Release Notes for VPN Client, Release 4.8 [Cisco VPN Client]
Cisco
Table Of Contents

Release Notes for VPN Client, Release 4.8

Contents

Introduction

System Requirements

Installation Notes

Files in VPN Client for Windows, Release 4.8.01.0300

Files in VPN Client for Windows, Release 4.8.00.0440

VPN Client for Linux, Release 4.8.01.0640

VPN Client for Linux, Release 4.8.00.0490

VPN Client for Linux, Release 4.8.00.440

File in VPN Client for Mac OS X, Release 4.8.00.0490

Installation Notes - Windows Platforms

Installing the VPN Client Software Using InstallShield

Installing the VPN Client Software Using the MSI Installer

Using the VPN Client

About Version Numbers

New Features in Release 4.8

Certificate Distinguished Name Matching

Certificate Key Usage

Certificate Key Usage Matching

Certificate Extended Key Usage Matching

Certificate Fall Through

Improved Certificate Matching Capabilities for VPN Client

Rebootless Client Upgrade for MSI Installer Only

Support for Dual-Processor and Dual-Core Workstations

Multi-Threaded CPU Windows Support

Smart Card Handling Enhancements

Tear Down Tunnel When Smart Card Is Removed

Notify User When a Smart Card Is Locked for Too Many Bad PINs

Smart Card Password Reprompt for New Connections

MSI and IS Installers Now Launch after Unzipping the Files.

Bypassing Installation of Firewall Files When Stateful Firewall Is Not Required

MSI Installation with the Japanese Language Help Files

GUI Customization Feature to Mask VPN Client Tabs and Features

API for Cisco VPN Client

Usage Notes

Linux Client Permits Unencrypted Traffic to Protected Host

Mac OS Client Help Inaccessible on Case-Sensitive File System

Potential Application Compatibility Issues

Windows Interoperability Issues

DNS

Network Interfaces

Network ICE BlackICE Defender Configuration

Microsoft Outlook Error Occurs on Connection or Disconnect

Adjusting the Maximum Transmission Unit (MTU) Value - Windows Only

Asante FR3004 Cable/DSL Routers Require Asante Firmware Version 2.15 or Later

Using Nexland Cable/DSL Routers for Multiple Client Connections

Cert DN Matching Cannot Match on Email Field EA

VPN Dialer Application Can Load During OS Shutdown or Restart

America Online (AOL) Interoperability Issues

Browser Interoperability Issues

Entrust Entelligence Issues

Accessing Online Glossary Requires Connection to Cisco.com

ZoneAlarm Plus Versions 3.1.274 and Earlier Are Incompatible with VPN Client

Upgrading Zone-Alarm Pro to Version 3.7.098 Causes Error When VPN Client Is Already Installed on the PC

DHCP Route Renewal in Windows 2000 and Windows XP

Data Meant for Private Network Stays Local if VPN Client's Local Network Is on Same IP Subnet as Remote Private Network

DNS Server on Private Network with Split DNS Causes Problems

VPN Client Supports Sygate Personal Firewall V. 5.0, Build 1175

VPN Client Is Not Supported on Windows NT Servers

No Limit to Size of Log File

Start Before Logon and Microsoft Certificate with Private Key Protect Fails

Downgrading VPN Client from Release 4.8 Causes Start Before Logon Failure

Linksys Wireless AP Cable/DSL Router Version 1.44 or Higher Firmware Requirement

VPN Client Can Require Smart Card When Using Certificates

VPN Client GUI Connection History Display Lists Certificate Used

Use Zone Labs Integrity Server 2.1.052.0 or Higher with VPN Client 4.0

Restart VPN Client Service If You Install VPN Client Before Zone Alarm

InstallShield Error Might occur during VPN Client Installation

VPN Client cTCP Connection Fails If Checkpoint Client Is Installed

Open Caveats

Resolved Caveats

Caveats Resolved in VPN Client for Windows, Release 4.8.01.0300

Caveats Resolved in VPN Client for Windows, Release 4.8.00.0440

Caveats Resolved in VPN Client for Linux, Release 4.8.01.0690

Caveats Resolved in VPN Client for Linux, Release 4.8.00.0490 and Release 4.8.00.0440

Caveats Resolved in VPN Client for Mac OS X, Release 4.8.00.0490

Documentation Updates

Documentation Changes

Correcting the Obsolete Filename vpnclient_en_msi

Using MSI to Install the Windows VPN Client without Stateful Firewall

Using InstallShield to Install the Windows VPN Client without Stateful Firewall

Certificates Exported from Cisco Certificate Store Are in Proprietary Format

Related Documentation

Release Notes for VPN Client, Release 4.8

Updated May 28, 2010

Part No. OL-11105-07

These release notes support Cisco VPN Client software for the following releases:

• Release 4.8.00 and 4.8.01 on Windows.

• Release 4.8.00 and 4.8.01 on Linux.

• Release 4.8.00 on Mac OS X.

In this document, we refer to all these releases generically as "Release 4.8." unless there is a need to refer to a specific release. Please refer to About Version Numbers for information about the version numbering scheme.

These release notes describe new features, limitations and restrictions, caveats, and related documentation. Please read the release notes carefully prior to installation. The section, "Usage Notes," describes interoperability considerations and other issues you should be aware of when installing and using the VPN Client.Where applicable, caveat identifiers appear in parentheses following new feature descriptions and usage notes.

Contents

Introduction

System Requirements

Installation Notes

New Features in Release 4.8

Usage Notes

Open Caveats

Resolved Caveats

Documentation Updates

Related Documentation

Introduction

The VPN Client is an application that runs on a Microsoft® Windows®-based PC, a Sun ultraSPARC workstations, a Linux desktop, or a Macintosh (Mac) personal computer that meets the system requirements stated in the next section. In this document, the term "PC" applies generically to all these computers, unless specified otherwise.

The VPN Client on a remote PC, communicating with a Cisco VPN device at an enterprise or service provider, creates a secure connection over the Internet that lets you access a private network as if you were an on-site user. This secure connection is a Virtual Private Network (VPN).

System Requirements

Refer to Chapter 2, "Installing the VPN Client," in the Cisco VPN Client User Guide for Windows or Cisco VPN Client User Guide for Mac OS X, as appropriate for your platform, for a complete list of system requirements and installation instructions.

• To install the VPN Client on any system, you need

– CD-ROM drive (if you are installing from CD-ROM)

– Administrator privileges

• The following table indicates the system requirements to install the VPN Client on each of the supported platforms.

Note VPN Client does not support Windows NT, 98, and ME.

VPN Client supports the following Cisco VPN devices:

• Cisco Adaptive Security Appliance, Version 7.0 and later.

• Cisco PIX Firewall, Version 6.2.2(122) or Version 6.3(1).

• Cisco IOS Routers, Version 12.2(8)T and later

• Cisco VPN 3000 Series Concentrator, Version 3.0 and later. Using IPsec over TCP requires VPN 3000 Series Concentrator version 3.6.7.a and later.

If you are using Internet Explorer, use version 5.0, Service Pack 2 or higher.

Note VPN Client, Release 4.8, supports both Windows 2000 and Windows 2003 servers.

Installation Notes

The following sections list the files included in the VPN Client releases for the Windows, Linux, and Mac OS X platforms.

•Files in VPN Client for Windows, Release 4.8.01.0300

•Files in VPN Client for Windows, Release 4.8.00.0440

•VPN Client for Linux, Release 4.8.01.0640

•VPN Client for Linux, Release 4.8.00.0490

•VPN Client for Linux, Release 4.8.00.440

•File in VPN Client for Mac OS X, Release 4.8.00.0490

Because of platform differences, the installation instructions for Windows and non-Windows platforms also differ.

• Refer to the Cisco VPN Client User Guide for Windows, Chapter 2, for complete installation instructions for Windows users.

• Refer to the Cisco VPN Client User Guide for Mac OS X, Chapter 2, for complete installation information for Mac OS X platforms.

Note Due to issues surrounding network installation, Active Directory Group Policy software deployment is no longer supported. For more information and a workaround, refer to open caveat CSCse00525.

Files in VPN Client for Windows, Release 4.8.01.0300

The following files are included in VPN Client for Windows, Release 4.8.01.0300:

• vpnclient-win-msi-4.8.01.0300-k9.zip—Windows client MSI installer

• vpnclient-win-is-4.8.01.0300-k9.zip—Windows client InstallShield installer

• update-4.8.01.0300-major-k9.zip—VPN Client Auto Update package

Files in VPN Client for Windows, Release 4.8.00.0440

The following files are included in VPN Client for Windows, Release 4.8.00.0440:

• vpnclient-win-msi-4.8.00.0440-k9.zip—Windows client MSI installer

• vpnclient-win-is-4.8.00.0440-k9.zip—Windows client InstallShield installer

• update-4.8.00.0440-major-k9.zip—VPN Client Auto Update package

VPN Client for Linux, Release 4.8.01.0640

The following files are included in VPN Client for Linux, Release 4.8.01.0640:

• vpnclient-linux-4.8.01.0640-k9.tar.gz

• vpnclient-linux-x86_64-4.8.01.0640-k9.tar.gz

Note VPN client fails to install on Linux kernel version is 2.6.31 and above. The workaround is to downgrade to one of the Linux distributions supported by the VPN Client.

VPN Client for Linux, Release 4.8.00.0490

The following files are included in VPN Client for Linux, Release 4.8.00.0490:

• vpnclient-linux-4.8.00.0490-k9.tar.gz

• vpnclient-linux-x86_64-4.8.00.0490-k9.tar.gz

Note VPN client fails to install on Linux kernel version is 2.6.31 and above. The workaround is to downgrade to one of the Linux distributions supported by the VPN Client.

VPN Client Release 4.8.00.0490 is a Beta for the VPN Client installed on biarch Linux systems for x86_64 platforms. (Biarch is a 64-bit kernel that allows execution of 32-bit applications.)

This client is not compatible with pure 64-bit operating systems. The Client operates on both 32-bit i386 and biarch x86_64 operating systems. On i386 32-bit operating systems, this release is not a Beta. The VPN Client now requires GLIBC_2.2 and libstdc++.so.5.Distributions like RedHat 9 and SuSe 9 comply with these requirements.

VPN Client Release 4.7.00.640 is the last release of the non-x86 version of the Linux VPN Client. The non-x86 version supports platforms that do not have the GLIBC_2.2 and libstdc_.so.5.

VPN Client for Linux, Release 4.8.00.440

The VPN Client for Linux, Release 4.8.00.440 consists of the following file: vpnclient-linux-x86_64-4.8.00.0440-k9.tar.gz

Note VPN client fails to install on Linux kernel version is 2.6.31 and above. The workaround is to downgrade to one of the Linux distributions supported by the VPN Client.

File in VPN Client for Mac OS X, Release 4.8.00.0490

The VPN Client for Mac OS X, Release 4.8.00.0490 consists of the following file:

vpnclient-darwin-4.8.00.0490-k9.dmg

Installation Notes - Windows Platforms

The following notes are important for users who are upgrading to Windows XP and users who want to downgrade to an earlier version of the VPN Client software.

