the implied warranties of merchantability and fitness for a particular purpose, are ma de in relation to the accuracy, reliability or contents of this document. Nokia reserves
the right to revise this document or withdraw it at any time without prior notice
The availability of particular products may vary by region. Please check with the Nokia dealer nearest to you.
With virtual private networking (VPN), you can create
encrypted connections to information you need while
away from the office. You are in touch and in control with
encrypted access to your enterprise network for email,
database applications, and intranet.
Remote network traffic needs to be protected. Your
company might use a VPN to tunnel network traffic and
apply appropriate security policies. A VPN helps provide
network transactions with privacy and integrity and
Virtual private networking
allows users to be authenticated and authorized for
access to networks and network services.
To create a VPN, a gateway and the device authenticate
each other and negotiate encryption and authentication
algorithms to help protect the privacy and integrity of the
information that you access.
Managing virtual private
networking
To use VPN connections, you first create VPN access
points, and then select VPN access points when you use
applications to connect to the enterprise. A VPN
connection is created to the enterprise network over
another type of Internet access point connection. The
connection is created and encrypted according to a VPN
policy that is loaded when you connect to a VPN access
point.
To use virtual private networking
1 Install VPN client.
For more information, see “Installing VPN client” on
page 5.
2 Specify a connection to a VPN policy server.
You can specify settings for a VPN policy server in VPN
management or install the settings from a Symbian
installation system (SIS) file.
For more information, see “Connecting to VPN policy
servers” on page 8.
Note: If you install VPN policies from SIS
files, you do not have to create connections
to VPN policy servers.
3 Install VPN policies from the VPN policy server.
For more information, see “Installing VPN policies from
VPN policy servers” on page 5.
4 Create VPN access points.
VPN access points specify an Internet access point and
a VPN policy.
Note: VPN access points combine VPN
policies with Internet access points. When
you synchronise a VPN policy server for the
first time, matching VPN access points are
created for each policy that you install on the
device.
For more information about creating and selecting VPN
access points, see “Managing VPN access points” on
page 11.
5 Select a VPN access point when you use applications to
connect to the enterprise network.
For more information, see “Using VPN with
applications” on page 13.
A VPN connection is created on top of the Internet
access point connection.
Installing VPN client
You receive VPN client as a standard SIS file. You install
VPN client on a device in the same way that you install
other software. For more information about how to install
software on a device, see the documentation of the device.
You do not need the VPN client SIS file after the
installation. Delete the SIS file to release memory.
System requirements
You can install VPN client on a memory card or on device
memory. The memory card must be in the device for VPN
client to work.
During the installation of VPN client, you need at least 1.5
MB of memory in the device.
After the installation, VPN client reserves 900 K of
memory on the device or on a memory card. Each VPN
policy typically requires from 1 K to 16 K of memory on
the device.
Managing VPN policies
VPN policies define the method that VPN client and a VPN
gateway use to authenticate each other and the
encryption algorithms that they use to help protect the
confidentiality of the data. Administrators create VPN
policies and store them on VPN policy servers or deliver
them to you as SIS files. You install VPN policies from a
VPN policy server in VPN management.
Installing VPN policies from VPN
policy servers
In VPN management, you can install VPN policies from a
VPN policy server.
Tip! VPN policy servers are servers on the
enterprise network that contain VPN policies.
4 Specify settings for connecting to a VPN policy server
and press Done.
For more information, see “Connecting to VPN policy
servers” on page 8.
5 Press Yes to synchronise the VPN policy server.
6 Create a key store password and press OK.
Tip! A key store password helps protect
private keys in VPN policies and VPN policy
server connections from unauthorized use.
For more information, see “Creating or changing a key
store password” on page 13.
Virtual private networking
The device connects to the VPN policy server.
7 Verify the identity code of the VPN policy server and
key in the missing characters to establish trust
between the device and the VPN policy server and
press OK.
You can skip this step if you install the settings for the
VPN policy server from a SIS file.
