Virtual Private Network

Virtual Private Network (VPN)

VPN Troubleshooting

User Guide

Release Date: 4/3/07

GDLS – Virtual Private Network (VPN)

Copyright © 2006 Computer Science Corporation at General Dynamics Land Systems. All rights reserved. No part of this publication may be reproduced or used in any form or by any means—graphic, electronic, or mechanical, including photocopying, recording, taping, or in information storage and retrieval systems—without written permission from the publisher.

For internal distribution only.

Table of Contents What is VPN? ............................................................................................................................ 1 How to Get Help ........................................................................................................................ 1

Online Help......................................................................................................................... 1 Help Desk........................................................................................................................... 1

Review Wireless Internet Connection Settings .......................................................................... 1 Verify Wireless Card is Enabled............................................................................................. 2

Enable or Disable Wireless Card........................................................................................ 3 Verify Wireless Network Settings ........................................................................................... 3 Verify Wireless Network Connection...................................................................................... 6

Select Wireless Network..................................................................................................... 6 Refresh Wireless Network .................................................................................................. 8 Configure Wireless Network ............................................................................................. 10

Review VPN Settings .............................................................................................................. 12 Verify you have an Internet Connection ............................................................................... 13 Verify IP Address ................................................................................................................. 14

Error Resolution ............................................................................................................... 15 Verify Certificate was Imported ............................................................................................ 16 Verify Certificate................................................................................................................... 17

Possible Error Messages.................................................................................................. 18 Verify Group and Certificate Authentication ......................................................................... 19

Group Authentication........................................................................................................ 19 Certificate Authentication.................................................................................................. 21

Verify Password ................................................................................................................... 22 Restore Original Password............................................................................................... 24

Verify Window Logon Properties.......................................................................................... 24 Verify Internet Settings......................................................................................................... 25 Verify Network Selected....................................................................................................... 27 Verify Network Drives are Mapped ...................................................................................... 28

VPN Client Error Resolution .................................................................................................... 29 Error Message: Warning 204: Certificate could not be found............................................... 30 Error Message: Reason 403: Unable to contact the security gateway................................. 30 Error Message: Reason 412 or 414: The remote peer is no longer responding................... 30

VPN Frequently Asked Questions ........................................................................................... 31 How do I log onto VPN prior to logging into Windows?........................................................ 31 I cannot access the network using my selected default connection, what do I do?.............. 31 How do I enable my SecurID card and access VPN? .......................................................... 32 The portal is asking for an ID and password, Why? What do I enter? ................................. 32 I cannot access a document on the U drive, what do I do?.................................................. 33 My network drives are mapped, but I can’t access my application, what do I do? ............... 33


What is VPN?

VPN, also known as a Virtual Private Network, gives users the ability to create a secure connection over the Internet, and access the GDLS private network remotely on a GDLS computer/laptop as if they were on-site. Virtual private networking makes GDLS servers and networks available securely anywhere, anytime! VPN enables IP traffic to travel securely over a public TCP/IP network by encrypting all traffic from one network to another. Cisco VPN uses "tunneling" to encrypt all information at the IP level.

How to Get Help

The VPN Client comes with a complete, context-sensitive, browser-based help system. You can display help in the following ways:

Online Help

• On the Program Menu, choose Start > Programs > Cisco Systems VPN Client > Help > Help VPN Client. This method displays the entire help file beginning with a list of topics.

• Press F1 on any window while using the VPN Client. This method displays context-sensitive information.

• Click the Help button on windows that display it. This method displays context-sensitive information.

Help Desk Who do I call when I need assistance with VPN? If you need assistance with VPN, contact the CSC Eastern Center Help Desk at 860-425-5002.

Review Wireless Internet Connection Settings

Wireless Internet connection settings vary according to the operating system installed on the computer and the wireless network card used. The wireless procedures provided in this user guide are based on the use of a standard Dell laptop issued to GDLS/CSC users, with a standard wireless card installed. The steps may vary slightly when used on another computer/laptop. This user guide provides wireless users with a basic understanding of how to use wireless and VPN while inside or outside a GDLS facility.

Continued on next page

Document Owner: Deborah Baskerville 1 VPN Troubleshooting User Guide Approved Date: Document Version: 1.1


Review Wireless Internet Connection Settings, continued

If you are having difficulty connecting to VPN, review the following Wireless settings for accuracy. This User Guide describes how to review each of these settings.

