Professional Documents
Culture Documents
VPN Client 5007
VPN Client 5007
0290
Updated December 13, 2011
Introduction New Features, page 2 System Requirements, page 2 Installation Notes, page 3 Advisories for Windows 7 and Vista Users, page 6 Usage Notes, page 6 Known Caveats, page 17 Resolved Caveats, page 18 Related Documentation, page 18
Introduction
These release notes are for the Cisco VPN Client, Release 5.0.07.0290. The names of the files on the software download site are:
vpnclient-win-msi-5.0.07.0290-k9.exe for Windows on x86 (32-bit). vpnclient-winx64-msi-5.0.07.0290-k9.exe for Windows on x64 (64-bit).
The VPN Client creates a secure connection over the Internet between a remote PC and an enterprise or service provider Cisco VPN device. This connection lets you access a private network as if you were an on-site user.
Americas Headquarters: Cisco Systems, Inc., 170 West Tasman Drive, San Jose, CA 95134-1706 USA
New Features
This document identifies the new features, system requirements, limitations and restrictions, known issues, resolved caveats, and related documentation. Please read it carefully prior to installation. The section, Usage Notes, describes interoperability considerations and other issues you should be aware of when installing and using the VPN Client.
New Features
VPN Client 5.0.07 features the following:
Support for Windows 7 on x64 (64-bit). This release, however, does not support WWAN devices (also called wireless data cards) on Windows 7 x86 (32-bit) and x64. For support of WWAN devices on Windows 7, please use the Cisco AnyConnect Secure Mobility client. Support for Windows Vista on x64. Packet LZS compression for x64 VPN Client.
System Requirements
Cisco VPN Client 5.0.07 supports the following Microsoft OSs:
Windows 7 on x64 (64-bit) Windows 7 on x86 (32-bit) only Windows Vista on both x86 (32-bit) and x64 Windows XP on x86
VPN Client does not support the Tablet PC 2004/2005; and Windows 2000, NT, 98, and ME. VPN Client supports smart card authentication on Windows 7, Vista, and XP. However, VPN Client does not support the ST Microelectronics smart card Model ST23YL80, and smart cards from the same family. VPN Client supports up to one Ethernet adapter and one PPP adapter. It does not support the establishment of a VPN connection over a tethered link. VPN Client 5.0.x is incompatible with the combination of Cisco Unified Video Advantage 2.1.2 and McAfee HIPS Patch 4 Build 688. To avoid system failures, uninstall either of these two applications, upgrade McAfee to the latest version, or use VPN Client 4.6.x. To install the VPN Client, you need
Pentium-class processor or greater Microsoft TCP/IP installed. (Confirm via Start > Settings > Control Panel > Network > Protocols or Configuration.) 50 MB hard disk space. 128 MB RAM (256 MB recommended) Administrator privileges Cisco Series 5500 Adaptive Security Appliance, Version 7.0 or later.
Cisco VPN 3000 Series Concentrator, Version 3.0 or later. Cisco PIX Firewall, Version 6.2.2(122) or Version 6.3(1). Cisco IOS Routers, Version 12.2(8)T or later.
Follow this link to the Cisco AnyConnect Secure Mobility Client Introduction page: http://www.cisco.com/en/US/products/sw/secursw/ps2308/tsd_products_support_series_home.html Click Download Software. Click Cisco VPN Client v5.x in the third column of the table under Make a selection to continue. Click Yes in response to the prompt, Do you want to view only the webpage content that was delivered securely? Enter your cisco.com credentials. Ensure the Latest Releases folder is open. Click Download Now next to the associated name of the .exe file. Click Proceed with Download. The webpage displays a link to the Cisco End User License agreement. Read and verify the download rules below the link, then click Agree. Click Download next to Cisco VPN Client v5.x.
Step 9 Step 10
Installation Notes
Refer to Cisco VPN Client User Guide for Windows, Chapter 2, for complete installation instructions for Windows users.
