UniOTP VPN Solution

About this Guide

VPN (Virtual Private Network) refers to two different equipment (a computer and firewall) with VPN link capability that can establish a secure tunnel between the server and a client over the internet. In the tunnel initiator (server), the user's private data is encapsulated and encrypted and then transmitted through the internet; on the receiver side (client), the received data is unpacked and decrypted. VPN services are installed with Windows 2000/2003. This manual is based on the installed VPN service, named "Routing and Remote Access". You can find this service from [Start] → [All Programs] → [Administrative Tools] → [Service].

Routing and Remote Access

From [Start] → [All Programs] → [Administrative Tools] → [Routing and Remote Access], please open the Routing and Remote Access panel. Right-Click on "Routing and Remote Access" on the left-side of the panel, please select "Add server" to add a VPN server.

Right click on the newly-added server and select "Configure and Enable Routing and Remote Access". If the Windows Firewall/Internet Connection Sharing (ICS) service is enabled, the Routing and Remote Access service cannot be turned on, and an ICS service warning message will appear. Configure the ICS service to allow then redo the above operation. After Routing and Remote Access is enabled, the following configuration wizard will appear.

Select [Remote access (dial-up or VPN)] then click [Next].

Finish VPN installation. The next step is configuration.

Environment Configuration

Right-click on the directory tree in the server name, select property and switch to the IP address tab.

If the connection is broadband routing, it is not necessary to modify the configurations in this page.

Using a static address pool will reduce the time to resolve an IP address, and will increase network speed

VPN Server with UniOTP

After building a VPN Server successfully, open the Start→program→administrative Tools and open the Routing and Remote Access control panel.

Right-click on SECU-CA (local) and select property

Select security tab, and in the authentication provider (H) list, select “Radius authentication”. The “Configure” button will now become available as the following picture shows.

Please click on the “Configure” button to configure the Radius authentication server. The configuration panel appears.

Click on “Add” button to add a Radius authentication server.

In the following configuration panel, fill the UniOTP authentication server address in Server name.

Click on “Change” to change the Radius communication shared key. As with the following picture, please configure the communication shared key

Click on “OK” and the following content should appear indicating a Radius authentication server has been added. Click on “OK” to exit authentication server configuration.

Click on “Authentication Methods” button, as in the following picture:

In the “Authentication Methods” control panel select “Extensible authentication protocol (EAP)”, “Encrypted authentication (CHAP)” and “Unencrypted password (PAP)”.

After configuration, click on OK →Apply and exit the control panel.

Please note: “MS CHAP v2”, “MS-CHAP” and “SPAP” authentication methods are not supported.

To enable new configurations, restart VPN server.

Add VPN Client

Right click on the Network icon to open network connection control panel.

Clicking on “Create a new connection”, a set up window will pop up.

Select “Connect to the network at my workplace”, and then click “Next”

Select “Virtual Private Network connection”, and then click on “Next”

Enter the VPN name or IP address, and click on “Next”.

You can choose “Add a shortcut to this connection to my desktop” in the following window and click “Finish”.

After configuration, a window will appear.

If you have added a VPN access user, and bound this user to a dynamic token, you can use that dynamic password and PIN (if OTP+PIN authentication method has been selected) to connect to the VPN. When following this manual, a Guest account has been added to VPN Server and to the UniOTP dynamic password authentication system, therefore Guest and OTP + PIN (for Guest account the authentication method is OTP + PIN) need to be filled into this window. Please Click “Connect”

The following error may happen:

To solve this error, please click “Properties”

Unselect “Require data encryption”→click on “OK”, and click “Connect” to start connection again.

After connecting to VPN server successfully, on the lower right corner of the screen, the following information will appear indicating that the configuration of VPN with UniOTP authentication has been completed successfully.

Appendix

Common errors upon VPN clients connecting to the server

Error Code	Reason
800	Unable to establish the VPN connection. The VPN server may be un-reachable, or security parameters may not be configured properly for this connection
619	In most cases, it is caused by that the NAT-T function used for client to connect to internet is turned off or bad VPN support that does not support NAT-T in GRE and PPTP protocol. To solve this problem, you can turn on the gateway’s NAT-T. If this error happens frequently, please change the gateway equipment.
721	In most cases, this problem is caused by client system. If users are using Windows XP SP2, this problem may happens, and you can solve it through modifying registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\<000x>. <000x> is the network adapter of the Satellite WAN port (PPTP) driver. In this key, create a new DWORD value, name ValidataAddress and value 0. If the configuration of the PPP protocol on the server is not correct, it will cause this problem as well.
718	Wrong user name or password when dial-up, or authentication service errors occur on authentication server.
734	Mostly it is caused by VPN configuration problem, such like PPP configuration, unsupported or bad supported MPPE.