Using VPN Connections

This section reviews how to use the VPN connections.

• Adding a VPN Connection
• Making VPN Connections
• Disabling a VPN Connection

Adding a VPN Connection

Adding a new VPN connection is easy because SonicWall’s Client Policy Provisioning automatically provides all the necessary configuration information to make a secure connection to the local or remote network. The burden of configuring the VPN connection parameters is removed.

This section describes how to use the New Connection wizard to create and save a VPN connection. The wizard automatically downloads a VPN connection policy over a secure IPsec VPN tunnel from a local or remote SonicWall VPN gateway .

If a default.rcf file is included with the downloaded Global VPN Client software, the VPN policy configured by you is used to create a connection automatically when the client software is installed.

To add a VPN connection using the New Connection Wizard

1. Choose Start > Programs > Global VPN Client. The first time you open the Global VPN Client, the New Connection Wizard launches automatically.

   If the New Connection Wizard does not display, click the New Connection button to launch it.

   

2. Click Next to display the New Connection page.

   

3. Enter the IP address or FQDN of the gateway in the IP Address or Domain Name field. That information also appears in the Connection Name field.
4. If you want a unique name for the connection, add the name in the Connection Name field.

5. Click Next. The Completing the New Connection Wizard page displays.

   

6. If you want to customize your connection, select one or both of these options:

   • Select Create a desktop shortcut for this connection to create a shortcut icon on your desktop for this VPN connection.
   • Select Enable this connection when the program is launched if you want to automatically establish this VPN connection when you launch the Global VPN Client.
7. Click Finish. The new VPN connection appears in the Global VPN Client window.

Making VPN Connections

Making a VPN connection from the Global VPN Client is easy because the configuration information is managed by the VPN gateway. The system administrator for the gateway sets the parameters for what is allowed and not allowed with the VPN connection. For example, the administrator may choose to not allow multiple VPN connections or the ability to access the Internet or local network while the VPN connection is enabled.

The Global VPN Client supports two IPsec authentication modes:

• IKE using Preshared Secret
• IKE using 3rd Party Certificates.

Pre-Shared Secret is the most common form of the IPsec authentication modes, but if your VPN connection policy uses 3rd party certificates, you use the Certificate Manager to configure the Global VPN Client to use digital certificates.

A Pre-Shared Key (also called a Shared Secret) is a predefined password that the two endpoints of a VPN tunnel use to set up an IKE (Internet Key Exchange) security association. This field can be any combination of alphanumeric characters with a minimum length of 4 characters and a maximum of 128 characters. Your Pre-Shared Key is typically configured as part of your Global VPN Client provisioning. If it is not, you are prompted to enter it before you log on to the remote network.

• Enabling a VPN Connection

• Entering a Pre-Shared Key

• Selecting a Certificate

• Connection Warning

Enabling a VPN Connection

Enabling a VPN connection with the Global VPN Client is a transparent two-phase process. Phase 1 enables the connection, which completes the ISAKMP (Internet Security Association and Key Management Protocol) negotiation. Phase 2 is IKE (Internet Key Exchange) negotiation, which establishes the VPN tunnel for sending and receiving data.

When you enable a VPN connection, the following information is displayed in the Status column of the Global VPN Client window:

• Disabled changes to Connecting.
• Connecting changes to Authenticating when the Enter Username/Password dialog displays.
• Authenticating changes to Connecting when the user enters the username and password.
• Connecting changes to Provisioning.
• Provisioning changes to Connected once the VPN connection is fully established. A green checkmark displays on the VPN connection icon.

When the VPN connection is established, a pop-up notification from the Global VPN Client system tray icon displays the Connection Name, Connected to IP address, and Virtual IP Address.

If an error occurs during the VPN connection, Error appears in the Status column, and an error mark (a red X) appears on the VPN Connection icon. A VPN connection that does not successfully complete all Phase 2 connections displays a yellow warning symbol on the Connection icon.

For more information view the Administration Guide on the SonicWall Support Portal at: GVC Administration Guide

To establish a VPN connection using a connection policy you created in the Global VPN Client

If you selected Enable this connection when the program is launched, the VPN connection is automatically enabled when you launch the Global VPN Client.

1. Launch the Global VPN Client from the Windows Start button or from your shortcut. The Global VPN Client window displays.

   

2. If your VPN connection is not automatically established when you launch the Global VPN Client, choose one of the following methods to enable a VPN connection:

   • Double-click the VPN connection.
   • Right-click the VPN connection icon and select Enable from the menu.
   • Select the VPN connection and press Ctrl+B.
   • Select the VPN connection, and click the Enable button on the toolbar.
   • Select the VPN connection, and then choose File > Enable.
   • If the Global VPN Client icon is displayed in the system tray, right-click the icon and then select Enable > <connection name>. The Global VPN Client enables the VPN connection without opening the Global VPN Client window.

3. In the Enter Username / Password dialog box, type your username and password.

   

4. Click OK to continue establishing your VPN connection.

   Depending on the attributes for the GroupVPN policy on the SonicWall security appliance, the Enter Pre-Shared Key or theSelect Certificate dialog may be displayed. See the following sections for more information on those features.

5. Click OK.

If the VPN connection policy allows only traffic to the gateway, the Connection Warning message appears, warning you that only network traffic destined for the remote network at the other end of the VPN tunnel is allowed. The Connection Warning section provides more information.

Entering a Pre-Shared Key

Depending on the attributes for the VPN connection, if no default Pre-Shared Key is used, you must have a Pre-Shared Key provided by the gateway administrator to make your VPN connection. If the default Pre-Shared Key is not included as part of the connection policy download or file, the Pre-Shared Key dialog appears, prompting you for the Pre-Shared key before establishing the VPN connection.

To enter a Pre-Shared Key

1. Type your Pre-Shared Key in the Pre-shared Key field.

   To make sure you are entering the correct Pre-Shared Key, select Don’t hide the pre-shared key. The Pre-Shared Key you enter appears unmasked in the Pre-shared Key field.

   If you select this option, be sure to clear it after you verify the Pre-Shared Key.

2. Click OK.

Selecting a Certificate

If the SonicWall VPN Gateway requires a Digital Certificate to establish your identity for the VPN connection, the Select Certificate dialog appears. This dialog lists all the available certificates installed on your Global VPN Client.

To select a certificate

1. Select the certificate from the drop-down menu.

2. If you need to import the certificate into the Global VPN Client, click Import Certificate to get the certificate.

3. Click OK.

Connection Warning

If the VPN connection policy allows only traffic to the gateway, the Connection Warning message appears. It notes that only network traffic destined for the remote network at the other end of the VPN tunnel is allowed. Any network traffic destined for local network interfaces and the Internet is blocked.

You can disable the Connection Warning message from displaying every time you enable the VPN connection:

1. Select If yes, don’t show this dialog box again.
2. Click Yes to continue with establishing your VPN connection.

Disabling a VPN Connection

Disabling a VPN connection terminates the VPN tunnel. You can disable a VPN connection using one of these methods:

• Right-click the VPN connection in the Global VPN Client window, and select Disable.
• Right-click the Global VPN Client icon on the system tray, and choose Disable > <select connection>.
• Select the connection, then press Ctrl+B.
• Select the connection, and click the Disable button on the toolbar in the Global VPN Client window.