Tip! A VPN policy server identity code is the
fingerprint of the VPN policy server
certificate, which identifies the certificate.
For more information, see “Adding VPN policy servers”
on page 9.
8 Key in authentication information to access the VPN
policy server and press OK.
Administrators tell you what information to key in.
VPN policies are installed on the device.
Note: If you press Cancel, VPN policies are not
installed. Select Install to install VPN policies
from a VPN policy server.
Installing VPN policies from SIS files
Administrators can deliver VPN policies to you as SIS files.
If you install VPN policies from SIS files, you do not have
to define connections to VPN policy servers. After you
install VPN policies, you can create VPN access points and
associate them to applications.
If the VPN policies contain private keys and corresponding
certificates, administrators define key import passwords
to help protect the private keys. Administrators should use
a secure method to deliver the key import password to
you.
Tip! A key import password helps protect the
private keys in a VPN policy file.
To install VPN policies from SIS files, type the key import
password in Password and press OK. Then type the key store
password in Password and press OK.
Viewing VPN policies
In VPN management, you can view, update, and delete the
VPN policies that you install on a device.
To view VPN policy details, select a VPN policy and press
Scroll to view the following information about each VPN
policy:
• Description shows additional information about the
VPN policy. The description is read from the VPN policy.
Administrators define the description when they create
the VPN policy.
• Policy status indicates whether the VPN policy is ready
to use or not or whether it is already in use.
• Certificate status indicates whether valid user
certificates are available in the device.
• Policy name shows the name of the VPN policy.
Administrators define the name when they create the
VPN policy.
• Policy server name shows the name of the VPN policy
server from where you installed the VPN policy. You
give names to VPN policy servers when you define
connections to VPN policy servers. This field is hidden
if you installed the VPN policy from a SIS file.
• Updated shows the date when the VPN policy was last
updated from the VPN policy server. This field is hidden
if you installed the VPN policy from a SIS file.
Checking policy status
Policy status can have the following values:
Active — you created a connection to a VPN access point
that is associated with the VPN policy. When you create a
connection, the VPN policy is activated.
Associated with a VPN access point — you associated the VPN
policy with one or several VPN access points. You can
select any of the VPN access points to activate the VPN
policy.
Not associated with a VPN access point — you must associate
the VPN policy with a VPN access point to activate the
VPN policy.
Note: The VPN policy details view is not
refreshed if the policy status changes while
the view is open.
Checking certificate status
Certificate status can have the following values:
OK — at least one valid certificate is available in the
device or you do not use certificates to authenticate to
VPN gateways.
Expired — lifetime of one or more certificates has ended.
If you cannot create a VPN connection, update the VPN
policy to enroll new certificates.
Missing — One or more of the required certificates cannot
be found on the device. If you cannot create a VPN
connection, try to update the VPN policy to enroll new
certificates.
Not yet valid — one or more certificates are for future use.
This value might also mean that the date and time on the
device are set in the past, time zones are not set correctly,
or the daylight-saving setting is turned on.
When you create a connection to a VPN access point, VPN
client checks the status of the VPN policy that is
associated with the VPN access point from the VPN policy
server. If administrators created a new version of the VPN
policy, the new version is installed on the device. If
administrators deleted the VPN policy from the VPN policy
server, the VPN policy is removed from the device.
Changes become effective the next time you create a
connection to the VPN access point, so they do not affect
the current VPN connection.
Virtual private networking
You can also update a VPN policy in VPN management.
To update a VPN policy, select a VPN policy and press
Update. VPN client checks the status of the VPN policy
from the VPN policy server.
Deleting VPN policies
VPN policies are deleted automatically after
administrators delete them from the VPN policy server
when you update a VPN policy or synchronise the VPN
policy server.
If you delete a VPN policy in VPN management that still
exists on the VPN policy server, the VPN policy is installed
again when you synchronise VPN policies from the VPN
policy server.