• Enabled Wireless Card

• Wireless Network Settings

• Wireless Network Connection

Verify Wireless Card is Enabled If you are having difficulty connecting to the Internet, make sure your wireless card is “enabled” to establish a wireless connection. There are two ways to verify your wireless card is enabled. 1. Review the WiFi indicator. Your wireless card is enabled when you

see a WiFi indicator light display. This indicator is located in the same area where the power button, caps lock, and number lock are located at the top of your laptop.


2. You can also use the following procedure to verify your wireless

card is enabled. a. Go to Start > My Network Places. b. Click View Network Connections. c. Locate your Wireless Network Connection. “Enabled”

displays next to your wireless network connection if your wireless card is enabled, otherwise “Disabled” displays.

WiFi Indicator light




Verify Wireless Card is Enabled, continued To enable or disable your wireless card, Enable or

Disable Wireless Card

1. Hold down the Function key and then click F2 (Function key = or Fn). The WiFi indicator light turns on when your wireless card is enabled.


Verify Wireless Network Settings

If you are having difficulty connecting to the Internet, make sure your wireless card is set to look for all access points and non-preferred networks. Some wireless cards and operating systems can be set to automatically search for access points while others need them to be manually set. If you are using Windows XP, you will need to set the card to look for all access points. Use the following procedure to set your wireless card to look for all access points and non-preferred networks.

1. Right click on your wireless icon ( or ) located in the system tray in the lower right corner of your desktop.

2. Click View Available Wireless Networks.

The Wireless Network Connection window displays. 3. Click Advanced.




Verify Wireless Network Settings, continued

The Wireless Network Connection Properties window displays. 4. Click Advanced.






5. Select the radio button next to Any available network (access

point preferred). 6. Place a checkmark next to Automatically connect to non-

preferred networks. 7. Click Close.






Verify Wireless Network Connection If you are having difficulty connecting to the Internet, make sure you have selected an available wireless network. To select an available wireless network,

Select Wireless Network

1. Right click on your wireless icon ( or ) located in the system tray in the lower right corner of your desktop.

2. Click View Available Wireless Networks.

The Wireless Network Connection window displays.





Verify Wireless Network Connection, continued Select Wireless Network, continued

3. Select the appropriate available wireless network related to your

location. 4. Place a checkmark next to Allow me to connect to the selected

wireless network, even though it is not secure. 5. Click Connect.





Verify Wireless Network Connnection, continued If the wireless network you want to connect to does not display, Refresh

Wireless Network 1. Click Advanced on the Wireless Network Connection window.

2. Place a checkmark next to Use Windows to configure my wireless

network settings. 3. Click Refresh.





Verify Wireless Network Connection, Continued Your desired wireless network now displays in the list of Available networks.

Refresh Wireless Network, continued 4. Selected and highlight your desired wireless network.

5. Click OK.




Verify Wireless Network Connection, Continued Configure a wireless network as a Preferred network, if you plan to repeatedly use it over and over again. Use the following procedure to configure a wireless network as a preferred network.

Configure Wireless Network

1. On the Wireless Network Connection window, click Advanced.

Desired wireless network does not display





Verify Wireless Network Connection, Continued 2. Click Add to add a preferred wireless network. Configure

Wireless Network, continued

Desired wireless network does not display

Verify Wireless Network Connection, Continued The Wireless network properties window displays. 3. Enter Network name (SSID) provided to you. 4. Unselect the checkbox next to Data encryption (WEP enabled). 5. Click OK and then click OK again. 6. Wait about 10 seconds and then you should have a wireless

connection. You should now be able to connect to the Internet.





Verify Wireless Network Connection, Continued Configure Wireless Network, continued

Review VPN Settings

If you are having difficulty connecting to VPN, review the following VPN settings for accuracy. This User Guide describes how to review each of these settings.

