To use this guide you need to be familiar with your computer’s
operating system. If you have questions about navigating in your
computer’s environment, please refer to your system user manual.
The following conventions are used in this guide.
ConventionIndication
Bold typeMenu commands, dialog box options, Web page
options, Web page names. For example: “On the
System Information page, select Disabled.”
NOTEImportant information, a helpful tip or additional
instructions.
iiMUVPN Client
Notice to Users
Information in this guide is subject to change without notice. Companies, names, and data
used in examples herein are fictitious unless otherwise noted. No part of this guide may be
reproduced or transmitted in any form or by any means, electronic or mechanical, for any
purpose, without the express written permission of WatchGuard Technologies, Inc.
Microsoft®, Internet Explorer®, Windows® 95, Windows® 98, Windows NT® and
Windows® 2000 are either registered trademarks or trademarks of Microsoft Corporation
in the United States and/or other countries.
Netscape and Netscape Navigator are registered trademarks of Netscape Communications
Corporation in the United States and other countries.
RealNetworks, RealAudio, and RealVideo are either a registered trademark or trademark of
RealNetworks, Inc. in the United States and/or other countries.
Java and all Jave-based marks are trademarks or registered trademarks of Sun
Microsystems, Inc. in the United States and other countries. All right reserved.
1. Redistributions of source code must retain the above copyright notice, this list of
conditions and the following disclaimer.
MUVPN Clients Guideiii
2. Redistributions in binary form must reproduce the above copyright notice, this list of
conditions and the following disclaimer in the documentation and/or other materials
provided with the distribution.
3. All advertising materials mentioning features or use of this software must display the
following acknowledgment: "This product includes software developed by the OpenSSL
Project for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to endorse or
promote products derived from this software without prior written permission. For written
permission, please contact openssl-core@openssl.org.
5. Products derived from this software may not be called "OpenSSL" nor may "OpenSSL"
appear in their names without prior written permission of the OpenSSL Project.
6. Redistributions of any form whatsoever must retain the following acknowledgment: "This
product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit
(http://www.openssl.org/)"
THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL
PROJECT OR ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
This product includes cryptographic software written by Eric Young
(eay@cryptsoft.com). This product includes software written by Tim
Hudson (tjh@cryptsoft.com).
Redistribution and use in source and binary forms, with or without modification, are
permitted provided that the following conditions are met:
1. Redistributions of source code must retain the copyright notice, this list of conditions and
the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice, this list of
conditions and the following disclaimer in the documentation and/or other materials
provided with the distribution.
3. All advertising materials mentioning features or use of this software must display the
following acknowledgement: "This product includes cryptographic software written by Eric
Young (eay@cryptsoft.com)" The word 'cryptographic' can be left out if the routines from the
library being used are not cryptographic related :-).
4. If you include any Windows specific code (or a derivative thereof) from the apps directory
(application code) you must include an acknowledgement: "This product includes software
written by Tim Hudson (tjh@cryptsoft.com)"
THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND ANY EXPRESS OR
IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR
CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
DAMAGE.
The licence and distribution terms for any publicly available version or derivative of this
code cannot be changed. i.e. this code cannot simply be copied and put under another
distribution licence [including the GNU Public Licence.]
The mod_ssl package falls under the Open-Source Software label because it's distributed
under a BSD-style license. The detailed license information follows.
Copyright (c) 1998-2001 Ralf S. Engelschall. All rights reserved.
Redistribution and use in source and binary forms, with or without modification, are
permitted provided that the following conditions are met:
1. Redistributions of source code must retain the above copyright notice, this list of
conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice, this list of
conditions and the following disclaimer in the documentation and/or other materials
provided with the distribution.
3. All advertising materials mentioning features or use of this software must display the
following acknowledgment:
MUVPN Clients Guidev
"This product includes software developed by Ralf S. Engelschall <rse@engelschall.com>
for use in the mod_ssl project (http://www.modssl.org/)."
4. The names "mod_ssl" must not be used to endorse or promote products derived from this
software without prior written permission. For written permission, please contact
rse@engelschall.com.
5. Products derived from this software may not be called "mod_ssl" nor may "mod_ssl"
appear in their names without prior written permission of Ralf S. Engelschall.
6. Redistributions of any form whatsoever must retain the following acknowledgment: "This
product includes software developed by Ralf S. Engelschall <rse@engelschall.com> for use
in the mod_ssl project (http://www.modssl.org/)."
THIS SOFTWARE IS PROVIDED BY RALF S. ENGELSCHALL ``AS IS'' AND ANY
EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL RALF S.