To delete a VPN policy, select the VPN policy, and press
Ctrl + D.
You cannot use a VPN access point if you delete the VPN
policy that is associated with it.
Managing VPN policy servers
In Policy servers, you can install VPN policies from VPN
policy servers. When you create a connection to a VPN
access point, the device connects to the VPN policy server
to automatically update the VPN policy that is associated
with the VPN access point. To update all VPN policies,
synchronise VPN policy servers with the device.
Connecting to VPN policy servers
When you install VPN policies from a VPN policy server,
you create a trust relationship between the device and the
VPN policy server. To create the trust relationship, you
must authenticate the VPN policy server and the VPN
policy server must authenticate you.
After the VPN policy server authenticates you, VPN client
generates a private key and enrolls a corresponding
certificate for you. The private key and certificate are
stored in a key store on the device. The certificate
authenticates you to the VPN policy server.
Tip! Administrators can deliver to you a SIS file
that contains settings that specify a connection
to a VPN policy server or you can add the VPN
policy server in VPN management.
You can install VPN policy server settings on the VPN
policy server from a SIS file. You install the settings on a
device in the same way that you install other software.
The settings consist of the address and server certificate of
the VPN policy server. The server certificate makes the
device trust the VPN policy server, so you only need to
present a user name and password to prove your identity.
The SIS file does not contain settings for the Internet
access point to connect to the VPN policy server. To specify
the Internet access point, edit VPN policy server settings.
You can also select the Internet access point when you
connect to the VPN policy server.
If administrators do not sign the SIS file, a security
warning is displayed when you install the SIS file. You can
ignore the warning if you can be sure that you received the
SIS file from administrators.
You must exit VPN management before you install the
settings from a SIS file or installation fails.
Adding VPN policy servers
In Policy servers, you can specify settings for a VPN policy
server if you do not install the settings from a SIS file.
When you connect to the VPN policy server address for the
first time, the device does not trust the VPN policy server,
so you must authenticate the VPN policy server. You
receive a VPN policy server identity code from
administrators. You check and complete the VPN policy
server identity code and VPN client verifies it.
After successful authentication, VPN client enrolls a
certificate from the VPN policy server for subsequent
authentication to the VPN policy server.
To add a VPN policy server, press New. Key in the
following settings:
• Policy server name — you can choose any name, but it
must be unique in VPN policy servers.
If you leave this field empty, Policy server address is
inserted in this field.
The policy server name appears in the VPN policy
server list and on the title bar of the VPN policy server
settings dialog.
• Policy server address — host name or IP address of the
VPN policy server to install VPN policies from. You can
also specify a port number, separated with a colon (:).
You receive the policy server address from
administrators.
• Internet access point — Internet access point used to
connect to this VPN policy server.
Administrators tell you which access point to select.
To install VPN policies from the VPN policy server,
press Yes when VPN management prompts you to
sychronise the VPN policy server.
Tip! Synchronising means that VPN client
connects to a VPN policy server to check for
new, updated, or removed VPN policies and installs the
VPN policies on the device.
When you connect to the VPN policy server address for
the first time, the VPN policy server is not trusted, so you
must authenticate the VPN policy server. You receive a
VPN policy server identity code from administrators.
To verify the identity of the VPN policy server, carefully
compare the VPN policy server identity code in the VPN
policy server identity code dialog with the code that you
receive from administrators, key in the missing characters
in Missing characters, and press OK.
Virtual private networking
To authenticate to the VPN policy server, key in your
user name in Policy server user name and password in Policy
server password and press OK in the VPN policy server
authentication dialog.
Administrators tell you the user name and password to
key in.
VPN client enrolls a certificate for subsequent
authentication to the VPN policy server and installs VPN
policies on the device.
Note: If you install VPN policy server settings
from a SIS file, you do not have to verify VPN
server identity and this view never appears.
Tip! A policy server user name and password
help protect the VPN policy server from
unauthorized access.
