Billion Electric Company CO1 manuale d’uso

V ersion Release 3.0 BiGuard C01 BiGuard VPN Client Secure access to Comp any Network User ’ s Manual[...]

T able of Contents i T T a a b b l l e e o o f f C C o o n n t t e e n n t t s s CHAPTER 1: INTRODUCTION ............................................................................................................. 1 I NTRODUCTION TO B I G UARD VPN C LIENT .............................................................................................[...]

T able of Contents ii How to set USB Mode on?........................................................................................................ .......... 27 How to enable a new USB S tick? ....................................................................................................... 28 How to automatically open tunnels when an USB S[...]

Billion BiGuard VPN Client Chapter 1: Introduction 1 Chapter 1: Intr oduction Introduction to BiGuard VPN Client Y our network is constantly evolving as y ou integrate more business applications and consolidate servers. In that environment, it is becoming extremely complex to maintain tot al security at the edge while user s being employees or T el[...]

Billion BiGuard VPN Client Chapter 1: Introduction 2 Invisible User Interface Silent install and invisible graphical interface allow IT managers to deploy solutions while preventing user to misuse configurations. Configuration building User Interface and Command Line.[...]

Billion BiGuard VPN Client Chapter 2: Installing BiGuard VPN Client 3 Chapter 2: Installing BiGuar d VPN Client Sof tware inst allation BiGuard VPN client installation is a classical Wi ndows installation that does not require specific information. After completing the inst allation , you will be asked to reboot your computer . After reboot and ses[...]

Billion BiGuard VPN Client Chapter 2: Installing BiGuard VPN Client 4 Sof tware Evaluation It is possible to use BiGuard VPN Client during the evaluation period (i.e. limited to 30 days) by clicking on "Evaluate" button. Wh en the IPSec VPN Client is on "E valuation" mode, the register window appears at each boot of the client. [...]

Billion BiGuard VPN Client Chapter 2: Installing BiGuard VPN Client 5 Step 1 of 2: Enter License Number Activation requires a License Number . Enter your License Number , your email address and clic k “Next” as shown below . Ema il address will be used to send ba ck an activation confir mation email to the user once activation has been successf[...]

Billion BiGuard VPN Client Chapter 2: Installing BiGuard VPN Client 6 Step 2 of 2: Online Activation The “Activation Wizard” will automatically connect to the online software activation server to activate the VPN Client Software. Y ou can go back at anytime to change the License Number . Activation errors In case of an error is returned by the [...]

Billion BiGuard VPN Client Chapter 2: Installing BiGuard VPN Client 7 exceeded processed for this specific license number . License numbers can not be used more than allowed by your IT department. Error 004 Wrong product code The License number you've entered is not allowed on this software product. This software product requires a specific li[...]

Billion BiGuard VPN Client Chapter 3: Navigation the User Interface 8 Chapter 3: Naviga tion the User Interface Navigation the user interface BiGuard VPN Client is fu lly autonomous and can start and stop tunnels without user intervention, depending on traffic to cert ain destinations. However it requires a VPN configuration. The VPN Client configu[...]

Billion BiGuard VPN Client Chapter 3: Navigation the User Interface 9 A left-button click on VPN icon opens configuration user interface. A right-button click shows the following menu: Quit: will close established VPN tunnels, stop s the configuration user interface. Save & Apply: will close established VPN tunnels, apply latest VPN configurati[...]

Billion BiGuard VPN Client Chapter 3: Navigation the User Interface 10 Main Window The main window is made of several elements: 1. Three buttons “Console”, “Parameters” and “Connections” (left column). 2. A tree list window (left window) that cont ains all IKE and I PSec configuration. 3. A configuration window (right window) that shows[...]

Billion BiGuard VPN Client Chapter 3: Navigation the User Interface 11 S t atus Bar The status bar displays several informations: The lef t side box indicates the VPN configuration locati on. For example, if the "USB Mode" is set, the image will show a USB st ick, enabled or not depending on the presence of a valid VPN USB stick. The cent[...]

Billion BiGuard VPN Client Chapter 3: Navigation the User Interface 12 Hidden Interface The graphical user interface c an be hidden to the end user . We pr ovide configuration tools for IT managers that prevent the end user from changing their c onfiguration. Access to the configuration user interface c an be restricted with configurat ion tool VPN[...]

Billion BiGuard VPN Client Chapter 3: Navigation the User Interface 13 can start with 3 dif ferent modes: St art VPN Client software before MS W indows logon: this mode can be used for secure remote login St art VPN Client software af ter MS Windows logon Don't st art VPN Client when I st art MS Windows: VPN Client is launched by user or from [...]