Release 4.8 includes the following installation considerations for Windows users:

Installing the VPN Client Software Using InstallShield

Installing the VPN Client software on Windows 2000 or Windows XP with InstallShield requires Administrator privileges. If you do not have Administrator privileges, you must have someone who has Administrator privileges install the product for you.

Note The VPN Client Installer does not allow installations from a network drive.

Installing the VPN Client Software Using the MSI Installer

If you are using the MSI installer, you must have Windows 2000 or Windows XP. Installing with MSI also requires Administrator privileges.

When installing the Windows MSI installation package, the user must manually uninstall the previous VPN Client if it is older than Release 4.8. The Release 4.8 MSI installer does not detect older versions, and the installer attempts to install before aborting gracefully. Once a version 4.8 MSI package has been installed, future client versions can detect the existing version 4.8 installation and automatically begin the uninstallation process.

Note Windows Installer 2.0 must be installed on a Windows 2000 PC before configuring the PC for a Restricted User with Elevated Privileges.

Using the VPN Client

• To use the VPN Client, you need

– Direct network connection (cable or DSL modem and network adapter/interface card), or

– Internal or external modem

• To connect using a digital certificate for authentication, you need a digital certificate signed by one of the following Certificate Authorities (CAs) installed on your PC:

– Baltimore Technologies (www.baltimoretechnologies.com)

– Entrust Technologies (www.entrust.com)

– Netscape (www.netscape.com)

– Verisign, Inc. (www.verisign.com)

– Microsoft Certificate Services — Windows 2000

– A digital certificate stored on a smart card. The VPN Client supports smart cards via the MS CAPI Interface.

About Version Numbers

Beginning with the VPN Client 4.6 release, an all-numeric version numbering system has been adopted for VPN Client software to facilitate the automatic update function. Release numbers are represented in the format:

<major release>.<minor release>.<sustaining release>.<build>

The major and minor release numbers represent the feature level of the product. Major and minor releases implement new product capabilities. The sustaining and build release numbers represent significant or minor patch levels, respectively. For example, 4.8.00.0440 represents feature release 4.8, build 440.

All sustaining and build releases are cumulative, and not all build numbers will be released externally. These release notes specify which build numbers have been released.

When referring generically to the VPN Client software (that is, without regard to a particular platform), these release notes use the term VPN Client 4.8.

New Features in Release 4.8

Release 4.8 of the VPN Client software includes the following new features.

• Certificate features to dynamically map a Certificate to a profile without manual selection by the user. This release adds this feature for Macintosh OS X platforms. This feature was introduced for Windows and Linux platforms in Release 4.7.

• Certificate Key Usage Matching for Mac OS X. This feature was introduced for Windows and Linux platforms in Release 4.7.

• Certificate Extended Key Usage Matching (Windows, Linux, and Mac OS X).

• Certificate Fall Through for Mac OS X. This feature was introduced for Windows and Linux platforms in Release 4.7.

• Improved Certificate Matching capabilities for Windows VPN Client.

• Support for dial process and dual core workstations for Windows 2000 and Windows XP.

• With Release 4.8.01 for Linux, build 0690, installation of the Linux unified VPN client works correctly during the kernel module build with Linux kernel 2.6.19+.

• With Release 4.8.01 for Linux, build 0690, the VPN Client accommodates long latency times during SCEP enrollments.

Certificate Distinguished Name Matching

The Profile Keyword CertMatchDN parameter specifies the wildcard string to match and selects a particular certificate by its Distinguished Name, in the given certificate store, during a connection attempt. If the wildcard string matches multiple certificates, the first certificate that satisfies the wildcard string is chosen. The value of this parameter is a pseudo-regular expression, the format of which is exactly identical to that of the VerifyCertDN profile keyword.

Valid keywords for the wildcard string are:

• "CN" SubjectCommonName

• "SN" SubjectSurName

• "GN" SubjectGivenName

• "N" SubjectUnstructName

• "I" SubjectInitials

• "GENQ" SubjectGenQualifier

• "DNQ" SubjectDnQualifier

• "C" SubjectCountry

• "L" SubjectCity

• "SP" SubjectState

• "ST" SubjectState

• "O" SubjectCompany

• "OU" SubjectDept

• "T" SubjectTitle

• "EA" SubjectEmailAddr

• "ISSUER-CN" IssuerCommonName

• "ISSUER-SN" IssuerSurName

• "ISSUER-GN" IssuerGivenName

• "ISSUER-N" IssuerUnstructName

• "ISSUER-I" IssuerInitials

• "ISSUER-GENQ" IssuerGenQualifier

• "ISSUER-DNQ" IssuerDnQualifier

• "ISSUER-C" IssuerCountry

• "ISSUER-L" IssuerCity

• "ISSUER-SP" IssuerState

• "ISSUER-ST" IssuerState

• "ISSUER-O" IssuerCompany

• "ISSUER-OU" IssuerDept

• "ISSUER-T" IssuerTitle

• "ISSUER-EA" IssuerEmailAddr

Example:

vID Cert",OU*"Cisco",ISSUER-CN!="Entrust",ISSUER-OU!*"wonderland"

CN="ID Cert"--Specifies an exact match on the CN.

OU*"Cisco"--Specifies any OU that contains the string "Cisco".

ISSUER-CN!"Entrust"--Specifies that the Issuer CN must not equal "Entrust".

ISSUER-OU!*"wonderland"--Specifies that the Issuer OU must not contain "wonderland".

Certificate Key Usage

For Windows, Linux, and Mac platforms, the global parameter vpnclient.ini [Main] keyword CertificateKeyUsage restricts the usage of Certificates from all stores to only those with the Certificate Key Usage parameters, Digital Signature or Non-Repudiation.

If the "CertificateKeyUsage=1" when the VPN Client is launched, only Certificates with the proper key usage are displayed under the Certificates tab. In addition, profiles configured to use Certificates that do not have the proper key usage receive an error that the Certificate cannot be found.

The default for this keyword is "CertificateKeyUsage=0", which allows all available Certificates to be selected and used.

This keyword overrides all other Certificate matching criteria, such as CertMatchDN.

Certificate Key Usage Matching

The Certificate Key Usage Matching feature allows the profile selection of Certificates based on the Key Usage as well as the DN and Extended Key Usage fields. The Profile Keyword: CertMatchKU overrides the vpnclient.ini keyword "CertificateKeyUsage."

For example:

CertMatchKU=0,3,4,5

DIGITAL_SIGNATURE 8

NON_REPUDIATION 7

KEY_ENCIPHERMENT 6

DATA_ENCIPHERMENT 5

KEY_AGREEMENT 4

KEY_CERT_SIGN 3

CRL_SIGN 2

ENCIPHER_ONLY 1

DECIPHER_ONLY 0

If the Certificate matches any of the usages in the CertMatchKU field, it passes on to the next criterion. Otherwise, the Certificate is not selected.

If two Certificates, identical except for Key Usage, are available to the following profile, only the one with Non-Repudiation is chosen.

[Main]

Host=1.2.3.4

AuthType=3

CertStore=2

CertName=myMultipleCerts

CertMatchKU=7

!CertSubjectName=

!CertSerialHash=

Certificate Extended Key Usage Matching

The profile keyword parameter CertMatchEKU specifies the list of extended Key Usage fields that the VPN Client should honor. When this profile keyword is specified, during a connection attempt the VPN Client looks only at those certs (irrespective of certificate store) whose Extended Key Usage fields match those that are specified by the profile keyword. That is, when this profile keyword is specified, for any given cert, at least one of the Extended Key Usage fields specified in the profile keyword must be present in the certificate's Extended key Usage field.

This keyword applies only to connection attempts and not to any other certificate-related operation (such as listing certs, viewing certs, and so on). This keyword applies to all forms of certificate selection (such as CertSerialHash, CertMatchDN, CertSubjectName, or CertName). The value of this keyword is a comma-separated list of Extended Key Usage OID strings. Custom Extended Key Usage strings must be of the form 1.3.6.1.5.5.7.3.n, where n can be any number.

For example:

CertMatchEKU=1.3.6.1.5.5.7.3.2,1.3.6.1.5.5.7.3.1

where:

1.3.6.1.5.5.7.3.2 = Client authentication

1.3.6.1.5.5.7.3.1 = Server Authentication

Certificate Fall Through

For a given connection attempt, you can select a certificate using one or more of the keywords given below (in order of precedence).

1. CertMatchEKU and CertMatchKU

2. CertSerialHash

3. CertMatchDN

4. CertSubjectName

5. CertName

If the VPN Client cannot find a cert in the given cert store using any of the Certificate keywords noted above, the connection attempt fails.

This behavior is implicit and does not have any profile keyword associated with it.

The following is a sample profile:

[Main]

Host=10.10.10.10

AuthType=3

CertStore=2

!UserName=

!UserPassword=

CertMatchDN=issuer-ou*"vpn group",ea*"Cisco.com"

!CertSerialHash=

This profile matches only certificates that have a Key Usage of "Non-Repudiation" and have either Client or Server Authentication in the Extended Key Usage. The Issuer-ou field must contain "vpn group", and the email address for the user Certificate must contain "cisco.com" (case insensitive).

In the Windows environment (the VPN Clients for Linux and Mac do not support smart cards), the preceding scenario allows a common workstation to connect users based on their smart card certificates. A user could walk up, insert the smart card, and press connect. This generic profile would find the proper certificate on the card (without restarting the client or modifying the profile) and prompt the user for their Certificate password, username, and password. The concentrator could also be configured to connect without a username and rely entirely upon the Certificates for authentication.

Note The use of the "!" character in the profile prevents the previous user's information from being retained between connections.

Improved Certificate Matching Capabilities for VPN Client

Certificate Matching matches the first available Certificate that matches the rules set up for Certificate Matching, regardless of validity, causing the connection to fail. To prevent expired certificates from being selected when valid ones are available, the Windows VPN Client now ignores invalid or expired Certificates from the Certificate Store.

Rebootless Client Upgrade for MSI Installer Only

The MSI installer for the VPN Client installation now allows the VPN Client to be upgraded without rebooting under the following circumstances:

• If a previous MSI version of the VPN Client has been installed, overwriting with the 4.8.00.0440 MSI VPN Client installation requires a reboot only to uninstall the previous VPN Client installation. (Prior installations had required an additional reboot that is no longer required.)

• A new installation of the 4.8.00.0440 MSI VPN Client installation does require a reboot.

• Future upgrades from the 4.8.00.0440 MSI VPN Client with later MSI installations will not require any reboots.

Support for Dual-Processor and Dual-Core Workstations

The VPN Client, Release 4.8.00.0440, includes support for dual-processor and dual-core workstations for Windows 2000 and XP.

Multi-Threaded CPU Windows Support

The VPN Client, Release 4.8.00.0440, now includes multi-threaded Windows support.

Smart Card Handling Enhancements

The VPN Client, Release 4.8.00.0440, includes several improvements in the way it handles smart cards, as described in the following sections.

Tear Down Tunnel When Smart Card Is Removed

When a smart card is removed from the system, the tunnel is now automatically torn down. This enhancement causes the tunnel to immediately drop upon removal of the smart card from the system. This is an "always on" feature.

Notify User When a Smart Card Is Locked for Too Many Bad PINs

The VPN Client now issues a log message when a smart card is blocked because too many incorrect PINs are entered. Under these circumstances, the connection eventually fails. The notification is a log message about the smart card being locked.