Tip! Enrolling a certificate means sending a
certification request to a certification authority
and receiving a certificate.
You can now create VPN access points and associate them
with applications.
Editing VPN policy servers
In Policy servers, you can view, edit, synchronise, and delete
VPN policy servers.
To view or change the settings for a VPN policy server,
select the VPN policy server and press Edit to change:
• Policy server name — name for the policy server. Policy
servers shows the new name.
• Internet access point — Internet access point used to
connect to this VPN policy server.
If you deleted the access point that is associated with
the VPN policy server, Internet access point shows the
text (not selected). If you deleted all access points, VPN
management cannot save the settings.
You cannot change Policy server address after you install
VPN policies from the VPN policy server, because the VPN
policy server sends the address to VPN management during
the first connection.
To delete the VPN policy server, press Delete.
To save the settings, press Done.
Tip! To close the view without saving your changes, press Esc.
To install and update policies from the VPN policy
server, select a VPN policy server and press Synchronise.
VPN client connects to the VPN policy server to check
whether administrators added, updated, or deleted VPN
policies.
If the VPN policy server contains new VPN policies or new
versions of VPN policies, the VPN policies are installed on
the device. If administrators deleted VPN policies from the
VPN policy server, the VPN policies are removed from the
device.
Note: When you synchronise a VPN policy
server for the first time, matching VPN access
points are created for each policy that you
install on the device. VPN access points
combine VPN policies with Internet access
points.
When you connect to a VPN policy server to install or
update VPN policies, you might need to enroll VPN
certificates from the VPN policy server.
Enrolling VPN certificates
VPN client creates a certification request for each required
certificate and sends the request to the VPN policy server.
The VPN policy server enrolls each requested certificate
from a certification authority and returns it to VPN client.
The certification request and the corresponding
certificate contain the identity of the user. Depending on
the VPN policy server configuration, the VPN policy server
user identity might be used as the user identity in VPN
certificates. If this is not possible, VPN management asks
the user identity from you for a particular domain.
Administrators tell you what information to key in.
To create certification requests, in the VPN user identity
dialog, key in your certificate user identity for the
specified domain in User identity and press OK.
Deleting VPN policy servers
To delete a VPN policy server, select the VPN policy
server and press Ctrl + D.
VPN management asks you to confirm the deletion of the
VPN policies that you installed from the VPN policy server.
Managing VPN access points
A VPN access point is a virtual access point that combines
a VPN policy and an Internet access point. Select a VPN
access point in Internet access point lists to create a VPN
connection.
In VPN access points, you can view, create, and delete VPN
access points on the device. Go to Tools > Control panel >
Connections > VPN access points. An icon indicates the type
of the Internet connection over which the VPN
connection is created.
To create VPN access points, press New. In General
settings, key in the following settings:
• VPN access point name — identifies the VPN access
point in Internet access point lists.
• Internet access point — name of the Internet connection
over which the VPN connection is created.
• VPN policy — name of the VPN policy that is associated
with the VPN access point.
• Network — identifies the VPN network.
You must select a different network than the network
for the Internet access point.
Virtual private networking
To select a network, go to Network and press Change:
• Select a network and press OK.
• To add a network, press New network, key in a name
• To rename a network, press Rename network, change
To specify settings for a proxy server in the enterprise
network, go to Proxy settings and key in the following
settings:
Note: If you create VPN connections to
several VPN gateways, create separate
networks for connecting to each VPN
gateway.
for the network in Network name, and press OK.
the network name in Network name, and press OK.
Note: A proxy server is an intermediate server
that acts as a security barrier between an
intranet and the Internet. Administrators tell
you the appropriate settings.
• Proxy protocol — protocol that the proxy server uses.
• Use proxy server — select Yes to specify settings for a
proxy server in the enterprise network.
• Proxy server — address of a proxy server in the
enterprise network.
• Port number — port number to connect to the proxy
server.
• No proxy for — Internet addresses to bypass the proxy
server for particular sites.