• Internet Connection

• IP Address

• Imported Certificate

• Verify Certificate

• Group and Certificate Authentication

• Correct Password

• Window Logon Properties

• Internet Settings

• Mapped Network Drives




Review VPN Settings, continued

Verify you have an Internet Connection The most common reason a user has difficulty connecting to VPN is because they do not have an Internet connection. Use the following procedure to verify you have an Internet Connection. 1. Bypass the VPN client entirely and log directly into Windows. 2. Open your Internet browser. 3. Enter a desired Internet web page (ex. www.google.com).

a. If the Internet web page displays, you have an internet connection and now you can try to connect to VPN.

b. If you are connecting from a hotel, check if the hotel has a

“contract of use” page that you are required to either fill out or acknowledge prior to receiving unrestricted internet access.

i. Manually Launch the VPN client ii. Authenticate and use the Map NT Drives shortcut in

the Start – Programs – Cisco VPN folder to have all drive shares established.

Note: Depending on the facility you are at, you may only have to contend with the Terms page once during your stay OR as frequently as every 24 hours. It differs from organization to organization.



http://www.google.com/



Verify you have an Internet Connection, continued c. If the Internet web page does not display:

i. Verify all cords/cables are properly connected ii. Verify your IP address is being recognized

Verify IP Address If you are having difficulty connecting to VPN, verify the IP address on your computer is correct. Use the following procedure to review the IP address on your computer. 1. Click Start. 2. Click Run.

3. Enter cmd. 4. Click OK.





Verify IP Address, continued 5. Enter ipconfig on the Windows system screen. 6. Click Enter. The IP Address assigned to your computer displays.


Your IP Address is not being recognized if one of the following displays:

• IP Address: 000.000.00.00

• IP Address: 169.254.xx.xx.

Use one of the following procedures to correct the situation, and have your IP Address be recognized by your computer.

• Enter ipconfig/renew at the prompt, and then hit enter. This generates a search for your IP address.

Error Resolution

• Turn off your modem or router for 30 seconds, after you turn it back on, your computer should recognize your IP Address.




Verify IP Address, continued Error Resolution, continued

Contact Eastern Center Help Desk If your computer is still not recognizing your IP address, after using the error resolution procedures listed above, then contact the Eastern Center Help Desk at 860-425-5002. When the Help Desk technician is assisting you, they may ask you for the IP address that displays on the Windows IP Configuration window. The displayed IP address tells them:

• The IP address assigned to your PC (public IP or private IP)

• If you can be connected to Dameware (public – no, private – yes)

• If a router/firewall is giving out the IP address (if so, this may be the source of the problem) The Help Desk technician may also ask you for the public IP address you present to the Internet. Go to www.WhatIsMyIP.com. Your public IP address displays at the top of the web page. Provide the public IP address to the technician if necessary.

Verify Certificate was Imported If you are having difficulty connecting to VPN, verify your VPN certificate was imported into VPN Client. Use the following procedure to verify your certificate was imported. 1. Open GDLS VPN Client window (use shortcut on your desktop). 2. Click the Certificates tab. 3. Select and highlight your certificate. 4. Click Verify. A message displays indicating the validity of your

certificate.



http://www.whatismyip.com/



Verify Certificate was Imported, continued

Message displays if certificate

is valid

NOTE: If no certificate information displays, then complete Step 6: Import Your VPN Certificate provided in the VPN User Guide.

Verify Certificate If you are having difficulty connecting to VPN, make sure you are using a valid certificate. Use the following procedure to verify your certificate. 1. Open GDLS VPN Client window (use shortcut on your desktop). 2. Click the Certificates tab. 3. Select and highlight the certificate that you want to verify. 4. Click Verify.





Verify Certificate, continued If you receive the following message, no further action is needed and you have a valid VPN certificate.

Below are possible error messages you could receive when verifying your VPN certificate.

Possible Error Messages

Error Message: Certificate expires in X days.

Problem: If you receive this error message your VPN certificate is still valid; however it expires in a few days. Resolution: Install a new certificate before the existing one expires following the procedures in the VPN User Guide called, Import Renewed Certificate.

Error Message: Certificate has expired.





Verify Certificate, continued Problem: If you receive this error message, then your certificate is no longer valid, and you will not be able to connect to VPN.

Possible Error Messages, continued Resolution: Import your renewed certificate following the procedures in

the VPN User Guide called, Renewal of VPN Certificate.

NOTE: If you feel that you are receiving this error message by mistake and your certificate has not expired; then review the system date on your computer for accuracy.

1. In the lower left corner of your system tray, double click on the displayed time.

2. Review the date selected. 3. Update the selected date, if necessary.

Verify Group and Certificate Authentication If you are having difficulty connecting to VPN, make sure your group and certificate authentication is set properly. Use the following procedure to establish group authentication. Group

Authentication 1. Open GDLS VPN Client window (use shortcut on your desktop). 2. Select your default connection on the Connection Entries tab. 3. Click Modify.





