UniOTP VPN Solution: Difference between revisions
No edit summary |
mNo edit summary |
||
| Line 4: | Line 4: | ||
== Note == | == Note == | ||
The following steps apply to Windows Server 2003 and Windows XP where relevant. For recent versions of Windows, the steps below may be differ slightly. | |||
== About This Guide == | == About This Guide == | ||
| Line 10: | Line 10: | ||
<!--Check server-client noun--> | <!--Check server-client noun--> | ||
VPN (Virtual Private Network) refers to a computer and firewall with VPN capability that can establish a secure tunnel between the server and a client over the internet. In the tunnel initiator (server), the user's private data is encapsulated and encrypted and then transmitted through the internet; on the receiver side (client), the received data is unpacked and decrypted. VPN services are installed with Windows 2000/2003. This manual is based on the installed VPN service, named "Routing and Remote Access". This service can be found from [Start], [All Programs], [Administrative Tools], [Services]. | |||
== Routing and Remote Access Configuration == | == Routing and Remote Access Configuration == | ||
From [Start], [All Programs], [Administrative Tools], [Routing and Remote Access], open the Routing and Remote Access control panel. Right-Click on Routing and Remote Access] on the left-side of the panel, then select [Add server] to add a VPN server. | |||
[[Image:vpnsol img01.jpg|370px]] | [[Image:vpnsol img01.jpg|370px]] | ||
Right click on the newly-added server and select [Configure and Enable Routing and Remote Access]. If the Windows Firewall/Internet Connection Sharing (ICS) service is enabled, the Routing and Remote Access service cannot be turned on, and an ICS service warning message will appear. Configure the ICS service to allow the above operation, then redo the above steps. After Routing and Remote Access is enabled, the following configuration wizard will appear. | |||
In the "Routing and Remote Access Server Setup Wizard" window, under the "Configuration" step, select [Remote access (dial-up or VPN)] then click [Next]. | |||
[[Image:vpnsol img02.jpg|370px]] | [[Image:vpnsol img02.jpg|370px]] | ||
On the "Remote Access" step, select [VPN] then click [Next]. | |||
[[Image:vpnsol img03.jpg|370px]] | [[Image:vpnsol img03.jpg|370px]] | ||
Click [Finish] after completing the remainder of the wizard to complete the VPN installation. | |||
== Configuring the VPN Server with UniOTP == | == Configuring the VPN Server with UniOTP == | ||
After successfully setting up and configuring the VPN Server, open [Start], [All Programs], [Administrative Tools] and open the Routing and Remote Access control panel. | |||
[[Image:vpnsol img06.jpg|370px]] | [[Image:vpnsol img06.jpg|370px]] | ||
In the "Routing and Remote Access" window, right-click on the respective server from the directory list and select [Properties]. | |||
[[Image:vpnsol img07.jpg|370px]] | [[Image:vpnsol img07.jpg|370px]] | ||
In the Properties window, select the [Security] tab, and under "Authentication provider", select [RADIUS Authentication] from the drop-down menu. | |||
[[Image:vpnsol img08.jpg|370px]] | [[Image:vpnsol img08.jpg|370px]] | ||
Click on [Configure] to configure the RADIUS Authentication server. In the configuration panel, click on [Add] to add a Radius authentication server. | |||
[[Image:vpnsol img09.jpg|370px]] | [[Image:vpnsol img09.jpg|370px]] | ||
Under the "Add RADIUS Server" window, fill in the UniOTP authentication server name and server details. Afterwards, click on [Change] next to "Secret" to change the RADIUS communication shared key. | |||
[[Image:vpnsol img10.jpg|370px]] | [[Image:vpnsol img10.jpg|370px]] | ||
In the "Change Secret" window, configure the communication shared key, then click [OK]. | |||
[[Image:vpnsol img11.jpg|370px]] | [[Image:vpnsol img11.jpg|370px]] | ||
The RADIUS Authentication window should now a indicate a Radius server has been added. Click on [OK] to save authentication server configuration. | |||
[[Image:vpnsol img12.jpg|370px]] | [[Image:vpnsol img12.jpg|370px]] | ||
Returning to the Properties window, click on [Authentication Methods]. | |||
[[Image:vpnsol img13.jpg|370px]] | [[Image:vpnsol img13.jpg|370px]] | ||
In the "Authentication Methods" window, check the checkboxes [Extensible authentication protocol (EAP)], [Encrypted authentication (CHAP)] and [Unencrypted password (PAP)]. | |||