To view and edit VPN access point settings, select a VPN
access point and press Edit.
To delete a VPN access point, select a VPN access point
and press Ctrl + D.
To save the settings, press Done.
Tip! To close the view without saving your changes, press Esc.
Viewing the VPN log
The VPN log contains log messages that are recorded when
you update and synchronise VPN policies and use VPN
access points to create VPN connections to VPN gateways.
In Log, you can view and clear log messages. You can view
the message type, the time when each message is
recorded, and the beginning of the log message.
Log sorts log messages by the time and date when they are
recorded, most recent messages first. You can view
messages up to the time when you opened Log.
To view the most recent log messages, press Refresh.
Log messages can contain error, status, and reason codes.
Report the codes to administrators when you report errors.
To delete all log messages from the log, press Clear log.
Log messages are recorded to a circular buffer. When the
log size reaches 20 kilobytes, new log messages are written
on top of the oldest log messages.
Key store passwords
In Password, you can create or change a key store
password. A key store password helps protect private keys
in the device and VPN policy server connections from
unauthorized use.
Creating or changing a key store
password
You create a key store password when you install the first
VPN policy. Create key store passwords that are long and
difficult enough to help protect the information in the
device. If the key store password is broken, the enterprise
network might be exposed to unauthorised access.
Tip! A key store password must be at least six
characters long and can contain letters,
numbers, and special characters.
To change the key store password, press Change
password.
Key in a password that is easy for you to remember but
difficult for anyone else to guess in Password. To avoid
typing errors, key in the password again in Confirm and
press OK.
Entering key store passwords
You must enter the key store password when you:
• Install new or updated VPN policies from VPN policy
servers.
• Use applications to connect to VPN access points that
require certificate authentication.
Using VPN with applications
When you use an application to create a connection to a
VPN access point, the device:
• Connects to the Internet access point that is
associated with the VPN access point.
• Loads the VPN policy that is associated with the VPN
access point.
• Connects to a VPN gateway to create a VPN
connection.
You need to prove your identity when you log on to the
enterprise VPN. The VPN policy determines the
authentication method that you use:
• Certificate-based authentication — you must have a
certificate that a trusted certification authority signs.
You use online certificate enrollment to obtain the
certificate or you install certificates when you install
the VPN policy from a SIS file.
• Legacy authentication — you use user names and
passwords or passcodes to authenticate.
Virtual private networking
Administrators create the user names and passwords
or give you SecurID tokens to generate the passcodes.
If you use certificates for authentication, enter the key
store password.
If you use legacy authentication, key in VPN
authentication information when you use applications to
connect to VPN access points and the device negotiates
encrypted connections with the VPN gateway.
To use usernames and passwords to authenticate to a
VPN gateway, key in your VPN user name in VPN user
name and VPN password in VPN password. Press OK.
To use usernames and passcodes to authenticate to a
VPN gateway, key in your VPN user name in VPN user
name. Generate a SecurID passcode and key in it in VPN
passcode. Press OK.
If the SecurID token has become out of synchronisation
with the time clock of the ACE/Server, you are prompted
for the next passcode that the ACE/Server uses as a new
reference for the time base of the token. Key in your VPN
user name in VPN user name. Generate and key in a new
passcode in Next passcode and press OK. If this fails,
contact administrators.
Troubleshooting
This section lists error messages in alphabetical order,
describes the possible causes of the errors, and suggests
actions to recover from the errors.
Authentication failed.
• You key in an incorrect user name or password when
you authenticate to a VPN policy server or log on to a
VPN.
• You key in the wrong passcode when you are prompted
for the Next passcode.
Try the following solutions:
• Check your user name and password and try again.
• Generate and key in a passcode.
Automatic policy server logon failed. Enter policy server user
name and password to continue.
The certificate that authenticates you to the VPN policy
server expires or administrators revoke the certificate.
Report this error to administrators, who give you a onetime password for logon. Key in the user name and onetime password to authenticate to the VPN policy server.