Note
Due to issues surrounding network installation, Active Directory Group Policy software deployment is no longer supported. For more information and a workaround, refer to open caveat CSCse00525.
Installation Notes
Avoiding Vista Problems with the TCP/IP Registry Compatibility Service and the VPN Virtual Adaptor
To avoid problems with the TCP/IP Registry Compatibility service and the VPN Virtual Adaptor, we strongly recommend that Windows Vista users install Vista SP2 or later. For more information about a previous hotfix for this problem, go to this URL: http://support.microsoft.com/kb/952876
Installation Notes
Direct network connection (cable or DSL modem and network adapter/interface card), or Internal or external modem
To connect using a digital certificate for authentication, you need a digital certificate signed by one of the following Certificate Authorities (CAs) installed on your PC:
Entrust Technologies (www.entrust.com) Netscape (www.netscape.com) Verisign, Inc. (www.verisign.com) Microsoft Certificate Services Windows 2003 Microsoft Certificate Services Windows 2000 Digital certificate stored on a smart card (supported only on Windows Vista and XP at this time). The VPN Client supports smart cards via the MS CAPI Interface.
The VPN Client accepts a blank password for certificate retrieval, but should not.
On Windows 7, the Cisco VPN Client uses the primary IP address of an interface during the VPN session setup. However, if the same interface has a secondary IP address, the VPN Client uses the secondary IP address to transmit all traffic once the session is established.
Connection Time
Using the VPN Client to connect a PC running Windows 7 or Vista system might take longer than one running Windows XP. The actual time it takes to connect might vary from customer to customer.
IPv6 Resources Accessible on LAN
Windows 7 and Vista users who establish a VPN Client connection can use IPv6 to access resources on the LAN, regardless of whether split tunneling is configured. By default, Windows 7 enables IPv6. The only workaround is to disable IPv6 on the endpoint. This issue applies to all VPN Client releases that support Windows 7 and Vista.
Unsupported Features
The Cisco VPN Client for Windows 7 and Vista does not support the following features:
Upgrade from Windows XP (clean OS installation required). Start Before Logon Integrated Firewall InstallShield AutoUpdate
Usage Notes
This section lists issues to consider before installing VPN Client Release 5.0.07. In addition, you should be aware of the known caveats in this release. Refer to Known Caveats on page 17 of this document for the list of known problems.
Note
Support for this release is provided through the Cisco TAC for customers with SMARTnet support contracts.
VPN Client May Not Work Properly After Laptop Wakes up from Suspend Mode
The Cisco VPN Client may not work properly on a laptop after it wakes up from suspend mode. If a VPN 4.8 (or later) Client is connected to a central site-device, and the client device (typically a laptop) goes into Suspend Mode, then the VPN Client disconnects. Upon waking up from Suspend Mode, the VPN Client is disconnected. A pop-up message appears, allowing you to reconnect the VPN connection. However, selecting reconnect may not re-establish the VPN tunnel.
Usage Notes
This situation occurred with the VPN 4.8 Client installed on a Windows XP Laptop. The client disconnects after going into any hibernate or standby situations. Note This behavior was tracked with the defect ID CSCsf96588 and resolved; however, Cisco cannot guarantee that this solution will work on all hardware platforms and operating systems. You may still encounter the behavior described in CSCsf96588 when running Cisco VPN client version 4.8 and later. If you do see the behavior described in the defect, use the following workaround: Workaround Disconnect the Cisco VPN session before going into Hibernate or Standby Mode. When you awaken your computer, re-establish the Cisco VPN session. Use one of these methods to disconnect the Cisco VPN Client:
Open the Cisco VPN Client on the desktop, select the connection entry and click Disconnect. Right-click the Cisco VPN client icon in the system tray and click Disconnect. Open Windows Task Manager, click the Processes tab, and end the vpngui.exe process.