''Please Note: Authentication methods [Microsoft encrypted authentication version 2 (MS-CHAP v2)], [Microsoft encrypted authentication (MS-CHAP)] and [Shiva Password Authentication Protocol (SPAP)] are not supported.'' | |||
Click on [OK] to apply settings and exit the window. | |||
[[Image:vpnsol img14.jpg|370px]] | [[Image:vpnsol img14.jpg|370px]] | ||
To apply configuration changes, restart the VPN server by right-clicking the server, selecting [All Tasks], [Restart]. | |||
[[Image:vpnsol img15.jpg|370px]] | [[Image:vpnsol img15.jpg|370px]] | ||
| Line 77: | Line 76: | ||
== Add VPN Client == | == Add VPN Client == | ||
Open the Network Connections control panel found in the Control Panel. | |||
[[Image:Vpnsol img16.jpg|370px]] | [[Image:Vpnsol img16.jpg|370px]] | ||
On the left-hand side, under "Network Tasks", click on "Create a new connection". | |||
[[Image:Vpnsol img17.jpg|370px]] | [[Image:Vpnsol img17.jpg|370px]] | ||
A "New Connection Wizard" window will appear. On the "Network Connection Type" step, select [Connect to the network at my workplace], then click [Next]. | |||
[[Image:Vpnsol img18.jpg|370px]] | [[Image:Vpnsol img18.jpg|370px]] | ||
On the "Network Connection" step, select [Virtual Private Network connection], then click [Next]. | |||
[[Image:Vpnsol img19.jpg|370px]] | [[Image:Vpnsol img19.jpg|370px]] | ||
On the "VPN Server Selection" step, enter the host name or IP address of the VPN to connect to, then click [Next]. | |||
[[Image:Vpnsol img20.jpg|370px]] | [[Image:Vpnsol img20.jpg|370px]] | ||
If you wish, you can choose to [Add a shortcut to this connection to my desktop] on the final step, then click [Finish] to complete the wizard. | |||
[[Image:Vpnsol img21.jpg|370px]] | [[Image:Vpnsol img21.jpg|370px]] | ||
When attempting to connect to the VPN server, a connection window similar to the window below will appear. | |||
[[Image:Vpnsol img22.jpg|370px]] | [[Image:Vpnsol img22.jpg|370px]] | ||
| Line 107: | Line 106: | ||
<!--Check--> | <!--Check--> | ||
If you have added a VPN access user, and bound this user to a dynamic token, you can use that dynamic password and PIN (if OTP+PIN authentication method has been selected) to connect to the VPN. When following this manual, a Guest account has been added to VPN Server and to the UniOTP dynamic password authentication system, therefore Guest and OTP + PIN (for Guest account the authentication method is OTP + PIN) need to be filled into this window. Please Click "Connect" | |||
[[Image:Vpnsol img23.jpg|370px]] | [[Image:Vpnsol img23.jpg|370px]] | ||
The following error may happen: | |||
[[Image:Vpnsol img24.jpg|370px]] | [[Image:Vpnsol img24.jpg|370px]] | ||
To solve this error, please click "Properties" | |||
[[Image:Vpnsol img25.jpg|370px]] | [[Image:Vpnsol img25.jpg|370px]] | ||
Unselect "Require data encryption", click on "OK", and click "Connect" to start connection again. | |||
[[Image:Vpnsol img26.jpg|370px]] | [[Image:Vpnsol img26.jpg|370px]] | ||
After connecting to VPN server successfully, on the lower right corner of the screen, the following information will appear indicating that the configuration of VPN with UniOTP authentication has been completed successfully. | |||
[[Image:Vpnsol img27.jpg|300px]] | [[Image:Vpnsol img27.jpg|300px]] | ||
== Appendix == | == Appendix == | ||
==== Common errors upon VPN clients connecting to the server ==== | ==== Common errors upon VPN clients connecting to the server ==== | ||
| Line 152: | Line 152: | ||
| Mostly it is caused by VPN configuration problem, such like PPP configuration, unsupported or bad supported MPPE.<br> | | Mostly it is caused by VPN configuration problem, such like PPP configuration, unsupported or bad supported MPPE.<br> | ||
|} | |} | ||
Revision as of 13:51, 17 August 2012
Note
The following steps apply to Windows Server 2003 and Windows XP where relevant. For recent versions of Windows, the steps below may be differ slightly.
About This Guide
VPN (Virtual Private Network) refers to a computer and firewall with VPN capability that can establish a secure tunnel between the server and a client over the internet. In the tunnel initiator (server), the user's private data is encapsulated and encrypted and then transmitted through the internet; on the receiver side (client), the received data is unpacked and decrypted. VPN services are installed with Windows 2000/2003. This manual is based on the installed VPN service, named "Routing and Remote Access". This service can be found from [Start], [All Programs], [Administrative Tools], [Services].