VPN client enrolls a new certificate for you.
Automatic policy server logon failed. See VPN log for details.
The validity period of the certificate that authenticates you
to the VPN policy server has not begun yet.
Check the date and time settings or wait until the validity
period of the certificate begins.
Crypto library is too weak.
If the cryptographic library that is installed on the device
is too weak, you cannot use VPN connections.
Contact administrators.
Incorrect password.
You key in an incorrect key store password or key import
password.
Check the password and try again.
You receive the key import password from administrators.
You create the key store password yourself.
Policy server is currently in use. Unable to delete.
You cannot delete a VPN policy server while you update
VPN policies from the server. If you use an application that
creates a connection to a VPN access point, VPN policies
are automatically updated.
Wait until VPN policy update finishes and try again.
Policy server logon failed. Delete and re-create the server
definition.
The server certificate of the VPN policy server expires.
To delete the VPN policy server, select the VPN policy
server in Policy servers and press Ctrl + D.
To add the VPN policy server again, press New, or ask
the administrator for a SIS file that contains new settings
for the VPN policy server.
Policy update failed. See VPN log for details.
Policy server synchronisation failed. See VPN log for details.
An error occurs while VPN policies are downloaded from
the VPN policy server or installed on the device.
To update a VPN policy, select a VPN policy in Policies
and press Update.
To install policies from the VPN policy server, select a
VPN policy server in Policy servers and press Synchronise.
Server identity code is incorrect.
You key in an incorrect string when you are prompted to
key in the VPN policy server identity code.
Check the VPN policy server identity code carefully
against the code that you receive from administrators and
key in the missing characters again.
VPN connection activation failed. See VPN log for details.
Legacy authentication failed or the certificate that you
use to authenticate to the VPN gateway is missing,
expired, or its validity period has not begun yet.
Check the date and time settings on the device.
To update a VPN policy, select a VPN policy in Policies
and press Update.
VPN policy in use has been deleted. Try reconfiguring the
internet access point.
The VPN policy that was associated with the VPN access
point became obsolete and was deleted automatically.
To associate another VPN policy with the VPN access
Virtual private networking
point, in VPN access points, select the VPN access point,
and press Edit.
Certificate status
Confirm
Description
Internet access point
Network
Next passcode
No proxy for
Password
Policy name
Policy server address
Policy server name
Policy server password
Policy server user name
Policy status
13
12
13
14
7
7, 8
7
12
7
7
11
7
14
12
10, 11
12
7
9, 12
9
7, 9
10
10
files
13
12
12
12
7
12
11
12
14
14
12
14
5
5, 11
9
9, 12
1313
Port number
Proxy protocol
Proxy server
Updated
Use proxy server
User identity
VPN access point name
VPN passcode
VPN password
VPN policy
VPN user name
I
Incorrect password15
installing
Connectivity Client
VPN policies
VPN policy server settings from SIS
Next passcode field
No proxy for field
not yet valid certificates
P
Password field13
Policy name field
Policy server address field
Policy server is currently in use
Policy server logon failed
Policy server name field
Policy server password field
Policy server user name field
Policy status field
Policy update failed
Port number field
Proxy protocol field
Proxy server field
Proxy settings view
7
12
12
12
14
12
7
7
9
15
7, 9
10
7
15
12
12
12
12
10
15
R
Refresh button13
Rename network button
S
SecurID passcode14
Select network view
selecting networks
Server identity code is incorrect
system requirements
U
Updated field7
Use proxy server field
User identity field
V
VPN
about
4
authenticating to
using with applications
VPN access point name field
VPN access points
deleting
12
editing
12
managing
view
VPN connection activation failed
VPN log
clearing
view
VPN passcode field
11
11
13
12
12
12
12
5
12
11
14
13
12
14
15
15
VPN password field
VPN policies
about
deleting
details
installing
managing
status
updating
VPN policy field
VPN policy in use has been deleted
VPN policy servers