Usage Notes
WINS Information Might Not Be Removed from Windows Servers If Not Disconnected Before Shutdown
If the VPN Concentrator is configured to send WINS server addresses to the VPN Client and the PC is shut down or restarted without first disconnecting the VPN Client, the WINS servers are not removed from the network properties. This might cause local PC registration and name resolution problems while not connected with VPN. To work around this problem, do one of the following:
Be sure to disconnect the VPN Client before shutting down. If you are having problems, check your network properties and remove the WINS entries if they are not correct for your network. Alternatively, enable Disconnect VPN connection when logging off. Go to Options > Windows Logon Properties, check Disconnect VPN connection when logging off.
DNS
For DNS resolution, if the DOMAIN NAME is not configured on the network interface, you must enter the fully qualified domain name of the host that needs to be resolved.
Network Interfaces
The VPN Client does not support Point-to-Point Protocol over ATM (PPPoA). The VPN Client cannot establish tunnels over Token Ring. However, it does not conflict with an installed Token Ring interface. The VPN Client on Windows 7 does not support WWAN devices (also called wireless data cards).
Usage Notes
Right-click the Outlook icon, go to Properties, and configure it to use Microsoft Exchange or Internet Mail as the default mail client. Use Internet Explorer to configure the system to have no default mail client. Configure Outlook as the default mail client.
You can receive data, such as mail, but not send it. You can send small messages (about 10 lines), but larger ones time out. You cannot send attachments in email.
Usage Notes
Procedure Use the SetMTU utility supplied with the Cisco VPN Client.
10
Usage Notes
ZoneAlarm Plus Versions 3.1.274 and Earlier Are Incompatible with VPN Client
The following known incompatibility exists between the Cisco VPN Client and Zone Labs ZoneAlarm Plus version 3.1.274 and earlier. If you are using such a version of ZoneAlarm Plus, please visit http://www.zonelabs.com or contact your Zone Labs representative for an update. On a PC with ZoneAlarm Plus version 3.1.274 (or earlier) and the VPN Client, errors similar to the following occur when the PC boots: ZAPLUS.exe has generated errors and will be closed by Windows. You will need to restart the program. An error log is being generated. The Application Log records a message similar to the following: The application, ZAPLUS.EXE, generated an application error. The error occurred on 7/23/2002... The exception was c0000005 at address 00401881 (<nosymbols>). The result of such errors is that the ZoneAlarm GUI does not run, and therefore a user cannot change any settings in ZoneAlarm Plus or allow new programs to access the Internet. (CSCdy16607).
Upgrading Zone-Alarm Pro to Version 3.7.098 Causes Error When VPN Client Is Already Installed on the PC
Upgrading ZoneAlarm Pro version 3.5.xxx to ZoneAlarm Pro version 3.7.098 when the VPN Client is installed on the PC might cause the following error to appear: The procedure entry point DbgProcessReset could not be located in the dynamic link library VSUTIL.dll. Click OK. The installation continues. See ZoneLabs bug number 10182.
11
Usage Notes
Select Start > Control Panel > (Network and Internet) > View Network Status and Tasks. Right-click the icon representing the public interface and select Properties. Select Internet Protocol Version 4 and click Properties. Click Advanced in the General tab, and set the interface metric to 2 or greater.
In Windows XP, you can increase the metric of the public network as follows:
Step 1 Step 2 Step 3 Step 4
Select Start > Settings > Control Panel > Network and Dial-up Connections. Select the public interface and click properties for the public interface. Select Internet Protocol (TCP/IP) and get the properties for the Internet Protocol (TCP/IP). Click Advanced, and set the interface metric to 2 or greater.
