UniOTP VPN Solution

ABOUT THIS GUIDE

VPN (Virtual Private Network) refers to two different equipment (a computer and firewall) with VPN link capability which can form a secure tunnel over the internet. In the tunnel initiator (server), A user’s private data is encapsulated and encrypted, and then transmitted on the internet; in the receiver side (client), the received data is unpacked and decrypted. VPN services are installed with Windows 2000/2003. This manual is based on the installed VPN service, named Routing and Remote Access. You can find this service from Start→Program→Administrative Tools→Service.

ROUTING & REMOTE ACCESS

From Start→Program→Administrative Tools→Routing and Remote Access, please open the Routing and Remote Access panel. Right-Click on “Routing and Remote Access” on the left-side of the panel, please select “add server” to add a VPN server.

Right click on the added server, and select “Configure and Enable Routing and Remote Access”. If the Windows Firewall/Internet Connection Sharing (ICS) service is enabled, the Routing and Remote Access service cannot be enabled, and an ICS service warning message will appear. Disable the ICS service and redo the above operation. After turning on Routing and Remote Access, the following configuration wizard will appear.

Select Remote access (dial-up or VPN) and click next to get into the next page.

Finish VPN installation. The next step is configuration.

ENVIRONMENT CONFIGURATION

Right-click on the directory tree in the server name, select property and switch to the IP address tab.

If the connection is broadband routing, it is not necessary to modify the configurations in this page.

Using a static address pool will reduce the time to resolve an IP address, and will increase network speed

VPN SERVER WITH UNIOTP

After building a VPN Server successfully, open the Start→program→administrative Tools and open the Routing and Remote Access control panel.

Right-click on SECU-CA (local) and select property

Select security tab, and in the authentication provider (H) list, select “Radius authentication”. The “Configure” button will now become available as the following picture shows.

Please click on the “Configure” button to configure the Radius authentication server. The configuration panel appears.

Click on “Add” button to add a Radius authentication server.

In the following configuration panel, fill the UniOTP authentication server address in Server name.

Click on “Change” to change the Radius communication shared key. As with the following picture, please configure the communication shared key

Click on “OK” and the following content should appear indicating a Radius authentication server has been added. Click on “OK” to exit authentication server configuration.

Click on “Authentication Methods” button, as in the following picture:

In the “Authentication Methods” control panel select “Extensible authentication protocol (EAP)”, “Encrypted authentication (CHAP)” and “Unencrypted password (PAP)”.

After configuration, click on OK →Apply and exit the control panel.

Please note: “MS CHAP v2”, “MS-CHAP” and “SPAP” authentication methods are not supported.

To enable new configurations, restart VPN server.

ADD VPN CLIENT

Right click on the Network icon to open network connection control panel.

Clicking on “Create a new connection”, a set up window will pop up.

Select “Connect to the network at my workplace”, and then click “Next”

Select “Virtual Private Network connection”, and then click on “Next”

Enter the VPN name or IP address, and click on “Next”.

You can choose “Add a shortcut to this connection to my desktop” in the following window and click “Finish”.

After configuration, a window will appear.

If you have added a VPN access user, and bound this user to a dynamic token, you can use that dynamic password and PIN (if OTP+PIN authentication method has been selected) to connect to the VPN. When following this manual, a Guest account has been added to VPN Server and to the UniOTP dynamic password authentication system, therefore Guest and OTP + PIN (for Guest account the authentication method is OTP + PIN) need to be filled into this window. Please Click “Connect”

The following error may happen:

To solve this error, please click “Properties”

Unselect “Require data encryption”→click on “OK”, and click “Connect” to start connection again.

After connecting to VPN server successfully, on the lower right corner of the screen, the following information will appear indicating that the configuration of VPN with UniOTP authentication has been completed successfully.