Smart Card Password Reprompt for New Connections

Any time a new connection is made, the smart card now requires the user to re-enter his/her credentials. (Password reprompt for new connections (uncache password).) The VPN Client does not allow connections to be re-established without the user re-entering the credentials to unlock the smart card.

To bypass this feature and retain the behavior found in earlier VPN Client releases, add an entry: BypassCardPinReset=1 in the vpnclient.ini file.

MSI and IS Installers Now Launch after Unzipping the Files.

To enhance the ease of installation of the VPN Client on Windows, for both IS and MSI, the installer now launches itself after you unzip the files.

Bypassing Installation of Firewall Files When Stateful Firewall Is Not Required

In some cases, the Stateful Firewall files of the VPN Client conflict with other third party applications. To minimize this conflict, you can install the VPN Client without its Stateful Firewall files by using the following procedures:

Caution Do not use this procedure if you are using a Zone Alarm product, because they share similar files.

If the workstation does not have the vsdata.dll file (no former Cisco VPN Client installation or Zone Alarm products), then delete or rename this file before proceeding.

IS Installer:

Place a new oem.ini keyword: DisableFirewallInstall=1 under the [main] section heading.

MSI installer:

MSI must use the novsdata.zip transform posted on CCO.

After a proper installation using the above procedure the VPN Client does not show the stateful firewall under the options pulldown.

MSI Installation with the Japanese Language Help Files

The Japanese help files for the MSI transform have been removed from the VPN Client installation package. They are now posted separately on CCO as "vpnclient_help_jp_4.8.00.0440.zip".

GUI Customization Feature to Mask VPN Client Tabs and Features

The following new keywords can be used in the vpnclient.ini under the [GUI] section to mask tabs and features from the VPN Client:

vpnclient.ini [GUI] section keywords:

ShowProfileTab

ShowCertTab

ShowLogTab

ShowCertDelete

ShowCertTabChangePasswd

ShowConnectionTab

Set equal to 0 to remove the "Connection Entries" tab. Defaults to 1.

ShowCertificatesTab

Set equal to 0 to remove the "Certificates" tab. Defaults to 1.

ShowLogTab

Set equal to 0 to remove the "Log" tab. Defaults to 1.

ShowCertTabDelete

Set equal to 0 to remove the "Delete" option for deleting Certificates. Defaults to 1.

ShowCertTabChangePasswd

Set equal to 0 to remove the "Change Certificate Password..." option for changing Certificate passwords. Defaults to 1.

API for Cisco VPN Client

The Cisco VPN Client offers an application programming interface (API). The software, sample program, and documentation are available at http://www.cisco.com/pcgi-bin/tablebuild.pl/windows, along with the rest of the VPN Client downloads. The file name is APIExample_Rev4.zip.

If you do not have a CCO account, please visit http://tools.cisco.com/RPF/register/register.do and register for a guest account. Once you have done this forward the account ID to the vpn-client-api-support@cisco.com so that we can publish the file to you.

Note The Solaris VPN Client does not provide API support.

All API commands require that the 4.6.x and later of the VPN Client be fully installed.

If you are planning on using C, we recommend you call the vpnapi.dll directly; however, if you plan on using C++, then use the example provided in the zip file. The example is compatible with Visual Studio 2005. The documentation in the zip file will work for both C & C++.

Usage Notes

This section lists issues to consider before installing Release 4.8 of the VPN Client software.

In addition, you should be aware of the open caveats regarding this release. Refer to "Open Caveats" on page 27 of these Release Notes for the list of known problems.

Linux Client Permits Unencrypted Traffic to Protected Host

The Cisco VPN Client for Linux permits traffic originated by a remote host to pass unencrypted to a protected host.

For example, the client replies and the connection is established if all of the following are true:

• Linux client IP address assigned by the VPN server is x.x.x.x.

• Linux client global IP address is y.y.y.y.

• Protected network on the client is a.a.a.a (that is, the network on the server side).

• Packet sent from a.a.a.a to y.y.y.y is not translated.

Mac OS Client Help Inaccessible on Case-Sensitive File System

The VPN client help for Mac OS is inaccessible if one changes the Mac OS file system to be case-sensitive.

The help is accessible if the file system is in its default, case-insensitive format.

Potential Application Compatibility Issues

You might encounter the following compatibility issues when using the VPN Client with specific applications. Whenever possible, this list describes the circumstances under which an issue might occur and workarounds for potential problems.

Windows Interoperability Issues

The following known issues might occur with the indicated Microsoft Windows operating systems and applications software.

Note Do not upgrade to Release 4.6.0.3.21 or higher if you depend on Split DNS configurations.

Microsoft Internet Connection Sharing Incompatible

The VPN Client is not compatible with Microsoft ICS (Internet Connection Sharing (ICS) on the same PC.

WINS Support

On Windows 95 and Windows 98, dynamic WINS support works with DHCP-enabled adapters (for example, PPP or NIC adapters that get their IP information dynamically). For static configurations, users must manually configure the adapters with WINS information.

VPN Client Cannot Launch Microsoft Connection Manager

The VPN Client does not see a dialup connection made with Microsoft Connection Manager because of incompatibilities between the requirements of the two applications.

Windows 98 Might Hang on Shutdown

On some Windows 98 PCs with the VPN Client installed, if you restart the PC, it might stop responding (that is, "hang") on the screen that says "Windows is shutting down".

Wait a minute. If the PC is still not responding, press the reset button. When the PC reboots, it should not run through ScanDisk, indicating the shutdown was successful in closing all open files. This problem may occur on some PCs and not on others, and we are looking for a solution. Windows 98 shutdown has numerous issues, as can be seen the following Microsoft Knowledge Base Article:

"Q238096 - How to Troubleshoot Windows 98 Second Edition Shutdown Problems."

Windows 2000 (only) Requires Adding Client for MS Networks for Dialup Connections

For the Cisco VPN Client running on a Windows 2000 system, you cannot access Microsoft resources unless you add the Client for Microsoft Networks for the Dial-up adapter.

Aladdin Runtime Environment (RTE) Issue and Windows 2000

Using versions of the Aladdin Runtime Environment (RTE) on Windows 2000 can cause the following behavior. The login prompt that is posted by the Aladdin etoken when connecting the VPN Client can get hidden in the background. If this happens, the VPN connection can timeout and fail with the following event:

"System Error: Connection Manager failed to respond."

A side effect of this is that the VPN Client's service and dialer might become out of synch, and the PC might need to be restarted. To avoid this issue, use the Aladdin Runtime Environment (RTE) version 2.65 or later.

Microsoft MSN Installation

Microsoft's MSN installation fails if you have already installed the VPN Client. Uninstall the VPN Client before you install MSN. After MSN has completed installation, you can install the VPN Client.

WINS Information Might Not Be Removed from Windows Servers If Not Disconnected Before Shutdown

If the VPN Concentrator is configured to send WINS server addresses down to the VPN Client and the PC is shut down or restarted without first disconnecting the VPN Client, the WINS servers are not removed from the network properties. This might cause local PC registration and name resolution problems while not connected with VPN.

To work around this problem, do one of the following:

• Be sure to disconnect the VPN Client before shutting down. If you are having problems, check your network properties and remove the WINS entries if they are not correct for your network.

• Alternatively, enable "Disconnect VPN connection when logging off". Go to Options > Windows Logon Properties, check Disconnect VPN connection when logging off.

DNS

For DNS resolution, if the DOMAIN NAME is not configured on the network interface, you must enter the fully qualified domain name of the host that needs to be resolved.

Network Interfaces

• The VPN Client does not support Point-to-Point Protocol over ATM (PPPoA).

• The VPN Client cannot establish tunnels over Token Ring. However, it does not conflict with an installed Token Ring interface.

Network ICE BlackICE Defender Configuration

Network ICE's BlackICE Defender is a traffic monitoring security product. If you properly configure it, BlackICE Defender can work with the VPN Client. You must configure BlackICE Defender for Trusting, Nervous, or Cautious mode. If you use Nervous or Cautious mode, add the public IP address of the VPN Concentrator to the list of trusted addresses. You can now configure the VPN Client to work with BlackICE Defender configured for Paranoid mode when in Tunnel-everything mode. Split Tunneling requires BlackICE to be in Trusting, Nervous, or Cautious mode.

The Cisco VPN Client firewall has the following requirements for BlackICE (BlackICE Defender 2.5 or greater or BlackICE Agent 2.5 or greater). For BlackICE Defender 2.5, copy the BICTRL.DLL file from the Cisco installation release medium to the BlackICE installation directory on the VPN Client PC. This is a mandatory step for making a connection requiring BlackICE.

BlackICE Defender version 2.9 and greater includes the BICTRL.DLL file in the Network ICE distribution medium, so that you do not need to copy it from the Cisco installation release medium.

Microsoft Outlook Error Occurs on Connection or Disconnect

The following Microsoft Outlook error might occur when the VPN Client connects or disconnects:

"Either there is no default mail client, or the current mail client cannot fulfill the messaging request. Run Microsoft Outlook and set it as the default mail client."

This message does not affect operation of the VPN Client. The issue occurs when Microsoft Outlook is installed but not configured for email, although it is the default mail client. It is caused by a Registry Key that is set when the user installs Outlook.

To eliminate this message, do one of the following:

• Right-click the Outlook icon, go to Properties, and configure it to use Microsoft Exchange or Internet Mail as the default mail client.

• Use Internet Explorer to configure the system to have no default mail client.

• Configure Outlook as the default mail client.

Adjusting the Maximum Transmission Unit (MTU) Value - Windows Only

VPN Encapsulation adds to the overall message length. To avoid refragmentation of packets, the VPN Client must reduce the MTU settings. The default MTU adjusted value is 1300 for all adapters. If the default adjustments are not sufficient, you may experience problems sending and receiving data. To avoid fragmented packets, you can change the MTU size, usually to a lower value than the default. To change the MTU size, use the VPN Client SetMTU utility. If you are using PPPoE, you may also have to set the MTU in other locations. Refer to the following table for the specific procedures for each type of connection.

The MTU is the largest number of bytes a frame can carry, not counting the frame's header and trailer. A frame is a single unit of transportation on the Data Link Layer. It consists of header data, plus data that was passed down from the Network Layer, plus (sometimes) trailer data. An Ethernet frame has an MTU of 1500 bytes, but the actual size of the frame can be up to 1526 bytes (22-byte header, 4-byte CRC trailer).

Recognizing a Potential MTU Problem

If you can connect with the Cisco VPN Client but cannot send or receive data, this is likely an MTU problem. Common failure indications include the following:

• You can receive data, such as mail, but not send it.

• You can send small messages (about 10 lines), but larger ones time out.

• You cannot send attachments in email.

Setting the MTU Value

If you are not experiencing a problem, do not change the MTU value. Usually, an MTU value of 1300 works. If it does not, the end user must decrease the value until the Cisco VPN Client passes data. Decrement the MaxFrameSize value by 50 or 100 until it works.

The following table shows how to set the MTU value for each type of connection.