Billion BiGuard VPN Client Chapter 4: VPN Configuration 14 Chapter 4: VPN Configur a tion Configuration Wizard Four easy step Wizard BiGuard VPN client provides a Configuration Wizard that allows the creation of VPN configuration in four ea sy steps. This Configuration Wizard is designed for remote computers that need to get connected to a cor pora[...]

Billion BiGuard VPN Client Chapter 4: VPN Configuration 15 Step 1 of 4 Y ou need to specify the following information: The public (network side) address of the remote gateway Address (I n IP or Domain name). (e.g. specify gateway .mydomain.com) The Preshared-key you will use for this tunnel (t his Preshared-key must be the same in the gateway). Ste[...]

Billion BiGuard VPN Client Chapter 4: VPN Configuration 16 Step 3 of 4 Y ou need to input this VPN Client IP address that will be used to identify the client in the VPN connection (e.g. specify 192.100.205.101). Step 4 of 4 The fourth step summaries your new VPN configuration. Other parameters may be further configured directly via the main interf [...]

Billion BiGuard VPN Client Chapter 4: VPN Configuration 17 VPN T unnel Configuration How to create a VPN T unnel? T o create a VPN tunnel from the main window ( without using the Confi guration Wizard), you must follow the following steps: 1. Right-click on “Configurati on’ in the tree list window an d select “New Phase 1” 2. Configure Auth[...]

Billion BiGuard VPN Client Chapter 4: VPN Configuration 18 Phase (Phase 1). Advanced Features Advanced features and parameters can be defined for Phase 1 and Phase 2. Those defined in Phase 1 apply to all Phase 2 created in current VPN Configuration: Enable/Disable Config Mode Enable/Disable Agressive Mode Enable/Disable Redundant Gateway Change IK[...]

Billion BiGuard VPN Client Chapter 4: VPN Configuration 19 Phase 1 Settings Description Name: Label for Authentication phase used only the conf iguration user interf ace. This value is never used during IKE negotiation. It is possible to change this name at any time and read it in the tree control. T wo Phase1s cannot have the same name. Interface:[...]

Billion BiGuard VPN Client Chapter 4: VPN Configuration 20 z AES: S tands for Advanced Encryption S tandards, you can use 128, 192 or 256 bit s as encryption method. ~ IKE authentication : It is a Message Digest algorithm which co verts any length of a message into a unique set of bit s. It is widely used MD5 (Message Digest) and SHA (Secure Hash A[...]

Billion BiGuard VPN Client Chapter 4: VPN Configuration 21 ~ Aggressive Mode: If checked, the VPN client will us ed aggressive mode as negotiation mode with the remote router . ~ IKE port: Negotiation port for IKE. Default value is 500. ~ Redundant GW : This allows the VPN Client to open an IPSec tunnel with an alternate gateway in case the primary[...]

Billion BiGuard VPN Client Chapter 4: VPN Configuration 22 If this identity is not set, VPN gateway's IP address is used. IPSec Configuration or Phase 2 What is Phase 2? “IPSec Configuration” or “Phase 2” wi ndow will concern settings for Phase 2. The purpose of Phase 2 is to n egotiate the IPSec security parameters that are applied to[...]

Billion BiGuard VPN Client Chapter 4: VPN Configuration 23 Remote address: This field may be "Remote host address" or "Remote LAN address" depending of the address type. It is the remote IP address, or LAN network address of the gateway , that opens the VPN tunnel. Subnet mask: Subnet mask of the remote LAN. Only available when [...]

Billion BiGuard VPN Client Chapter 4: VPN Configuration 24 Automatic Open mode: The VPN Client can automatically open the specified tunnel (Phase2) on specific events such as: Auto open this tunnel when t he VPN Client start s up. Auto open this tunnel when USB stick is inserted (see section "USB Mode"). Auto open this tunnel when the VPN[...]

Billion BiGuard VPN Client Chapter 4: VPN Configuration 25 Global Parameters – Global Settings Description Global Parameters are generic settings that appl y to all created VPN t unnels. Once modified, click on “Save & Apply” to take you modifications into account. Lifetime (sec.) ~ IKE Default Lifetime (sec.): Default lifetime for IKE re[...]

Billion BiGuard VPN Client Chapter 4: VPN Configuration 26 Miscellaneous: ~ Retransmissions : How many times a message should be retransmitted before giving up. ~ Delay between retries (sec.): W aiting time in an exchange before giving up a negociation. ~ Block non-ciphered connection: When this option is checked, only encrypted traffic is authoriz[...]

Billion BiGuard VPN Client Chapter 4: VPN Configuration 27 USB Mode What is USB Mode? BiGuard VPN Client brings t he capability to secure VPN c onfigurations and VPN security elements (e.g. PreShared key , Certificates , …) by the use of an USB S tick. When you select "USB mode", the VPN configur ation and security elements cont ained i[...]

