9243054 Issue 1 Nokia and Nokia Connecting People are registered trademarks of Nokia Corporation VPN Client User's Guide 9243054 Issue 1 Copyright © 2005 Nokia. All rights reserved. Copyright © 2005 Nokia. All rights reserved. Reproduction, transfer, distribution or storage of part or all of the contents in this document in any form without the prior written permission of Nokia is prohibited. Nokia is a registered trademark of Nokia Corporation. Other product and company names mentioned herein may be trademarks or tradenames of their respective owners. This product includes software licensed from Symbian Software Ltd (c) 1998-2004. Symbian and Symbian OS are trademarks of Symbian Ltd. SecurID is a registered trademark of RSA Security INC. Nokia operates a policy of continuous development. Nokia reserves the right to make changes and improvements to any of the products described in this document without prior notice. Under no circumstances shall Nokia be responsible for any loss of data or income or any special, incidental, consequential or indirect damages howsoever caused. The contents of this document are provided `as is'. Except as required by applicable law, no warranties of any kind, either express or implied, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose, are made in relation to the accuracy, reliability or contents of this document. Nokia reserves the right to revise this document or withdraw it at any time without prior notice The availability of particular products may vary by region. Please check with the Nokia dealer nearest to you. Contents Virtual private networking....................... 4 Managing virtual private networking.............................. 4 Installing VPN client ............................................................. 5 System requirements .................................................... 5 Managing VPN policies........................................................ 5 Installing VPN policies from VPN policy servers ... 5 Installing VPN policies from SIS files....................... 6 Viewing VPN policies .................................................... 6 Checking policy status ................................................. 7 Checking certificate status ......................................... 7 Updating VPN policies.................................................. 8 Deleting VPN policies ................................................... 8 Managing VPN policy servers............................................. 8 Connecting to VPN policy servers ............................. 8 Installing settings from SIS files ............................... 9 Adding VPN policy servers........................................... 9 Editing VPN policy servers.........................................10 Synchronising VPN policy servers ...........................11 Enrolling VPN certificates .........................................11 Deleting VPN policy servers ......................................11 Managing VPN access points...........................................11 Viewing the VPN log...........................................................12 Key store passwords ...........................................................13 Creating or changing a key store password.........13 Entering key store passwords...................................13 Using VPN with applications ...........................................13 Authenticating to VPN gateways............................14 Troubleshooting ...................................................................14 Copyright © 2005 Nokia. All rights reserved. Virtual private networking Virtual private networking With virtual private networking (VPN), you can create encrypted connections to information you need while away from the office. You are in touch and in control with encrypted access to your enterprise network for email, database applications, and intranet. Remote network traffic needs to be protected. Your company might use a VPN to tunnel network traffic and apply appropriate security policies. A VPN helps provide network transactions with privacy and integrity and allows users to be authenticated and authorized for access to networks and network services. To create a VPN, a gateway and the device authenticate each other and negotiate encryption and authentication algorithms to help protect the privacy and integrity of the information that you access. policy that is loaded when you connect to a VPN access point. To use virtual private networking 1 Install VPN client. For more information, see "Installing VPN client" on page 5. 2 Specify a connection to a VPN policy server. You can specify settings for a VPN policy server in VPN management or install the settings from a Symbian installation system (SIS) file. For more information, see "Connecting to VPN policy servers" on page 8. Note: If you install VPN policies from SIS files, you do not have to create connections to VPN policy servers. 3 Install VPN policies from the VPN policy server. For more information, see "Installing VPN policies from VPN policy servers" on page 5. 4 Create VPN access points. VPN access points specify an Internet access point and a VPN policy. Note: VPN access points combine VPN policies with Internet access points. When you synchronise a VPN policy server for the first time, matching VPN access points are Managing virtual private networking To use VPN connections, you first create VPN access points, and then select VPN access points when you use applications to connect to the enterprise. A VPN connection is created to the enterprise network over another type of Internet access point connection. The connection is created and encrypted according to a VPN 4 Copyright © 2005 Nokia. All rights reserved. Managing VPN policies VPN policies define the method that VPN client and a VPN gateway use to authenticate each other and the encryption algorithms that they use to help protect the confidentiality of the data. Administrators create VPN policies and store them on VPN policy servers or deliver them to you as SIS files. You install VPN policies from a VPN policy server in VPN management. Installing VPN client You receive VPN client as a standard SIS file. You install VPN client on a device in the same way that you install other software. For more information about how to install software on a device, see the documentation of the device. You do not need the VPN client SIS file after the installation. Delete the SIS file to release memory. Installing VPN policies from VPN policy servers In VPN management, you can install VPN policies from a VPN policy server. Tip! VPN policy servers are servers on the enterprise network that contain VPN policies. To install VPN policies 1 Go to Tools > Control panel > Connections > VPN management. 