Asante FR3004 Cable/DSL Routers Require Asante Firmware Version 2.15 or Later

Versions of the Asante firmware caused a problem with rekeying and keepalives when a VPN Client had an all-or-nothing connection to a VPN Concentrator through an Asante FR3004 Cable/DSL router. Version 2.15 (or later) of the Asante firmware resolves these issues. For more information about Asante cable/DSL routers, see the following Web sites:

•http://www.asante.com/products/routers/index.html

•http://www.practicallynetworked.com/pg/router_guide_index.asp

Using Nexland Cable/DSL Routers for Multiple Client Connections

All Nexland Pro routers support passing multiple IPSec sessions through to Cisco VPN 3000 Series Concentrators. To enable this function, the Nexland user must select IPSec Type 2SPI-C on the Nexland options page.

The discontinued Nexland ISB2LAN product correctly handles a single connection, but problems can occur when attempting to make multiple client connections to the same Secure Gateway from behind an ISB2LAN Nexland Cable/DSL router. Nexland has fixed this problem in the Nexland Pro series of routers.

Cert DN Matching Cannot Match on Email Field EA

You cannot match on the Cert DN field (EA) when using the Peer Cert DN Verification feature because the VPN Concentrator does not assign a value to that field.

VPN Dialer Application Can Load During OS Shutdown or Restart

When using the VPN Client's Start Before Logon feature (Windows 2000 or Windows XP) in "fallback" mode, the VPN dialer application loads during a shutdown or restart of the operating system. This does not cause any problems and can be ignored.

America Online (AOL) Interoperability Issues

AOL Versions 5.0 and 6.0

The VPN Client supports AOL Version 5.0. AOL Version 6.0 is also supported, with one limitation: when connected, browsing in the network neighborhood is not available.

AOL Version 7.0

AOL Version 7.0 uses a proprietary heartbeat polling of connected clients. This requires the use of split tunneling to support the polling mechanism. Without split tunneling, AOL disconnects after a period of time between 5 and 30 minutes.

AOL 7 Disconnects after VPN Authentication

When making a dialup connection with AOL 7.0 Revision 4114.537 (for Windows 95, 98, ME, Windows 2000 and XP), then attempting to connect with the VPN Client, AOL might disconnect while the user is being authenticated. This is an AOL issue, not a VPN Client problem.

VPN Client Fails to Connect over Some AOL Dialup Connections

The Cisco VPN Client connecting over an AOL dialup connection fails to complete the connection, particularly when using AOL 7.0 and 8.0

The AOL dialup process uses a fallback method which, if your initial attempt to connect fails, resorts to a different connection type for the second attempt. This second attempt can sometimes cause AOL to communicate over two PPP adapters (visible in ipconfig /all output). When this happens, the VPN Client cannot connect. This is a known issue, and AOL is investigating the problem.

To work around this issue, try to reconnect the dialup connection and try to avoid getting two PPP adapters.

Browser Interoperability Issues

The following known issues might occur when using the VPN Client with the indicated browser software.

Issues Loading Digital Certificate from Microsoft Certificate Store on IE 4.0 SP2

The following error occurs in the VPN Client log when using a Digital Certificate from the Microsoft Certificate Store. This can occur on Internet Explorer 4.0 with SP2 and using the VPN Client v3.1 or v3.5:

"Could not load certificate cn=Joe Smith,ou=Engineering,o=MyCompany,l=Buffalo, st=new york,c=US,e=jsmith@mycompany.com from the Unsupported Store store"

Both the VPN Client and the Certificate Manager can see and validate the Certificate, but when you try to connect using that Certificate, you get a message in the Connection History dialog that says, "Failed to establish a secure connection to the security gateway".

To fix this problem, upgrade to Internet Explorer v5.0 or greater.

Requirements for using VPN Client for Windows Using Digital Certificate With Non-exportable Keys

To use certificates with non-exportable keys, you must have the VPN Client, Release 3.6, 4.0 or 4.6, or higher, and your PC must have Internet Explorer version 5.0 SP2 or later installed to function properly.

Entrust Entelligence Issues

The following known issues might occur when using Entrust Entelligence software with the VPN Client.

Potential Connection Delay

Using the VPN Client with Entrust Entelligence might result in a delay of approximately 30 seconds if you are trying to connect while Entrust is "online" with the CA. This delay varies, depending on your Entrust CA configuration. If the Entrust CA is on the private network, then the chance of Entrust being online are low, since the VPN connection is needed to communicate with the CA.

If you experience this delay, do one of the following:

• Wait for the delay to end and proceed with the VPN connection normally.

• Before initiating the VPN Client connection, log out of Entrust. The VPN Client will initiate the Entrust Login Interface with the "work offline" checkbox checked, which alleviates the problem. The easiest way to log out of Entrust is to right-click on the Entrust tray icon (gold key) and select "Log out of Entrust."

Entrust System Tray Icon Might Erroneously Indicate Logout

When using VPN Client with Start Before Logon (Windows 2000) and Entrust Entelligence, the Entrust system tray icon indicates that it is "logged out" once in Windows. It is really logged in, just not in the normal Windows desktop. The reason for this is that the context that Entrust was logged into was on the "Logon desktop". This is an Entrust issue, not a VPN Client problem.

Entrust operates normally once logged into within Windows.

Entrust Client May Appear Offline

After establishing a VPN connection with Entrust Entelligence certificates, the Entrust client may appear offline. It may appear this way even after the Entrust client has successfully communicated with the Entrust i500 directory.

To work around this issue, do one of the following:

• Upgrade to Entrust Entelligence version 5.1 SP3 or later.

• Once connected, right click on the Entrust tray icon (gold key) and uncheck "Work Offline". This manually puts Entrust online.

Use Entrust Entelligence 4.0 with VPN Client Release 3.5.1 or 3.1 Start Before Logon

When using the Release 3.5.1 or 3.1 VPN Client with the Entrust Entelligence 4.0 software, the Start Before Logon feature does not function properly. Upgrading to Entrust Entelligence 5.1 resolves this problem.

Some Entrust Dialogs Do Not Display Properly When Using VPN Client Start Before Logon

When using the VPN Client with Start Before Logon and Entrust Entelligence, some Entrust dialogs do not display properly on the logon desktop that displays before going into Windows 2000. The first time the VPN Client dialer and service access the Entrust certificates, you see a prompt for a security check. This prompt displays in Windows, but not at the logon screen.

To work around this problem, connect the VPN Client once, while in Windows and after installing, to register the VPN applications (ipsecdialer.exe and cvpnd.exe) with Entrust. Once you have done this you can use it at the logon desktop.

Renewing Entrust Entelligence Certificate (Key Update) Requires Entrust Version 5.1 SP 3 or Later

Entrust Entelligence certificate renewal (key update) will not work over a VPN Client connection unless Entrust Entelligence version 5.1 SP3 or later is being used. Other Entrust Entelligence operations using older versions work properly.

To work around this issue, do one of the following:

• Upgrade to Entrust Entelligence version 5.1 SP3 or later.

• Computers need to have Entrust digital certificates renewed by placing them directly on the network during the renewal period to get updated.

Accessing Online Glossary Requires Connection to Cisco.com

The Glossary button at the top of all Help screens tries to contact univercd at www.cisco.com (the Cisco documentation site). This connection requires connectivity to Cisco's main web site. If your PC does not have a corporate Internet connection or your firewall blocks access, the following error appears when you attempt to access the Glossary:

"The page cannot be displayed."

To access the Glossary, you must be connected to www.cisco.com.

ZoneAlarm Plus Versions 3.1.274 and Earlier Are Incompatible with VPN Client

The following known incompatibility exists between the Cisco VPN Client and Zone Labs ZoneAlarm Plus version 3.1.274 and earlier. If you are using such a version of ZoneAlarm Plus, please visit http://www.zonelabs.com or contact your Zone Labs representative for an update.

On a PC with ZoneAlarm Plus version 3.1.274 (or earlier) and the VPN Client, the following errors occur when the PC boots:

On Windows 2000:

ZAPLUS.exe has generated errors and will be closed by Windows. You will need to restart the program.

An error log is being generated.

The Application Log states:

The application, ZAPLUS.EXE, generated an application error. The error occurred on 7/23/2002... The exception was c0000005 at address 00401881 (<nosymbols>).

Similar errors occur on other Windows operating systems.

The result of this error is that the ZoneAlarm GUI does not run, and therefore a user can not change any settings in ZoneAlarm Plus or allow new programs to access the Internet.

Upgrading Zone-Alarm Pro to Version 3.7.098 Causes Error When VPN Client Is Already Installed on the PC

Upgrading ZoneAlarm Pro version 3.5.xxx to ZoneAlarm Pro version 3.7.098 when the VPN Client is installed on the PC might cause the following error to appear:

"The procedure entry point DbgProcessReset could not be located in the dynamic link library VSUTIL.dll."

Click OK, and the installation continues. See ZoneLabs' bug number 10182.

DHCP Route Renewal in Windows 2000 and Windows XP

In a Windows 2000 or Windows XP environment, if the public network matches the private network (for example, a public IP address of 192.168.1.5, with a subnet mask of 255.255.0.0, and an identical private IP address) and the public network's route metric is 1, then traffic might not be tunneled to the private network. The same problem can occur if you are using a virtual adapter and the public metric is smaller than the virtual adapter metric.

In Windows 2000 and Windows XP, you can increase the metric of the public network by doing the following steps:

Step 1 Select Start > Settings > Control Panel > Network and Dial-up Connections.

Step 2 Select the public interface and click properties for the public interface.

Step 3 Select Internet Protocol (TCP/IP) and get the properties for the Internet Protocol (TCP/IP).

Step 4 Click Advanced, and set the interface metric to 2 or greater.

Data Meant for Private Network Stays Local if VPN Client's Local Network Is on Same IP Subnet as Remote Private Network

This problem occurs only with the VPN Client, Release 4.6 and only with Virtual Adapter (Windows 2000 and Windows XP), when the VPN Client's local network is on the same IP subnet as the remote private network. When a VPN connection is up, data meant for the private network stays local. For example: 192.168.1.0/255.255.255.0

The VPN Client, Release 4.6, with Virtual Adapter attempts to modify local route metrics to allow data to pass over the VPN tunnel. In some cases, it is impossible for the VPN Client to make this modification.

To work around this problem, make the change manually, using the following procedure:

Step 1 Run > Control Panel > Network and Dialup Connections.

Step 2 Right-click on the adapter in question and select Properties.

Step 3 From the Adapter Properties dialog, select TCP/IP from the list and click Properties.

Step 4 Click Advanced and increase the number in the "Interface metric" box by 1 (it is usually 1, so making it 2 works).

Step 5 Click OK to exit out of all dialogs.

Step 6 The VPN connection should now work.

DNS Server on Private Network with Split DNS Causes Problems

When an ISP's DNS server is included in the Split Tunneling Network List and Split DNS Names are configured, all DNS queries to domains other than those in the Split DNS Names list are not resolved.

By definition, split DNS is used so that only certain domains get resolved by corporate DNS servers, while rest go to public (ISP-assigned) DNS servers. To enforce this feature, the VPN Client directs DNS queries that are about hosts on the Split DNS Names list to corporate DNS servers, and discards all DNS queries that are not part of the Split DNS Names list.

