using your browser, go to the following URL:
http://support.microsoft.com/support/downloads/dp326
7.asp

Release 6.8.2 Release Notes 17
2. Click the upgrade file, msdun13.exe, then follow the
instructionson your screen to download thefile.
3. Install the upgrade, then reboot your PC.
Also, if you have trouble browsing through a tunnel and
have NetBEUI installed in your network control panel:
1. Check the NetBIOS node type either on the VPN device
or on the VPN Manager.
2. Remove the VPN Client software.
3. Remove the NetBEUI protocol from your network
control panel.
4. Reinstall the VPN Client software.
Inconsistent Behavior When Initial Client-
IP Address Changes
If you change the initial Client-IP addressby enabling
DHCP using the Setup, Optionssequence of menu
commands, the VPN Client will display inconsistent
behavior. For example, the outcome may be that either the
initial Client-IP address remains unchanged from the initial
IP address, or an IP address somewhat different than the
one assigned will be displayed.
This behavior is exhibited because the Client-IP address
can be adjusted based on the VNIC (virtual network
interface card) number. Since the mask = 8, the last octet
may vary by 7.
Using HP SA3000 Series VPN Client With
Novell NetWare 5
Reference Number 6.7S-1
Connecting to a Novell Network Directory Services (NDS)
tree through a VPN Client SST (Shiva Smart Tunneling)
tunnel is possible if you allow the Novell client
workstation to find the NDS tree. The way in which you
arrange for the workstation to find the NDS resources
depends on the version and network protocol running on
your Novell NetWare server.

18 Hewlett-Packard SA3000 Series VPN Client
Beginning with NetWare 5, the Novell servers and clients
allow for support of native IP (Internet Protocol). This
means that the nativeIP stack installed on your client
workstation is the protocol used to communicate with the
server. No additional protocols or services are necessary.
Use the latest Novell client with service pack that is
appropriate to your operating system: Windows 95,
Windows 98, or Windows NT. Then, when you install the
Novell client software, select the option appropriate to the
Novell server version: the IP option for a NetWare 5 server
(the IPX option is not necessary for NetWare 5).
With Novell NetWare 5, the Novell client and server can
use native IP, including Microsoft IP, to connect with IP
addresses. NetWare 5 resolves resources through its
Network Directory Services (NDS). NDS is the equivalent
of DNS to the Internet or WINS to Microsoft. With NDS,
you are authenticated to thetree, much like being
authenticated to the domain in Microsoft networking. With
NDS, you normally enter the tree name and not a specific
server when logging in. The NDS tree structure usually
identifies resources, such as servers, through names.
For example, you might call your authentication server
auth_server.
However, NDS names cannot be resolved in the same
manner through a VPN Client tunnel as they can on the
LAN. This is because broadcasts and multicast protocols
do not function through the VPN Client tunnel.
To work around this, try one or both of the following:
1. On your local workstation, add a file that maps the
name to the IP address. For Windows 95/98, call the file
NWHOST and put the file in the directory Novell\Client
32. For Windows NT, call the file HOSTS and put the
file in the directory [system root
directory]\system 32\drivers\etc, where
system root directory means the name of the directory
in which Windows NT is located on your workstation.
See Sample Novell Map File.

Release 6.8.2 Release Notes 19
2. Use the IP address of the server you want to use for
authentication, instead of using its name. For example,
use 10.250.113.1 instead of auth_server. To specify
the IP address for NDS to use, when the Novell client
logon window appears, click Advanced. The Advanced
section appears. In the Tree Name field, enter the IP
address ofthe Novell NDS server on the LANthat logs
you into the NDS directory services.
To use the VPN Client software with Novell NetWare 5,
first install and then configure the Novell client. Next,
install and then configure the VPN Client software.
In addition to the previous steps, for NetWare 5, for
Windows 98 only, a patch is required. The patch is a Novell
file called trannta.nlm. Replace the existing
trannta.nlm file that was loaded on your computer
when you installed the Novell client. The patch is in Beta
release, but there are no known problems associated with
it. To obtain the patch, call Novell technical support using
the telephone number you obtain as follows.
To obtain the Novell technical support telephone number
for your area, follow the links on the following URL:
http://support.novell.com
To work with Novell NetWare 5, no action is required in
the VPN Client software.
Sample NWHOST Map File
To allow the Novell client to find the NetWare/IP server
and/or tree:
• Use an NWHOST file.
• Use a Domain SAP/RIP Server (DSS) or DNS (for DNS
to work, the client must be configured to use a tree
name that looks like a DNS name, for example,
novell_tree.nwip.shiva.com).

20 Hewlett-Packard SA3000 Series VPN Client
A sample NWHOST file provided by Novell Client 32
installation follows.
;
; NetWare Host File entries are formatted as follows
;
; <treename> IP Addr
; <servername> IPAddr
;
;
; TEST_SERV 255.65.8.1
; TEST 255.65.8.1
;
; For treenames, specify the address of the server
; to connect to in the tree.
;
; IP addresses are in A.B.C.D format.
;
; Use ';' or '#' for comments. The Win95 Client looks
; for the host file "NWHOST" in the NOVELL\CLIENT32
directory.
;
; The NT Client looks for the host file "HOSTS" in the
; %SYSTEM_ROOT%\SYSTEM32\DRIVERS\ETC directory.
;
Full Class C Route Should Not Be Added
to VPN Client Route Table
Reference Number 104092
If a tunnel is createdfrom the VPN Client to a VPN device
using a net-include of 172.16.20.0 mask 255.255.255.248, a
route print from the VPN Client side of the tunnel displays
the following route:
172.16.20.0 255.255.255.0 client-ip address
172.16.20.0 255.255.255.248 client-ip address
The first route should not be added to the route table.
This behavior results from the Client-IP on the VPN device
falling within the subnetdefined through an address IP on
the VPN device of 172.16.20.1 with a mask of 255.255.255.0.