Billion BiGuard VPN Client Chapter 4: VPN Configuration 28 Once USB mode is set on, the left side box in the status bar show s an USB stick icon. The USB S tick icon is plain when a USB S t ick is plugged in: The USB Stick icon is gray when no USB Stick is plugged in: How to enable a new USB Stick? A new USB S tick (no data) must be enabled by copy[...]

Billion BiGuard VPN Client Chapter 4: VPN Configuration 29 Certificate Management (Please see Appe ndix A - Comp atible t able of Billion VPN enabled devices and BiGuard VPN Client) Additional support document s BiGuard VPN Client uses X509 cert ificates with PEM format. This kind of certificates is created with OpenSSL, not with BiGuard VPN Client[...]

Billion BiGuard VPN Client Chapter 4: VPN Configuration 30 Configuration Management – How to Im port or Export a VPN Configuration? BiGuard VPN Client can im port or export a VPN Conf iguration. With this feature, IT managers can prepare a configuration and deliver it to other users. 1. Importing a configuration, select "File > Import VPN[...]

Billion BiGuard VPN Client Chapter 4: VPN Configuration 31 Configuration T ools Command line tools Those tools are available as co mmand line type and are meant to be used by IT managers to change the IPSec VPN Client behavior to their needs. 1. S topping IPSec VPN Client 2. Import VPN Configuration 3. IPSec VPN Client S tartup mode 4. Hiding IPSec[...]

Billion BiGuard VPN Client Chapter 4: VPN Configuration 32 Console and Logs Console Windows The “Console” window is available from the cont ext menu of the systray ic on or from “Console” button in the configuration user interface. This window can be used to analyze VPN tunnels. This tool is particularly useful fo r IT managers in setting u[...]

Billion BiGuard VPN Client Chapter 4: VPN Configuration 33 Misc (Misc): log level for configuration readi ng or dump of low level messages Tr p t (T ransport): log level for UDP transport mode Msg (Message): log level for IKE decode Cryp (Crypto): log level and dump for cr ypto material exchanged T imr (Time r): log level about timers Sdep (Sysdep)[...]

Billion BiGuard VPN Client Chapter 5: T roubleshooting 34 Chapter 5: T r oubleshooting Introduction The goal of this section is to help IT M anagers, system administrator s or users facing VPN configuration issues of their IPSec VPN net work. All information concerning VPN connection state, VPN trace or VPN Logs can be found in t he "Console&q[...]

Billion BiGuard VPN Client Chapter 5: T roubleshooting 35 « no keyst ate » error 115305 Default sysdep_app_open: Init Connection for : Cnx-Cnx-P2 Cnx-remote-addr 115305 Default sysdep_app_open: IPV4_SUBNET Network 192.168.1.1 115305 Default sysdep_app_open: IPV4_SUBNET Netmask 255.255.255.0 115315 Default (SA Cnx-P1) SEND phase 1 Main Mode [SA][V[...]

Billion BiGuard VPN Client Chapter 5: T roubleshooting 36 115905 Default sysdep_app_open: Init Connection for : Cnx-Cnx-P2 Cnx-remote-addr 115905 Default sysdep_app_open: IPV4_SUBNET Network 192.168.1.1 115905 Default sysdep_app_open: IPV4_SUBNET Netmask 255.255.255.0 115911 Default (SA Cnx-P1) SEND phase 1 Main Mode [SA][VID] 115911 Default RECV I[...]

Billion BiGuard VPN Client Chapter 5: T roubleshooting 37 No response to phase 2 request s 120348 Default (SA CnxVpn1-CnxVpn1-P2) SEND phase 2 Quick Mode [HASH] [SA] [NONCE] [ID] [ID] 120349 Default (SA CnxVpn1-CnxVpn1-P2) SEND phase 2 Quick Mode [HASH] [SA] [NONCE] [ID] [ID] 120351 Default (SA CnxVpn1-CnxVpn1-P2) SEND phase 2 Quick Mode [HASH] [SA[...]

Billion BiGuard VPN Client Appendix A: Comp atible t able of Billion VPN enabled dev ices and BiGuard VPN Client 38 A ppendix A: Compatible table of Billion VPN enabled de vices and BiGuar d VPN Client BIP AC 74xx series BIP AC 75xx series BIP AC 85xx series BiGuard 2/10/30 series Hash algorithms MD5 v v v v SHA1 v v v v Encryption DES v v v v 3DES[...]

Billion BiGuard VPN Client Appendix B: Product Support and Cont act Information 39 APPENDIX B: Pr oduct Suppor t and Contact Inf or ma tion Most problems can be solved by referring to the T roubleshooting section in the User ’s Manual . If you cannot resolve the problem with the T roubleshooting chapter , please contact the dealer where you purch[...]