The problem is when the ISP-assigned DNS servers are in the range of the Split Tunneling Network List. In that case, all DNS queries for non-split-DNS domains are discarded by the VPN Client.

To avoid this problem, remove the ISP-assigned DNS server from the range of the Split Tunneling Network List, or do not configure split DNS.

VPN Client Supports Sygate Personal Firewall V. 5.0, Build 1175

The supported version of Sygate Personal Firewall is version 5.0, build 1175. Earlier versions might cause the following Blue screen to occur on a Windows NT-based system that has made many connects/disconnects with the VPN Client:

Stop: 000000d1 (BAD0B0B8, 00000002, 00000000, BFF12392)

Driver_IRQL_Not_Less_Or_Equal

***Address BFF12392 base at BFF10000, Datestamp 3CCDEC2C - Teefer.sys

VPN Client Is Not Supported on Windows NT Servers

The VPN Client is not supported on any Windows NT servers. The VPN Client is no longer supported on any Windows NT server version.

No Limit to Size of Log File

When logging is enabled on the VPN Client, all of the log files are placed in the Program Files\Cisco Systems\VPN Client\logs directory and are date and time stamped. There is no limit to the size of the log when logging is enabled. The file will continue to grow in size until logging is disabled or the VPN Client program is closed. The log is still available for viewing until the VPN Client program is re-launched, at which time the display on the log tab and log window are cleared. The log file remains on the system and a new log file is created when the VPN Client, with logging enabled, is launched.

Start Before Logon and Microsoft Certificate with Private Key Protect Fails

Trying to connect the VPN client using Start Before Logon (SBL) and Microsoft Machine-based certificates fails. This is a Microsoft issue, not a VPN Client problem.

If your certificate has private key protection enabled, every time you use the certificate keys you are either prompted for a password to access the key, or notified with a dialog and asked to click OK.

The prompt displayed when using a certificate with private key protection appears on the Windows Desktop. You do not see this message while at the "Logon" desktop, therefore the VPN Client cannot gain the access to the certificate needed to connect.

Use one of the following workarounds:

• Get a certificate without private key protection (just make sure it is machine-based, otherwise it won't be accessible before logging on).

• Instead of using Start Before Logon, log on to the PC using cached credentials, make the VPN connection, and— using the "stay connected at logoff" feature—logoff/logon with the VPN established to complete the domain logon.

Downgrading VPN Client from Release 4.8 Causes Start Before Logon Failure

Start Before Logon fails if the VPN Client is downgraded from Release 4.8 to 3.6. The reason for this is that the file csgina.dll is upgraded when the VPN Client version 4.8 is installed. If the VPN Client is downgraded to version 3.6, the csgina.dll file for version 4.8 is not replaced, and this breaks ability in the VPN Client version 3.6 to Start Before Logon.

Follow this procedure to drop back to the VPN Client version 3.6 from version 4.8.

Step 1 Uninstall the VPN Client version 4.8.

Step 2 After rebooting, search for csgina.dll. This file is found in the System32 directory.

Step 3 Rename csgina.dll to something like csgina.old.

Step 4 Install the VPN Client version 3.6.

Linksys Wireless AP Cable/DSL Router Version 1.44 or Higher Firmware Requirement

To use the VPN Client behind a Linsksys Wireless AP Cable/DSL router model BEFW11S4, the Linksys router must be running version 1.44 or higher firmware. The VPN Client cannot connect when located behind a Linsksys Wireless AP Cable/DSL router model BEFW11S4 running version 1.42.7 firmware. The VPN Client may see the prompt for username/password, then it disappears.

VPN Client Can Require Smart Card When Using Certificates

For Windows 2000 and Windows XP systems, you can configure the VPN Client to require the presence of a Smart Card when Certificates are used. If this feature is configured, the VPN Client displays an error message if a Smart Card is not present. The Certificates need not be present on the Smart Card itself. To configure this feature, add the following line to the user's client profile, specifying the appropriate vendor for your smart card:

SmartCardName=<Name of Smart Card Vendor>

If you are using pre-shared keys instead of Certificates, this requirement is not enforced, even if configured.

To disable the Smart Card verification function, completely delete the entry: SmartCardName=<text> from the user's client profile.

VPN Client GUI Connection History Display Lists Certificate Used

Since Release 4.0.3.C, the VPN Client GUI connection history dialog box displays as the first entry the name of the certificate used for establishing the connection.

Use Zone Labs Integrity Server 2.1.052.0 or Higher with VPN Client 4.0

Versions of the Zone Labs Integrity Server earlier than 2.1.052.0 exhibit the following problem. If two or more VPN Clients (running on Windows 2000 or XP) are connected to a VPN 3000 Series Concentrator and receive firewall policy from a ZoneLabs Integrity Server, the Integrity Server registers only one connection.

On the Integrity Flex (client agent), under "Policies", the "Integrity Server" column flashes "Connected" then "Disconnected" over and over. The VPN Client log also includes the following event: "The firewall, configured for Client/Server, returned a status of lost connection to server." Zone Labs Integrity Server version 2.1.052.0 fixes this issue.

Restart VPN Client Service If You Install VPN Client Before Zone Alarm

The Firewall Enhancement, "Prevent VPN Traffic Blocking", automatically adds the Loopback address (127.0.0.1) and the address of the VPN 3000 Concentrator to the ZoneAlarm or ZoneAlarmPro trusted zone.

An exception to this, however, occurs if the VPN Client is installed before Zone Alarm. Then the VPN Client's service must be restarted by rebooting the PC or stopping and restarting the service through the Control Panel (on Windows NT-based PCs).

InstallShield Error Might occur during VPN Client Installation

The following error message might occur during VPN Client installation:

IKernel.exe - Application Error

The instruction at "0x771c741a" referenced memory at "0x00163648". The memory could not be "read".

This error is caused by an InstallShield component, possibly because of a run-once stale remnant. To recover, you must reboot.

The InstallShield Knowledge base article q108020 addresses this problem. To view this article go to the following URL:

http://support.installshield.com/kb/view.asp?articleid=q108020

Microsoft has a fix for this issue. For more information and to obtain the fix, go to the following URL:

http://support.microsoft.com/default.aspx?scid=kb;en-us;329623

VPN Client cTCP Connection Fails If Checkpoint Client Is Installed

When the Checkpoint VPN-1 Securemote client is installed with the 4.6 or higher VPN Client, and the VPN Client attempts to connect using cTCP, the VPN Client cannot make the connection. Connections do work with UDP, NAT-T, and non-NAT connections.

To make a connection with cTCP when the Checkpoint VPN-1 Securemote is installed, you must disable the Check Point SecuRemote driver in the Connections Properties. To do this, you must be administrator. Follow these steps:

Step 1 Click Start > Settings > Control Panel >Network and Dial-up Connections.

Step 2 Select the Local Area Connection you use.

Step 3 Click on File > Properties.

Step 4 Uncheck Check Point SecuRemote, and click OK.

Open Caveats

Caveats describe unexpected behavior or defects in Cisco software releases. The following lists are sorted by identifier number.

Note If you have an account with CCO, you can use Bug Navigator II to find caveats of any severity for any release. To reach Bug Navigator II on CCO, choose Software & Support: Online Technical Support: Software Bug Toolkit or navigate to http://www.cisco.com/pcgi-bin/Support/Bugtool/launch_bugtool.pl.

• CSCdt07491

The VPN Client might swap Primary and Secondary WINS received from the Concentrator. In a few cases, the VPN Client receives a Primary and a Secondary WINS server from the Concentrator but swaps them when they are added to the IP Configuration. If this happens, it might cause browsing problems if the Secondary WINS server is not as populated as the Primary. Disconnecting and reconnecting may fix the problem.

• CSCdt07673

When the VPN Client is installed on a Windows 2000 PC with the Efficient Networks NTS EnterNet 300 PPPoE version 1.41 or 1.5c, the following message appears:

"EnterNet could not find the (adapter) for complete pc management NIC (adapter). But it did locate the (adapter) for complete pc management NIC (adapter) - Deterministic Network Enhancer Miniport adapter through which your network server is reachable. Do you want to switch to this adapter?"

Answer Yes every time this question appears. The installation then continues normally.

If the VPN Client is uninstalled, the next time the NTS EnterNet 300 PPPoE version 1.41 is used the message, "EnterNet could not find the (adapter). But it did locate the (adapter) through which your network server is reachable. Do you want to switch? Yes No"

Answer Yes to this question. The installation then continues normally.

• CSCdt07787

Problems have occurred when an ISA legacy NIC card (IBM Etherjet 10MB) is used in a PC with PnP OS enabled. The WINS servers did not function correctly when a VPN Client connection was made. This could be an issue with other legacy NIC cards as well.

The end results are that the WINS servers sent from the Secure Gateway cannot be viewed in the Network configuration, and problems with browsing/logon over the VPN connection may occur.

Workaround:

Disable PnP OS in the PC's BIOS or statically configure the WINS servers.

• CSCdt13380

When you connect the VPN Client to a VPN 3000 Concentrator that issues two DNS servers, both appear under ipconfig /all, but only one appears under the Network settings TCP/IP Properties. DNS server appears to be missing under TCP/IP Properties (Advanced button, DNS TAB). We do not know whether this causes any problems.

• CSCdt56343

You might see the following problem on Windows 2000 when you are using the Start Before Logon feature of the VPN Client with third-party dialer. If the third-party dialer does not get set to the foreground when launched, add the following parameter to the vpnclient.ini file in the VPN Client directory (\Program Files\Cisco Systems\VPN Client\Profiles):

[main]

TopMostDelay=2500

The value is the time in milliseconds that the VPN Client waits for the third party dialer to load before attempting to place it in the foreground. The default time is 1000 milliseconds.

Workaround:

For problem dialers/applications, try 2500 milliseconds or greater.

• CSCdu22174

SCEP enrollment might fail to complete successfully after the PKI administrator has granted your request.

Workaround:

If this happens, delete your failed request and submit a new one. To delete the request, click the Certificate tab, select the failed request, and click Delete on the toolbar. Alternatively, open the Certificates menu and select Delete.

• CSCdu50445

The following issue can exist when using the VPN Client Start Before Logon feature with Entrust SignOn. Entrust SignOn is an add-on to the Entrust Entelligence client that allows logging into the Entrust profile and the NT domain from a single login.

The Entrust SignOn GINA dll does not support chaining to other GINA dll files. To make the Entrust SignOn product and the VPN Client with Start Before Logon function properly together, install the VPN Client after Entrust SignOn. The VPN Client replaces the Entrust GINA (etabcgin.dll) with its own (csgina.dll).

• CSCdu62275

VPN Client and Entrust Entelligence - VPN Connection timeout.

In version 3.1, the potential exists for the VPN Client Connection Manager and the VPN dialer to get out of sync with each other. This occurs only after a VPN Client upgrade on the first time the VPN Client accesses a given Entrust profile. The following sequence outlines how a user could get the connection into this state:

Step 1 In the VPN dialer, the user clicks Connect.

Step 2 Entrust prompts for password and security hash check. The user clicks Yes.

Step 3 Entrust prompts for password for cvpnd.exe security access. If the user waits or walks away, the VPN Connection times out in 3 minutes.

Step 4 The user returns and enters the Entrust password, then clicks Yes to the security hash check question.