Windows XP OnlyData Meant for Private Network Stays Local if VPN Client Local Network Is on Same IP Subnet as Remote Private Network
This problem occurs only with the VPN Client, Release 4.6 and only with Virtual Adapter on Windows XP when the VPN Client local network is on the same IP subnet as the remote private network. When a VPN connection is up, data meant for the private network stays local. For example: 192.168.1.0/255.255.255.0 Beginning with VPN Client, Release 4.6, the Virtual Adapter attempts to modify local route metrics to allow data to pass over the VPN tunnel. In some cases, it is impossible for the VPN Client to make this modification. To work around this problem, make the change manually, using the following procedure:
Step 1 Step 2 Step 3 Step 4 Step 5
Run > Control Panel > Network and Dialup Connections. Right-click on the adapter in question and select Properties. From the Adapter Properties dialog, select TCP/IP from the list and click Properties. Click Advanced and increase the number in the Interface metric box by 1 (it is usually 1, so making it 2 works). Click OK to exit out of all dialogs.
12
Usage Notes
Step 6
Start Before Logon and Microsoft Certificate with Private Key Protect Fails
Trying to connect the VPN client using Start Before Logon (SBL) and Microsoft Machine-based certificates fails. This failure is a Microsoft issue, not a VPN Client problem. If your certificate has private key protection enabled, every time you use the certificate keys you are either prompted for a password to access the key, or notified with a dialog and asked to click OK. The prompt displayed when using a certificate with private key protection appears on the Windows Desktop. You do not see this message while at the Logon desktop, therefore the VPN Client cannot gain the access to the certificate needed to connect. Use one of the following workarounds:
Get a certificate without private key protection. Make sure it is machine-based; otherwise it will not be accessible before logging on). Instead of using Start Before Logon, log on to the PC using cached credentials, make the VPN connection, and using the stay connected at logoff featurelogoff/logon with the VPN established to complete the domain logon.
13
Usage Notes
Stateful Firewall (Always On) is enabled. The setting StatefulFirewallAllowICMP=1 is added to the [Main] section of the vpnclient.ini file. A connection is made to the VPN Concentrator that pushes the default CPP firewall rule to the VPN Client.
Use the parameter, StatefulFirewallAllowICMP=1only if you want to allow ICMP traffic to pass through the firewall.
Use Zone Labs Integrity Server 2.1.052.0 or Higher with VPN Client 4.0
Versions of the Zone Labs Integrity Server earlier than 2.1.052.0 exhibit the following problem. If two or more VPN Clients running on Windows XP are connected to a VPN 3000 Series Concentrator and receive firewall policy from a ZoneLabs Integrity Server, the Integrity Server registers only one connection. On the Integrity Flex (client agent), under Policies, the Integrity Server column flashes Connected then Disconnected over and over. The VPN Client log also includes the following event: The firewall, configured for Client/Server, returned a status of lost connection to server. Zone Labs Integrity Server version 2.1.052.0 fixes this issue.
14
Usage Notes
Restart VPN Client Service if You Install VPN Client before Zone Alarm
The firewall enhancement, Prevent VPN Traffic Blocking, automatically adds the Loopback address (127.0.0.1) and the address of the VPN 3000 Concentrator to the ZoneAlarm or ZoneAlarmPro trusted zone.
Caution
Do not disable the firewall if you are using the ZoneAlarm firewall. To disable the Integrity firewall, rename or delete the following files, then reboot:
Click Start > Settings > Control Panel >Network and Dial-up Connections. Select the Local Area Connection you use. Click on File > Properties. Uncheck Check Point SecuRemote, and click OK.
Extract the file vpnclient-win-msi-5.0.00.0340-k9.exe to any folder. Execute vpnclient_setup.msi. The installer runs in English. After installation is complete, modify vpnclient.ini as follows: ClientLanguat=jp
15
Usage Notes
Step 4
Open Network and Sharing Center. Select Manage Network Connections. Enable the Virtual Adapter (VACisco VPN Adapter). Right-click on Cisco VPN Adapter and select Diagnose from the context menu. Select Reset the network adapter Local Area Connection X.
If this procedure does not work, run the following command from cmd: reg add HKLM\System\CurrentControlSet\Services\Tcpip\Parameters /v ArpRetryCount /t REG_DWORD /d 0 /f Then reboot. This resolves the issue until the OS reports a duplicate IP address again. Follow the preceding steps to resolve it again. If that doesn't work, you might have UAC enabled. If so, you must run cmd as administrator and repeat the previous registry workaround.