Verify Group and Certificate Authentication, continued

Group Authentication, continued

4. Select the radio button next to Group Authentication. 5. Click Save.




Verify Group and Certificate Authentication, Continued In addition to Group Authentication you also need to establish Certificate Authentication.

Certificate Authentication

Use the following procedure to establish certificate authentication. 1. Open GDLS VPN Client window once again. 2. Select your default connection on the Connection Entries tab

once again. 3. Click Modify once again.

4. Select the radio button next to Certificate Authentication. 5. Select and highlight your Name (Cisco) in the Name drop down

list. 6. Click Save.





Verify Password If you are having difficulty connecting to VPN, make sure you are entering the correct password. Use the following procedure to verify the password you are using is correct. 1. Open GDLS VPN Client window (use shortcut on your desktop). 2. Click the Certificates tab. 3. Select and highlight the certificate that you want to verify.

4. Select the Certificates menu item. 5. Select Change Certificate Password.

6. Enter what you think is the current VPN Client password. 7. Click OK.





Verify Password, continued

8. Do not enter a new password, leave the new password BLANK. 9. Click OK.

10. Do not confirm the password, leave the confirm password

BLANK. 11. Click OK.

Leave Blank

11.

If you receive the following message then the password is correct.




Verify Password, continued Use the following procedure to restore your original password. Restore

Original Password WARNING: After using the procedure above to verify your password,

the current password is blank. 1. Repeat steps 2 – 11 to restore the original password. 2. In step 6, do not enter a password, the current password is blank. 3. In steps 8 & 10, instead of leaving the password blank, enter your

desired password. If you receive the following message then the password provided is incorrect.

If desired, repeat steps 2-11 with other passwords as many times as needed to locate the correct VPN password. IMPORTANT: If you are not able to determine the correct VPN password, then call the Eastern Center Help Desk at 860-425-5002 for assistance.

Verify Window Logon Properties If you are having difficulty connecting to VPN, make sure you are logging into VPN before logging into Windows. Use the following procedure to review your Windows logon properties. 1. Open GDLS VPN Client window (use shortcut on your desktop). 2. On the VPN Client window, select the Options menu item. 3. Select Windows Logon Properties.





Verify Window Logon Properties, continued

4. Select Enable start before logon. If you do not have Administrator

Rights to select this option, contact the Easter Center Help Desk. 5. Click OK.

NOTE: If the VPN client is still not starting before the Windows logon, unselect “Enable start before logon” and then click OK, then reopen the Windows Logon Properties and reselect this setting.

Verify Internet Settings If you are having difficulty connecting to VPN, make sure your Internet settings is set to automatically detect your LAN settings. Use the following procedure to verify your Internet settings. 1. Open Internet Explorer. 2. Select the Tools menu item.





Verify Internet Settings, continued 3. Select Internet Options. 4. Click on the Connections tab at the top. 5. Place a checkmark next to Never dial a connection. 6. Click LAN Settings.





Verify Internet Settings, Continued 7. Place a checkmark next to Automatically detect settings. Do not

check the other two boxes.

IMPORTANT: Make sure the use of a proxy server is not selected; sometimes it is automatically selected by VPN

8. Click OK. 9. Close Internet Explorer. 10. Open a new Internet Explorer browser window. You should now

be connected to the Internet.

Make sure the use of a proxy server is not selected; sometimes automatically selected by VPN

Verify Network Selected If you are having difficulty logging onto Windows, review the selected network. When logging onto Windows, 1. Enter your Windows/NT user name. 2. Enter your Windows/NT password.

Document Owner: Deborah Baskerville 27 VPN Troubleshooting User Guide Continued on next page

Approved Date: Document Version: 1.1



Verify Network Selected, continued 3. Select LS from the Log On To drop down list.

IMPORTANT: • Make sure you do not select LAxxxxxx (this computer); if selected, you will not be able to log onto Windows

• For example, do not select LA123456 (this computer)

4. Click OK.

Do not select - LA123456 (this computer)

Verify Network Drives are Mapped After you have a VPN connection, you can access documents and complete work assignment on various network drives outside the office as long as you are mapped to the network drive. These are the drives (i.e. M drive, P drive, U drive, etc.) you use and see when at the office. Use the following procedure if you do not have access to your network drives and you need to map these drives. 1. Click Start > Programs > Cisco VPN > Map NT Drives.