Step 5 The VPN connection completes, and data can be passed. The VPN dialer appears as not connected.

Step 6 Clicking Connect returns, "A connection already exists." The user clicks Cancel, and the dialer appears connected in the system tray.

The VPN connection can be used as a normal connection.

• CSCdu77405

The message, "The necessary VPN sub-system is not available. You will not be able to make a connection to the remote IPSec server." might appear on a PC when Start Before Logon is enabled on the Client and ZoneAlarm is also running. The message appears when the ctrl+alt+del key combination is pressed. This has happened because the Cisco Systems VPN Service has terminated unexpectedly.

Workaround:

Logon to the PC with cached credentials, open "Services" in control panel and start the VPN service. A connection to the VPN Concentrator will be possible once the service has started.

• CSCdu81905

When connecting to a VPN 3000 Concentrator over PPPoE using the EnterNet 300 client software from Efficient Networks, Inc., if a firewall is required by the VPN Concentrator, the following message might appear:

"The Client did not match any of the Concentrator's firewall configurations..."

If this message appears, click OK and then click Connect. The connection to the VPN Concentrator then proceeds successfully.

• CSCdu83054

If you make connections from the command line interface, the following problem can occur. When a firewall is required to connect and the firewall fails or is shut down, you do not see any message giving the reason for the lost connection.

• CSCdu86399

If you use the VPN Client with a Digital Certificate and your Client sits behind a Cable/DSL router or some other NAT device, you might not be able to connect to your VPN Gateway device (that is, the VPN 3000 Concentrator). The problem is not with the VPN Client or the Gateway; it is with the Cable/DSL router. When the VPN Client uses a Digital Certificate, it sends the Certificate to the VPN Gateway. Most of the time, the packet with the Certificate is too big for a standard Ethernet frame (1500), so it is fragmented. Many Cable/DSL routers do not transmit fragmented packets, so the connection negotiation fails (IKE negotiation).

This problem might not occur if the Digital Certificate you are using is small enough, but this is only in rare cases. This fragmentation problem happens with the D-Link DI-704 and many other Cable/DSL routers on the market. We have been in contact with a few of these vendors to try to resolve the issue.

Testing with the VPN Client Release 3.1 indicates that VPN Client connections using Digital Certificates can be made using the following Cable/DSL routers with the following firmware:

Linksys BEFSRxx v1.39 or v1.40.1

SMC 7004BR Barricade R1.93e

Nexland Pro400 V1 Rel 3M

NetGear RT314 V3.24(CA.0)

Asante FR3004 V2.15 or later

Others like 3COM 3C510, and D-Link DI-704 either had updated firmware that was tested and failed, or had Beta firmware that was NOT tested because the firmware notes did not indicate a fix specifically for fragmentation.

• CSCdu87521

The following message might appear when a connection using the EnterNet 300 version 1.4 PPPoE software and transferring via FTP:

93 09:42:06.020 08/02/01 Sev=Warning/2 IPSEC/0xE3700002

Function CniInjectSend() failed with an error code of 0xe4510000 (IPSecDrvCB:517)

This does not interfere with your connection. You can ignore this message.

• CSCdv40009

When Zone Alarm's Internet setting is set to high and the VPN Concentrator sends a CPP firewall policy that allows inbound traffic on a specific port, the CPP rule takes precedence over the Zone Alarm rule allowing the specified port to be open.

• CSCdv42414

Importing a PKCS12 (*.p12 or *.pfx) certificate using the Certificate Manager that has not been password protected will fail with the following error:

"Please make sure your import password and your certificate protection password (if for file based enrollment) are correct and try again."

Workaround:

Get a *.p12 certificate that has been password protected.

• CSCdv44529

Attempting to install/uninstall Gemplus Workstation version 2.x or earlier while the Cisco VPN Client and its GINA (csgina.dll) is installed will cause the following error, and Gemplus will not install/uninstall:

"A 3rd party GINA has been detected on your system. Please uninstall it before installing this product."

Workaround:

Do one of the following:

– Uninstall the VPN Client and reinstall it after Gemplus software.

or

– Use Gemplus version 3.0.30 that no longer installs the gemgina.dll

• CSCdv46591

When a CPP Firewall policy is in place that drops all inbound and outbound traffic and no WINS address is sent to the VPN Client from the 3000 series Concentrator, Start Before Logon fails. If a WINS address is in place, Start Before Logon works fine. Also, if a WINS address is sent and the CPP rule drops all inbound traffic, but allows all outbound traffic, Start Before Logon works fine.

• CSCdv46937

Using the Aladdin "R2" model etoken, certain functions can be performed using the certificate even after the R2 token has been detached from the system (USB port). The VPN Client, for instance, can perform an IKE rekey without the token attached to the system. The reason for this is the design of the "R2" etoken: it does not contain the RSA key functions needed and must upload the private key to the system for these functions.

In contrast, the Aladdin "PRO" etoken must be connected to the USB port during an IKE rekey, otherwise the VPN Client connection terminates. This is Aladdin's problem; it is not a VPN Client problem.

• CSCdv55730

Using the Solaris VPN Client, some applications are unable to operate properly. A possible indicator of the problem is that a large ping is unable to pass through the VPN Tunnel.

No problem exists when passing large packets using cTcp or normal IPSec. When using IPSec over UDP, Path MTU Discovery problems exist, as a result of which large packets cannot be transmitted.

An MTU issue currently exists with the Solaris VPN Client that causes fragmentation errors that might affect applications passing traffic through the VPN Tunnel.

To identify whether the VPN Client is properly fragmenting packets, use the following commands:

ping -n <known good ping target address>

ping -n -s <known good ping target address> 2500

The first command ensures that the target is reachable, and the second determines whether fragmentation is an issue

Workaround:

Step 1 Before opening the tunnel, bring down the MTU of the point-to-point interface to the MTU of the rest of the path to the concentrator (generally 1500). This would allow large packets to pass through, when using IPSec over UDP. No problems exist when using normal IPSec or cTcp.

Step 2 Set IP Compression to "LZS" in the VPN Group on the Concentrator. This decreases the size of the encrypted packet and might allow the smaller packet to avoid fragmentation. If you are using NAT, switching the NAT method of the client from cTCP (TunnelingMode=1) to UDP (TunnelingMode=0) might also reduce the size of the packet.

• CSCdv62613

When you have multiple VPN Client connections behind Linksys Cable/DSL router, the following problem can occur. Due to a Linksys problem with firmware versions 1.39 and 1.40.1, making multiple VPN Client connections enabling the feature "Allow IPSec over UDP" (transparent tunneling) may cause data transfer problems.

Allow IPSec over UDP is a VPN Client feature that allows ESP packets to be encapsulated in UDP packets so they traverse firewall and NAT/PAT devices. Some or all of the clients may not be able to send data. This is due to a Linksys port mapping problem, that Linksys has been notified of.

Workaround:

Use a newer version of Linksys code (higher than firmware version 1.40.1). If you must use one of the problem versions, do not use the "Allow IPSec over UDP" (transparent tunneling) feature when you have multiple VPN Client connections behind Linksys Cable/DSL router.

• CSCdv67594

The following Microsoft Outlook error might occur when the VPN Client connects or disconnects. This occurs when Microsoft Outlook is installed but not configured.

Either there is no default mail client or the current mail client cannot fulfill the messaging request. Pun Microsoft Outlook and set it as the default mail client.

To set Microsoft Outlook as the default mail client, right-click on the Outlook icon, go to Properties, and configure it to use Microsoft Exchange or Internet Mail.

• CSCdv73541

The make module process fails during installation of the VPN Client for Linux.

Workaround:

The module build process must use the same configuration information as your running kernel. To work around this problem, do one of the following:

– If you are running the kernels from Red Hat, you must install the corresponding kernel-sources rpm. On a Red Hat system with kernel-sources installed, there is a symlink from /lib/modules/2.4.2-2/build to the source directory. The VPN Client looks for this link first, and it should appear as the default value at the kernel source prompt.

– If you are running your own kernel, you must use the build tree from the running kernel to build the VPN Client. Merely unpacking the source code for the version of the kernel you are running is insufficient.

• CSCdw60866

Getting Entrust certificates using SCEP does not get the Root CA certificate. The Entrust CA does not send the whole certificate chain when enrolling with SCEP. Therefore, making a VPN Client connection might require the manual installation of the Root certificate before or after SCEP enrollment. Without the existence of the Root CA certificate, the VPN Client fails to validate the certificate and fails with the following VPN Client event/error messages:

"Get certificate validity failed"

"System Error: Unable to perform validation of certificate <certificate_name>."

• CSCdw73886

If an attempt to load the VPN Client is made before the Clients Service loads, the following error occurs: "The necessary VPN sub-system is not available. You will not be able to make a connection to the remote IPSec server."

Workaround:

Wait until the Service has loaded, then start the VPN Client.

• CSCdx04343

A customer had problems enrolling the Mac OS version of the VPN Client. Following some troublesome attempts at debugging the enrollment of the MacOS VPN Client with a Baltimore CA, it was felt that the Documentation should be improved and the Certificate Manager enhanced.

Workaround:

It seems that the critical thing as far as Baltimore is concerned is to put either or both of the challenge phrase (-chall) and the host's FQDN (-dn) in the request. This appears to be similar for the successful SCEP enrolment in a Verisign Onsite PKI. Perhaps there's a case for tweaking the interface a bit, or at least making some notes in the manual!

Just doing cisco_cert_mgr -U -op enroll only asks for a Common Name, which is not enough. The request that succeeded on two separate Baltimore installations, one of which had an expired RA certificate, was as follows (switches only shown for brevity):

cisco_cert_mgr -U -op enroll -cn -ou -o -c -caurl -cadn -chall -dn

The ou is required for connecting to a Cisco 3030 VPN Concentrator and is the group name. On almost every attempt, the certificate manager dies after starting to poll the CA, with an error in the log: "Could not get data portion of HTTP request".

If this happens, it is possible to resume the enrollment with cisco_cert_mgr -E -op enroll_resume. The last attempt didn't fail at all though, and the certificate manager kept running until the request was approved, which is how it should behave.

• CSCdx51632

If the computer is powered off or loses power during an MSI installation of the VPN Client, the VPN Client may not be registered in Control Panel, and the following may occur when attempting to reinstall:

– A message may appear stating:

Deterministic Network Enhancer Add Plugin Failed

Click the "OK" button.

– Error 1722. There is a problem with this Windows Installer package. A program as part of the setup did not finish as expected. Contact your Support personnel or package vendor. Click the "OK" button.

– Error 1101. Error reading from file c:\config.msi\laff4.rbs. Verify that the file exits and you can access it. Click the "OK" button.

– Error 1712. One or more of the files required to restore your computer to its previous state could not be found. Restoration is not possible. Click the "OK" button.

After clearing the last message box, restart MSI installation. It should successfully install the VPN Client.

• CSCdx70223

The VPN Client's xauth dialog always stays in the foreground so it doesn't get "lost" (on XP it goes to the background and then jumps forward within seconds). The xauth dialog does not have focus, however, and it can be difficult to enter the username/password without first clicking on it with the mouse. This was observed on Windows 2000 and Windows XP; we have not checked Windows 98.