Windows 7 and Vista Window Auto-tuning Feature Might Cause Network Timeout Problems
Windows 7 and Vista support a feature called Receive Window Auto-Tuning that continually adjusts the receive Windows size, based upon the changing network conditions. Some people reported that auto-tuning causes network timeout problems with some applications and routers. If you have experienced such problems, you can turn it off using the following procedure:
Step 1 Step 2
Open an elevated command prompt. Enter the following command to disable auto-tuning:
netsh interface tcp set global autotuninglevel=disabled
If this solution does not fix the problem, you can turn it back on, as follows:
Step 1
16
Known Caveats
Step 2
Enter the following command to enable auto-tuning netsh interface tcp set global autotuninglevel=normal To view the states of the TCP global parameters, use the following command:
netsh interface tcp show global
(CSCsi26106)
Note
If you are using Domain Isolation, you cannot use the UseLegacyIKEPort keyword, as this conflicts with Microsoft Domain Isolation.
Known Caveats
Caveats describe unexpected behavior or defects in Cisco software releases.
Note
If you have an account with CCO, you can use Bug Navigator II to find caveats of any severity for any release. To reach Bug Navigator II on CCO, select Software & Support: Online Technical Support: Software Bug Toolkit or navigate to http://www.cisco.com/cgi-bin/Support/Bugtool/launch_bugtool.pl. Table 1 shows all Severities 2 and 3 caveats known to be in Release 5.0.07.0290.
Table 1 Known Caveats
ID CSCtf73767 CSCec02663 CSCsf10635 CSCsi25985 CSCsi26020 CSCsi26050 CSCsi26069 CSCsi26086 CSCsi26159 CSCsi26229
Headline Local DNS server contacted for FQDN in Split-DNS domain Auto Initiation fails on 9x/Vista on boot up unity client disconnect-verizon evdo/at&t 3G card changed IP unity vista: user not prompted to reconnect after sleep or hibernation unity vista: firewall tab under stats still shows unity vista: installshield package does not work on vista unity vista: error 1721 when installing client on vista 64bit unity vista: upgrading from xp to vista not supported unity vista: bsod during install/uninstall/sleep with active ras unity vista: integrated firewall not installed on vista
17
Resolved Caveats
Table 1
Known Caveats
Headline unity vista: start before login sbl not functioning unity windows silent msi upgrade not Cisco VPN Client incorrectly using the secondary IP address for VPN VPN Client unable to validate certificate chain
Resolved Caveats
Table 2 shows the caveats that Release 5.0.07 resolves.
Table 2 Resolved Caveats
Headline unity xp-vista: reauth on rekey with saved password causes disconnect VPN client does not handle IP option properly under Vista IGMP packets from the Vista discovery service are getting encapsulated SetMTU needs to support Dial-Up Networking on Vista. ENH: unity client with SBL shows error message with firewall detected VPN Client can't connect for certain period after forcible termination VPN Client will not connect to headend if PCF is read only PC reboots if physical link is disrupted during a VPN connection x64 Vista: Error 442 failed to enable VA during the 1st connect attempt
Related Documentation
Cisco Security Appliance Command Line Configuration Guide, Version 8.0 Cisco Security Appliance Command Reference, Version 8.0 ASDM Online Help ASDM 6.0 User Guide Cisco AnyConnect VPN Client Administrator Guide VPN 3000 Series Concentrator Reference Volume I: Configuration, Release 4.1 VPN 3000 Series Concentrator Reference Volume II: Administration and Management, Release 4.1 VPN 3000 Series Concentrator Getting Started, Release 4.1
This document is to be used in conjunction with the documents listed in the Related Documentation section. Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)
18
Related Documentation
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental. 1999-2011 Cisco Systems, Inc. All rights reserved.
19
Related Documentation
20