Verify Network Drives are Mapped, continued

2. Enter Y on the Map NT Drives window.

Map Network Drives process is complete.

VPN Client Error Resolution

Below are some of the common VPN error messages you could receive and the resolution to fix the issue to help you gain access to VPN Client. Go to http://www.chicagotech.net/vpnissues/ciscoerror10.htm for a complete list of reason codes and possible resolutions.


http://www.chicagotech.net/vpnissues/ciscoerror10.htm


VPN Client Error Resolution, continued

Error Message: Warning 204: Certificate could not be found.

Problem: The certificate associated with a connection entry could not be found. Resolution: Repeat Step 7: Group and Certificate Authentication provided in the VPN User Guide.

Error Message: Reason 403: Unable to contact the security gateway.

Problem: Password is incorrect. Resolution: Enter the correct password. If you are not sure of the correct password, then follow the procedures provided in Verify Password section of this Troubleshooting guide.

Error Message: Reason 412 or 414: The remote peer is no longer responding.





VPN Client Error Resolution, Continued

Error Message: Reason 412 or 414, continued Problem 1: You are trying to connect to Cisco VPN while connected to a GDLS site network. Resolution: Do not connect to Cisco VPN when you are already on the GDLS network. Problem 2: VPN may be blocked by another firewall. Resolution: Temporarily disable the other firewall, log into VPN, and then enable firewall again.

VPN Frequently Asked Questions

Below is a list of VPN frequently asked questions. Please review this list for an answer to your question before contacting the CSC Eastern Center Help Desk.

How do I log onto VPN prior to logging into Windows? A VPN Client setting determines if you log onto VPN before Windows. Follow the procedures provided in the Verify Windows Logon Properties section of this Troubleshooting guide.

I cannot access the network using my selected default connection, what do I do?

1. If your main/default connection entry doesn’t work, select another connection for your corresponding site.

2. After selecting a new connection entry, repeat Step 7: Group and Certificate Authentication provided in the VPN User Guide.

NOTE: USA users can select USA1, USA1 SSL, USA2, or USA2 SSL until a connection is established.



VPN Frequently Asked Questions, continued

I cannot access the network using my selected default connection, what do I do? - continued

How do I enable my SecurID card and access VPN? Users of shared laptops will have a SecurID card instead of a VPN Certificate. To enable your SecurID card, 1. Follow the Group Authentication procedures provided in the VPN

User Guide. 2. When prompted, enter your Window/Network User ID. 3. Enter the PIN # (4 – 8 digits) that is specifically assigned to you. 4. Enter the Passcode which is your PIN # (4 – 8 digits) + SecurID (6

digits) displayed at that time. The SecurID changes every minute.

The portal is asking for an ID and password, Why? What do I enter? VPN changes your proxy settings, which affect your ability to access the GDLS portal.

Why?

If you are prompted to provide an ID and password to access the portal; use the following procedure on the portal login window. 1. Enter ls.gdls.com\ followed by your GDLS Windows/NT

username. Example: ls.gdls.com\youngb

What ID and Password do I Enter?

2. Enter your GDLS Windows/NT password. 3. Select the checkbox next to Remember Password. 4. Click Enter. You now have access to the GDLS Portal.




VPN Frequently Asked Questions, Continued

I cannot access a document on the U drive, what do I do? Use one of the following options to gain access to your network drives so you can view documents on the U drive. 1. Log into VPN before logging into Windows. 2. Map your Network Drives; follow the procedures provided in the

Verify Network Drives are Mapped section of this Troubleshooting guide.

My network drives are mapped, but I can’t access my application, what do I do? If you are having trouble accessing an application, check your IP address to see what GDLS location you are connect to. Use the following procedure to locate the IP address for a specific connection entry. 1. Click Start. 2. Click Run. 3. Enter cmd. 4. Click OK. 5. Enter ipconfig on the Windows system screen. 6. Click Enter. The IP Address assigned to your computer displays. 7. Call the Eastern Center Help Desk and provide the IP address to

the technician. They will be able to determine what location you are connected to.


Virtual Private Network

Documents

Transcript of Virtual Private Network