2 Press Yes when VPN management prompts you to install VPN policies. 3 Press Yes again to add VPN policy servers. System requirements You can install VPN client on a memory card or on device memory. The memory card must be in the device for VPN client to work. During the installation of VPN client, you need at least 1.5 MB of memory in the device. Copyright © 2005 Nokia. All rights reserved. Virtual private networking created for each policy that you install on the device. For more information about creating and selecting VPN access points, see "Managing VPN access points" on page 11. 5 Select a VPN access point when you use applications to connect to the enterprise network. For more information, see "Using VPN with applications" on page 13. A VPN connection is created on top of the Internet access point connection. After the installation, VPN client reserves 900 K of memory on the device or on a memory card. Each VPN policy typically requires from 1 K to 16 K of memory on the device. 5 Virtual private networking 4 Specify settings for connecting to a VPN policy server and press Done. For more information, see "Connecting to VPN policy servers" on page 8. Press Yes to synchronise the VPN policy server. Create a key store password and press OK. Tip! A key store password helps protect private keys in VPN policies and VPN policy server connections from unauthorized use. For more information, see "Creating or changing a key store password" on page 13. The device connects to the VPN policy server. Verify the identity code of the VPN policy server and key in the missing characters to establish trust between the device and the VPN policy server and press OK. You can skip this step if you install the settings for the VPN policy server from a SIS file. Tip! A VPN policy server identity code is the fingerprint of the VPN policy server certificate, which identifies the certificate. For more information, see "Adding VPN policy servers" on page 9. Key in authentication information to access the VPN policy server and press OK. Administrators tell you what information to key in. Note: If you press Cancel, VPN policies are not installed. Select Install to install VPN policies from a VPN policy server. 5 6 Installing VPN policies from SIS files Administrators can deliver VPN policies to you as SIS files. If you install VPN policies from SIS files, you do not have to define connections to VPN policy servers. After you install VPN policies, you can create VPN access points and associate them to applications. If the VPN policies contain private keys and corresponding certificates, administrators define key import passwords to help protect the private keys. Administrators should use a secure method to deliver the key import password to you. Tip! A key import password helps protect the private keys in a VPN policy file. To install VPN policies from SIS files, type the key import password in Password and press OK. Then type the key store password in Password and press OK. 7 8 Viewing VPN policies In VPN management, you can view, update, and delete the VPN policies that you install on a device. To view VPN policy details, select a VPN policy and press Open to view more information. VPN policies are installed on the device. 6 Copyright © 2005 Nokia. All rights reserved. Scroll to view the following information about each VPN policy: · Description shows additional information about the VPN policy. The description is read from the VPN policy. Administrators define the description when they create the VPN policy. · Policy status indicates whether the VPN policy is ready to use or not or whether it is already in use. · Certificate status indicates whether valid user certificates are available in the device. · Policy name shows the name of the VPN policy. Administrators define the name when they create the VPN policy. · Policy server name shows the name of the VPN policy server from where you installed the VPN policy. You give names to VPN policy servers when you define connections to VPN policy servers. This field is hidden if you installed the VPN policy from a SIS file. · Updated shows the date when the VPN policy was last updated from the VPN policy server. This field is hidden if you installed the VPN policy from a SIS file. Not associated with a VPN access point -- you must associate the VPN policy with a VPN access point to activate the VPN policy. Note: The VPN policy details view is not refreshed if the policy status changes while the view is open. Checking certificate status Certificate status can have the following values: OK -- at least one valid certificate is available in the device or you do not use certificates to authenticate to VPN gateways. Expired -- lifetime of one or more certificates has ended. If you cannot create a VPN connection, update the VPN policy to enroll new certificates. Missing -- One or more of the required certificates cannot be found on the device. If you cannot create a VPN connection, try to update the VPN policy to enroll new certificates. Not yet valid -- one or more certificates are for future use. This value might also mean that the date and time on the device are set in the past, time zones are not set correctly, or the daylight-saving setting is turned on. To delete the VPN policy, press Delete. To close the VPN policy details, press Close. Copyright © 2005 Nokia. All rights reserved. Checking policy status Policy status can have the following values: Active -- you created a connection to a VPN access point that is associated with the VPN policy. When you create a connection, the VPN policy is activated. Associated with a VPN access point -- you associated the VPN policy with one or several VPN access points. You can Virtual private networking select any of the VPN access points to activate the VPN policy. 7 Virtual private networking Updating VPN policies When you create a connection to a VPN access point, VPN client checks the status of the VPN policy that is associated with the VPN access point from the VPN policy server. If administrato ...