• CSCdx72463

Installing the VPN Client using the Microsoft Windows Installer (MSI) displays "Time Remaining" for the installation. This time is not very accurate and should be ignored.

• CSCdx77292

Microsoft article Q234859 states that for the resiliency feature to work on Windows 4.0, IE 4.01 sp1 and shell32.dll version 4.72.3110.0 or greater must be installed on the computer.

• CSCdx78868

The Microsoft Installer (MSI) resiliency (self healing) feature does not restore all files that are installed with the VPN Client. The files that will be restored are files that are associated with the shortcuts under Start | Program Files | Cisco Systems VPN Client.

• CSCdx81491

An issue can occur when using the Release 4.0VPN Client with Start Before Logon (SBL), after enabling SBL. The first time you log out of Windows, the VPN Client does not load after you press the CTRL+ALT+DEL key combination at the Windows logon prompt.

Workaround

Reboot the PC after enabling Start Before Logon; after a subsequent logout, the VPN Client should operate properly.

• CSCdx88063

When attempting to launch the dialer when the dialer is already running on the logon desktop (due to SBL or SBL and AI), the following error occurs instead of the VPN Client dialer loading.

"Single dialer instance event creation failed with error 5."

This is most likely to happen when Start Before Logon and Auto Initiate are being used on Windows 2000 or XP.

Workaround

This is due to the fact that the VPN Client dialer is already running on the "logon desktop". Most likely during Windows logon the dialer launched and posted an error, the Windows logon was completed and the error was never closed. To work around this error, do the following:

Step 1 Press CTRL+ALT+DEL to get to the logon desktop.

Step 2 Look for and close any VPN Client error dialogs.

Step 3 Press ESC to return to the normal Windows desktop; the VPN Client should load normally.

• CSCdy14218

During installation of the VPN Client on a PC that already has the Enternet v.1.5c or v. 1.5c SP2, the following error might appear:

"SVCHOST.EXE has generated errors and will be closed by Windows."

Workaround:

If this message appears, click OK, then reboot the PC when the VPN Client prompts for the reboot. After this, The message does not reappear and all connections work fine.

• CSCdy50648

InstallShield's "Tuner" application produces warnings and errors when validating the Cisco MSI installation package.

• CSCdy68888

On a Windows 98 PC that has the Sygate Personal Firewall, the following message may appear in the VPN Client log file:

"Packet size greater than ip header"

This message does not interfere with the VPN Client's ability to pass data and can be ignored.

• CSCdy70168

A user with the VPN Client cannot establish an IPSec tunnel to a VPN Concentrator running over an Internet satellite connection.

There are three observed results:

– User is never prompted for XAUTH username and password.

– After successfully authenticating, the user cannot transmit/receive any data.

– After successfully transmitting data for approximately 5 minutes, the VPN session is disconnected regardless of the user activity at the time of disconnect.

This problem occurs only if IPSec over TCP is used.

Workaround:

Use IPSec over UDP.

• CSCdy79358

The following error might occur on Windows 98 when making many VPN connections without closing the VPN Client between connections:

VPNGUI caused an invalid page fault in module MSVCRT.DLL at 0167:78002f52.

To avoid this error, exit the VPN Client after disconnecting.

• CSCdz48584

The VPN Client on Windows XP using native XP PPPoE client fails to connect when using IPSec/TCP.

Workaround:

Make sure that the Windows XP Internet Connection Firewall is disabled for the PPPoE connection. This feature defaults to enabled when the connection entry is created. To disable it do the following.

Step 1 Run Control Panel, then click on Network Connections.

Step 2 Right click on the PPPoE connection entry (may be called "Broadband") and select "Properties".

Step 3 Change to the Advanced Tab and uncheck the "Internet Connection Firewall" option.

• CSCdz56076

Some AOL applications might not be usable while a 4.0 VPN Client connection is active. These include the AOL integrated web browser and some internal links. Using external web browsers and other applications should work over the VPN. These issues were seen most recently using AOL version 7.0 and 8.0.

• CSCdz71367

To connect to a VPN 3000 Concentrator requiring Sygate Personal Firewall, Sygate Personal Firewall Pro, using Are You There (AYT), the version of the firewall must be 5.0, build 1175 or later. The VPN Client might not detect an earlier version of the Sygate Personal Firewall and therefore, a connection will not be allowed.

• CSCdz74310

After upgrading, the VPN Client is unable to connect to the VPN 3000 Concentrator. The ability for the VPN Client to negotiate an AES-192 IKE Proposal has been removed. This change affects all VPN Client versions greater than 3.7.2.

Workaround

Reconfigure the VPN Concentrator so that it does not require an AES-192 IKE Proposal for VPN Client connections.

• CSCdz75892

The Equant remote access dialer does not automatically connect the Release 4.0 VPN Client, as it could when using the Release 3.x VPN Client. If you have the Equant dialer configured to establish your VPN connection, the VPN Client appears, but you must manually click Connect to connect. An updated, Cisco-specific .dll file is available from Equant to fix this problem.

• CSCdz87404

The 4.0 VPN Client (on Windows 2000 or Windows XP) connects but is unable to pass data over the VPN tunnel. Viewing the routing table using "route print" at a command prompt shows the default gateway has been modified incorrectly as in the example below.

0.0.0.0 255.255.255.255 n.n.n.n n.n.n.n 1

Where n.n.n.n is the IP address assigned to the VPN.

Workaround:

This is due to a misconfiguration on the VPN3000 at the central site. Make sure that the Group | Client Config settings for Split Tunneling Policy are correct. If the group is set to "Only tunnel networks in the list" and the Split Tunneling Network List is the predefined "VPN CLient Local LAN" list this problem will occur.

If split tunneling is the desired result, change the Split Tunneling Network List to an appropriate list, otherwise make sure that the Split Tunneling Policy is set to "Tunnel Everything" and check "Allow the networks in the list to bypass the tunnel". This allows for proper Local LAN functionality.

• CSCea03597

When the VPN Client is installed and Start before Logon is configured, logging into an Active Directory Domain might take a long time, with or without a VPN connection.

This issue occurs under the following conditions:

– The VPN Client is installed on Windows 2000 or Windows XP Professional.

– You have enabled "Start before Logon" in the VPN Client.

– You are logging into a Windows Active Directory domain (not an NT 4 Domain).

Workaround:

This problem occurs because of a fix that was added for CSCdu20804. This fix adds the following parameter to the registry every time Start before Logon is enabled:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NetLogon\Parameters

ExpectedDialupDelay

Removing "ExpectedDialupDelay" from the registry (then rebooting) should fix the problem with slow logons to an Active Directory Domain.

Note If you disable, then re-enable Start before Logon, this entry is added again and must be removed.

• CSCea16482

If the Digital Certificate you are using has expired, the Windows VPN Client GUI does not popup with an error message indicating it has expired. The only indication you have is in the log file.

A message does appear if you are using the VPN Client command line - vpnclient.exe

• CSCea17705

If a ZoneLabs product such as ZoneAlarm or ZoneAlarm Pro is installed on the PC and the VPN Client is installed or upgraded, ZoneAlarm blocks the VPN Client service (cvpnd.exe). The VPN Client's splash screen appears, but the GUI does not. ZoneAlarm does not ask the user whether to allow the VPN Client to access the Internet. Additionally, the following error appears after about two minutes:

"The necessary VPN sub-system is not available. You can not connect to the remote VPN server."

Workaround:

Do the following steps:

Step 1 Open the ZoneLabs product and select "Program Control".

Step 2 Click on the "Programs" Tab

Step 3 Cisco Systems VPN Client's Access permission is a ?. Click under "Trusted" and select "Allow". The ? mark changes change to a Check mark.

Step 4 Reboot the PC.

Step 5 When the PC boots back up, the client will launch normally.

• CSCea22557

When attempting to open the Mac VPN Client GUI, the application immediately quits. If the ipseclog is running before the GUI client starts, the application quits.

Workaround

If the ipseclog is running manually in a terminal window, terminate the log using ctrl-c.

If the GUI client had logging enabled and it quit unexpectedly for any reason, the ipseclog might still be running. In this case, open a terminal window and use "sudo killall -9 ipseclog" to terminate the process.

After the ipseclog has been stopped, the VPN Client should open normally.

• CSCea25682

The following Notification might occur if the Cisco Systems Integrated Client is required to make a connection.

"The Client did not match the firewall configured on the central site VPN device. Cisco Systems Integrated Client should be enabled or installed on your computer."

When this occurs, the connection is not allowed. If this Notification appears, click Close and attempt to reconnect. If this second attempt to connect fails, reboot the PC. The connection should succeed at this point.

• CSCea27524

This problem has two facets. You cannot select text from the VPN Client log tab, and trying to save the VPN Client log results in an empty (zero byte) file. This problem might occur if the VPN Client logging has been enabled, disabled, or cleared.

Workaround:

If the all or part of the log must saved, you can select the text with the mouse or by using CTRL+A, and then copy it using CTRL+C. You can then paste it as usual using CTRL+V in Notepad or your favorite editor.

As an alternative, the VPN Client log files are saved to the directory c:\Program Files\Cisco Systems\VPN Client\Logs by default and can be opened and viewed using a text editor and saved as a different name if needed.

• CSCea29976

After the user enters the username and password, the VPN Client machine might go blank for a moment and then continue. This behavior has not shown any negative effect on the tunnel connection or the user's ability to use the PC.

• CSCea62229

Using the 4.0 VPN Client with Entrust Entelligence certificates, the "Send CA Certificate Chain" option should be grayed out and unavailable, but it is not.

Workaround:

Checking the "Send CA Certificate Chain" option when using Entrust Entelligence certificates makes the VPN Client connection fail to complete, leave this option unchecked.

• CSCea63957

If you uninstall the VPN Client from a Windows 2000 or Windows XP Computer with RASPPPOE, the following message box might appear:

Failed to uninstall the Cisco Network Adaptor.

Error: 0xe000020b

Click OK. The Client uninstallation then continues normally.

• CSCea75956

The following problem has occurred with non-Windows VPN Clients. While connected to the VPN Client, DNS resolution to the internal network works at first but fails later in the connection.

If the workstation is set to use DHCP and receives a DNS address from the DHCP server, the new DNS overwrites the VPN Concentrator's pushed DNS that had been resolving internal network devices. Once the new DNS has overwritten the Concentrator-pushed DNS, internal devices are no longer resolved properly.

Workaround:

After connecting to the ISP, record the DNS addresses assigned by the DHCP server and hard code them into the workstation. This prevents the workstation from accepting the DHCP-pushed DNS addresses in the future but still allows resolution when not connected over VPN.

The drawback of this is that if the ISP changes their DNS server addresses, the user must find out the hard way and hard code these new addresses once more.

• CSCea92185

The PKCS#10 thumbprint for the certificate request is missing on 4.x VPN Client, so it is impossible for the CA to verify the user's request by comparing the thumbprint.

Workaround:

Downgrade to 3.6.X VPN Client.

• CSCeb48663

The `vpnclient stat firewall' command cannot be run while not connected. This command should return the state of the firewall at all times, not just when the VPN Client is connected.

• CSCeb83746

The following problem occurs when using the VPN Client, Release 4.0 running on MS Windows 2000 or Windows XP. After connecting, a "classfull" route is installed in the routing table, due to not receiving a subnet mask.