Routing and Remote Access Configuration
From [Start], [All Programs], [Administrative Tools], [Routing and Remote Access], open the Routing and Remote Access control panel. Right-Click on Routing and Remote Access] on the left-side of the panel, then select [Add server] to add a VPN server.
Right click on the newly-added server and select [Configure and Enable Routing and Remote Access]. If the Windows Firewall/Internet Connection Sharing (ICS) service is enabled, the Routing and Remote Access service cannot be turned on, and an ICS service warning message will appear. Configure the ICS service to allow the above operation, then redo the above steps. After Routing and Remote Access is enabled, the following configuration wizard will appear.
In the "Routing and Remote Access Server Setup Wizard" window, under the "Configuration" step, select [Remote access (dial-up or VPN)] then click [Next].
On the "Remote Access" step, select [VPN] then click [Next].
Click [Finish] after completing the remainder of the wizard to complete the VPN installation.
Configuring the VPN Server with UniOTP
After successfully setting up and configuring the VPN Server, open [Start], [All Programs], [Administrative Tools] and open the Routing and Remote Access control panel.
In the "Routing and Remote Access" window, right-click on the respective server from the directory list and select [Properties].
In the Properties window, select the [Security] tab, and under "Authentication provider", select [RADIUS Authentication] from the drop-down menu.
Click on [Configure] to configure the RADIUS Authentication server. In the configuration panel, click on [Add] to add a Radius authentication server.
Under the "Add RADIUS Server" window, fill in the UniOTP authentication server name and server details. Afterwards, click on [Change] next to "Secret" to change the RADIUS communication shared key.
In the "Change Secret" window, configure the communication shared key, then click [OK].
The RADIUS Authentication window should now a indicate a Radius server has been added. Click on [OK] to save authentication server configuration.
Returning to the Properties window, click on [Authentication Methods].
In the "Authentication Methods" window, check the checkboxes [Extensible authentication protocol (EAP)], [Encrypted authentication (CHAP)] and [Unencrypted password (PAP)]. Please Note: Authentication methods [Microsoft encrypted authentication version 2 (MS-CHAP v2)], [Microsoft encrypted authentication (MS-CHAP)] and [Shiva Password Authentication Protocol (SPAP)] are not supported. Click on [OK] to apply settings and exit the window.
To apply configuration changes, restart the VPN server by right-clicking the server, selecting [All Tasks], [Restart].
Add VPN Client
Open the Network Connections control panel found in the Control Panel.
On the left-hand side, under "Network Tasks", click on "Create a new connection".
A "New Connection Wizard" window will appear. On the "Network Connection Type" step, select [Connect to the network at my workplace], then click [Next].
On the "Network Connection" step, select [Virtual Private Network connection], then click [Next].
On the "VPN Server Selection" step, enter the host name or IP address of the VPN to connect to, then click [Next].
If you wish, you can choose to [Add a shortcut to this connection to my desktop] on the final step, then click [Finish] to complete the wizard.
When attempting to connect to the VPN server, a connection window similar to the window below will appear.
If you have added a VPN access user, and bound this user to a dynamic token, you can use that dynamic password and PIN (if OTP+PIN authentication method has been selected) to connect to the VPN. When following this manual, a Guest account has been added to VPN Server and to the UniOTP dynamic password authentication system, therefore Guest and OTP + PIN (for Guest account the authentication method is OTP + PIN) need to be filled into this window. Please Click "Connect"
The following error may happen:
To solve this error, please click "Properties"
Unselect "Require data encryption", click on "OK", and click "Connect" to start connection again.
After connecting to VPN server successfully, on the lower right corner of the screen, the following information will appear indicating that the configuration of VPN with UniOTP authentication has been completed successfully.
Appendix
Common errors upon VPN clients connecting to the server
| Error Code |
Reason |
| 800 |
Unable to establish the VPN connection. The VPN server may be un-reachable, or security parameters may not be configured properly for this connection |
| 619 |
In most cases, it is caused by that the NAT-T function used for client to connect to internet is turned off or bad VPN support that does not support NAT-T in GRE and PPTP protocol. To solve this problem, you can turn on the gateway’s NAT-T. If this error happens frequently, please change the gateway equipment. |
| 721 |
In most cases, this problem is caused by client system. If users are using Windows XP SP2, this problem may happens, and you can solve it through modifying registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\<000x>. <000x> is the network adapter of the Satellite WAN port (PPTP) driver. In this key, create a new DWORD value, name ValidataAddress and value 0. If the configuration of the PPP protocol on the server is not correct, it will cause this problem as well. |
| 718 |
Wrong user name or password when dial-up, or authentication service errors occur on authentication server. |
| 734 |
Mostly it is caused by VPN configuration problem, such like PPP configuration, unsupported or bad supported MPPE. |