• CSCec00525

IPSec SA rekeying fails on VPN Client 4.0.2A/B. The VPN4.0.2A/B and IPSec SA Lifetime Measurement is configured as Data on the VPN 3000 Concentrator.

Workaround:

Use Time Lifetime on the VPN 3000 Concentrator.

• CSCec18923

After the Cisco VPN Client is connected, the PC stops receiving the local multicast traffic. The "Allow Local LAN Access" check box is checked, and the multicast addresses are also included in the bypass list on the VPN 3000 Concentrator.

• CSCec20680

The ForceNetLogin feature might not work properly with Entrust Intelligence client version 6.1

• CSCec22783

VPN Client sends the first esp packet after IKE negotiation is successful using an SPI number that doesn't exist. Then the central-site Concentrator sends back a delete notification, which the client ignores because the SPI doesn't actually exist in the VPN Client. This does not affect any functions.

• CSCec30347

A customer installed an RSA Keon CA server with root and subordinate CA. When we are using the VPN Client, Release 3.1 with the certificates, we can connect to VPN 3000 Concentrator running either 3.x or 4.0.1D (Concentrator code does not matter).

Once I upgrade the VPN Client to 3.6.x or 4.0.x, I can no longer get a connection to VPN 3000 Concentrator.

I play around all the settings including "check uncheck CA chain" on the Client end, as well as the Concentrator end, "Certificate Group Matching", IKE group 1 or group2, no matter what I do, it does not work.

Workaround:

Downgrade the VPN client to 3.1.

• CSCec47637

Using VPN Client version is 4.0.1 with a multiple-monitor display enabled on a Windows XP machine, the VPN Client authentication dialog box appears split between the two monitors rather than completely in one side or the other.

• CSCed05004

With the VPN Client, Release 4.0.x installed on a Windows XP (tablet edition) system, whenever the VPN dialer is opened we get an error "System Error: IPC Socket allocation failed with error ffffffff8h" and then it cannot go out to the DHCP server and get an ip address

• CSCed11256

When installing a customized VPN Client InstallPath, a pop-up box appears during the installation with the following message:

Usage:

VAInstaller i <INF Location> <HardwareID>

r <HardwareID>

f <HardwareID>

Options:

i - installs the Virtual Adapter

r - removes the Virtual Adapter

f - finds if the Virtual Adapter in installed

Workaround:

If the installation path includes $BASEDIR\Program Files\, then the InstallPath works.

• CSCed90732

Windows VPN Client version 4.0.3 fails to enroll with IOS CA server using SCEP. Other devices (PIX, IOS) enroll successfully.

The VPN Client does get the CA certificate installed but not the user certificate. The following error results:

error 42: unable to create certificate enrollment request

The Client log shows:

Could not find data portion of HTTP response from CEP server. Contact your CA administrator for further instructions.

Workaround:

Enroll via a pkcs10 requests.

• CSCee08782

Mac OS X VPN Client Release 4.0.3.E and higher no longer supports Mac OS X 10.1.5. VPN Client Release 4.0.2.C is the last released client compatible with Mac OS X 10.1.5.

Workaround:

Install the Mac OS X VPN Client Release 4.0.2.C.

• CSCee49392

Terminating the cvpnd or vpnclient process causes the VPN Client to claim that it is already connected. You should terminate the VPN Client connection only by using the vpnclient disconnect command.

Workaround:

Terminate any residual vpnclient and cvpnd processes that might still be running.

• CSCee68280

When attempting to tab through the options of a new profile, the Mutual Group Authentication button is never highlighted. It should be highlighted right after the Group Authentication button.

• CSCee74900

On a linux multiprocessor kernel the VPN Client seems to pass traffic much slower than on a single processor kernel with the same hardware.

In order to work with an SMP kernel the VPN Client was modified in such a way that the performance is lower than the same client run with a single processor kernel.

Workaround:

Use a single processor kernel with the VPN Client.

• CSCee93430

VPN client fails to connect to Virtual Cluster master real address. Client Firewall is enabled.

IPSec/TCP in use.

Workaround

Use IPSec/UDP, and Disable the firewall option on the client.

• CSCee95701

If the Microsoft Windows client dns-resolver tries to resolve an unqualified DNS request (for example, a request from client browser for http://local [see the scenario that follows]), it takes a long time (more than 15 seconds) to resolve the query.

Scenario:

DNS-SERVER (zone aa.com) local DNS-SERVER (zone bb.com)

| |

VPN-CONCENTRATOR--<INTERNET>--LOCAL-ROUTER---Server(local.bb.com)

| |

Server(intern.aa.com) VPN-CLient (split-dns-mode)

The delay is introduced, because VPN-client drops A-queries with split-dns suffix(aa.com) when sent to local DNS-Servers.

• CSCef51072

Problem after receiving a Novell log message using Internet Explorer browser proxy. Using the Windows 4.6 VPN Client, the client or service crashes soon after making a successful connection. The last log message from the client is "Novell not installed."

Workaround:

Go into Internet Explorer and uncheck the Proxy Server checkbox found under Internet Options | Connections | LAN Settings.

• CSCeg00709

Entrust certificates that do not expire until 2048 do not work with the VPN Client; it shows the expiry date as 1970. To fix this, the VPN Client needs to support 64-bit time fields.

• CSCeg13025

When using multi-tiered CA between the VPN Client and the IOS, the Client does not process both the x509 certs it has received.

Workaround

Make sure that the Client has the certificate chain for the Certificates the IOS device is sending.

• CSCeg24018

We have reproduced this in our lab using latest VPN client 4.0.5C, PIX 6.3.4, and IOS router 12.3(11)T

A Cisco VPN Client cannot connect to a PIX when using a Certificate issued by the Cisco IOS CA server.

In addition, a Cisco VPN Client cannot connect to a router when using a Certificate issued by the Cisco IOS CA server.

However, a PIX and a router using same Certificates can build LAN-to-LAN tunnels to each other.

• CSCeg24804

After making a VPN Client connection with split tunneling, traffic to a local NFS server that bypasses the tunnel does not work properly.

Files may be put onto the server while the tunnel is up, but getting files from the server fails with the following ipsec log message:

212 16:05:18.360 11/02/2004 Sev=Info/4 IPSEC/0x43700003

Receive: Could not find first fragment; packet dropped (Src:192.168.0.2 Id:29068 Offset:2960)

213 16:05:18.360 11/02/2004 Sev=Info/4 IPSEC/0x43700003

Receive: Could not find first fragment; packet dropped (Src:192.168.0.2 Id:29068 Offset:1480)

• CSCeg32621

VPN Client version 3.6.x connecting using IPSec/TCP, large cert, and send chain enabled fails to connect and causes IKE length errors. This occurs under the following conditions: connecting into an ASA device with 2048- or 4096-bit certs, sending chain, and IPSec/TCP

Workaround

Use smaller certs, don't send chain, install needed certs on both ends if possible.

• CSCeg36511

A VPN Client using large certs (2048 bit keys) and sending the cert chain fails to connect under the following conditions: connecting into a VPN 3000 Concentrator using a 2048 bit cert and with send chain configured.

• CSCeg56330

When using "start before logon", the Cancel connect button does not work.

Workaround

Use ctl-alt-del on the PC, login to the machine, then relaunch the VPN Client.

CSCeg82076

When connecting a Windows VPN Client, the pushed browser proxy settings are not applied when working under the following conditions.

When Fast User Switching is involved, the VPN Client attaches itself to the first user to use the VPN Client. If the workstation is then switched to another user and the VPN Client is run, the VPN Client attempts to adjust the registry for the original user to use the Browser Proxy pushed from the VPN Client; this fails.

Workaround

Avoid using Fast User Switching or stop the cvpnd service before leaving the previous user:

net stop cvpnd (old user)

net start cvpnd (new user)

Or reboot the workstation and log in as the new user.

• CSCeh11214

Mac OS X VPN Client fails to connect with Certs when Windows Clients connect with the same certs without a problem. A chained Identity Cert is in use on the Concentrator.

Workaround

Install an Identity Cert that is not chained.

• CSCeh12314

Windows 98 VPN Client 4.6.02.0011 does not display logging information in the GUI. The log file in the Log folder is created successfully.

Workaround

Review the log file from the Log folder for logging information.

• CSCeh15956

When the VPN Client launches the xauth application while using Radius w/ Expiry, if you delete the domain name field, the VPN Client might fail.

• CSCeh17548

VPN Client fails to connect over dialup with XP. Only XP and dialup exhibit the issue.

Workaround

Downgrade to the 4.6.01.0019 VPN Client.

• CSCeh20734

The following program error with dr.watson occurs when toggling back and forth between the simple mode to advanced mode:

vpngui.exe has generated errors and will be closed by Windows.

You will need to restart the program.

An error log is being created.

This symptom occurs on Windows 2000, SP4 with VPN Client release 4.6 (both IS and MSI).

Workaround:

Do not toggle back and forth from simple to advanced mode.

• CSCeh21310

Windows XP workstations with the built in firewall turned on seem to cause the VPN Client to disconnect if the KeepAlives are not turned on for the VPN Group or the Confidence Interval is set to 0, the Client cannot rekey properly through the XP built in firewall.

Workaround

Enable KeepAlives on the Concentrator with the default 30 second interval, lengthen the period of the IPSec rekey, or disable the built in XP firewall.

Alternatively, in the VPN Client profile, add the keyword "ForceNatT=1".

• CSCeh26526

Windows XP VPN Client disconnects for no reason. The Windows XP Integrated Firewall blocks rekey attempts from the Concentrator to the Client.

Workaround

In the VPN Group, turn on IKE Keepalives and set the Confidence Interval to 30 seconds. This is the default for the VPN 300 Concentrator.

Alternatively, configure the Windows XP Firewall to allow traffic from port 500.

• CSCeh54674

Running VPN-Client in a windows environment in combination with NAC, although start-before-logon is configured, logon-scripts might fail.

• CSCeh56322

After making a Windows VPN Client connection, all access to the local DHCP server is lost except for DHCP traffic. SSH, telnet, ping, http... all fail.

On the Windows Virtual Adapter, a route is placed so that DHCP can be renewed locally. This route bypasses the tunnel, but the VPN filter blocks all traffic types except for DHCP. This effectively cuts off all other communications to the DHCP server.

Workaround

Use split tunnels and exclude the DHCP server's address from being tunneled. This allows all traffic to the local DHCP server to be bypassed.

• CSCeh78592

The vpngui.exe process continuously runs, consuming memory on the PC if split tunneling is not configured.

Note This caveat is resolved in VPN Client for Windows, Release 4.8.01.0300.

• CSCei09677

When running Integrity Desktop v5.1.556.187 and VPN Client v4.6.03.21 on the same Windows machine, both applications function as expected. The VPN Client uninstalls as expected, but the uninstall of Integrity Desktop hangs

• CSCei11378

When attempting to start the VPN Client log using the GUI, the following error appears in the log:

Error 47: Failed to load ipseclog.exe

This affects all Mac OS X versions.

Workaround:

Click the Enable log button a second time to start the log.

• CSCei30835

In rare situations, the GUI stops responding. W