ENGELSCHALL OR HIS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
INCIDENTAL, SPECIAL,
EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
DAMAGE.
The Apache Software License, Version 1.1
Copyright (c) 2000 The Apache Software Foundation. All rights reserved.
Redistribution and use in source and binary forms, with or without modification, are
permitted provided that the following conditions are met:
1. Redistributions of source code must retain the above copyright notice, this list of
conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice, this list of
conditions and the following disclaimer in the documentation and/or other materials
provided with the distribution.
3. The end-user documentation included with the redistribution, if any, must include the
following acknowledgment:
"This product includes software developed by the Apache Software Foundation (http://
www.apache.org/)." Alternately, this acknowledgment may appear in the software itself, if
and wherever such third-party acknowledgments normally appear.
4. The names "Apache" and "Apache Software Foundation" must not be used to endorse or
promote products derived from this software without prior written permission. For written
permission, please contact apache@apache.org.
viMUVPN Client
5. Products derived from this software may not be called "Apache", nor may "Apache" appear
in their name, without prior written permission of the Apache Software Foundation.
THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE APACHE SOFTWARE FOUNDATION OR
ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
DAMAGE.
This software consists of voluntary contributions made by many individuals on behalf of the
Apache Software Foundation. For more information on the Apache Software Foundation,
please see <http://www.apache.org/>.
Portions of this software are based upon public domain software originally written at the
National Center for Supercomputing Applications, University of Illinois, Urbana-Champaign
All other trademarks or trade names mentioned herein, if any, are the property of their
respective owners.
Part No
MUVPN Clients Guidevii
viiiMUVPN Client
Contents
CHAPTER 1 Configure the SOHO 6.............................. 1
Redeem your SOHO 6 Upgrade Options.......................... 2
Configure the SOHO 6 for MUVPN Clients........................ 3
CHAPTER 2 Preparation, Installation, and Connection7
Prepare the Remote Computers....................................... 7
Install the MUVPN Client................................................ 19
Connect and Disconnect the MUVPN Client.................... 27
Monitor the MUVPN Client Connection........................... 31
System requirements..................................................... 8
Windows 98/ME operating system setup........................... 8
Windows NT operating system setup.............................. 11
Windows 2000 operating system setup........................... 13
Windows XP operating system setup.............................. 16
Configuring the MUVPN Client...................................... 21
Uninstall the MUVPN client........................................... 25
Connecting the MUVPN Client...................................... 27
The Mobile User VPN client icon.................................... 27
Allowing the MUVPN client through the personal firewall.... 29
Disconnecting the MUVPN client................................... 30
The Log Viewer.......................................................... 31
MUVPN Client Guideix
The Connection Monitor...............................................31
CHAPTER 3 The ZoneAlarm Personal Firewall...........33
Copyright and Patent Information................................... 59
xMUVPN Client
CHAPTER 1Configure the SOHO 6
This guide applies to both the SOHO 6TM and the SOHO 6tcTM–the name
SOHO 6 is used to refer to both these devices throughout the guide. The
only difference between them is the ability to create and use a Virtual
Private Network (VPN) other than the MUVPN client. This VPN option
can be added to the SOHO 6, while the SOHO 6tc comes with the VPN
option already installed and is used to create a Branch Office VPN tunnel
between two IPSec compliant devices allowing data from an entire
network rather than a single remote user.
This chapter describes how to configure a SOHO 6 for use with the
Watch Guard
® Mobile User VPN (MUVPN)™ client.
Redeem your SOHO 6 Upgrade Options
When you purchase a SOHO 6, the software for all upgrade options is
provided with the unit regardless of whether you have actually
purchased any of those options. The Feature Key that enables these
software options is stored within the SOHO 6. Once you purchase an
upgrade option and redeem it at the LiveSecurity Service Web site, you
will receive a Feature Key, which you can then copy and paste into a
SOHO 6 configuration page, to activate the software upgrade.
MUVPN Client Guide1
CHAPTER 1: Configure the SOHO 6
For information on registering your SOHO 6 with the LiveSecurity
Service, see “Register your SOHO 6 and Activate the LiveSecurity
Service” in the WatchGuard Firebox SOHO 6 User Guide.
Follow these steps to redeem your upgrade option license key:
1With your Web browser, go to:
2Click the LiveSecurity link at the top of the page and log into the site.
3Follow the instructions provided on the site to redeem your upgrade
license key.
4Copy the Feature Key displayed at the LiveSecurity Service Web site.
5With your Web browser, go to the System Status page using the
Trusted IP address of the SOHO 6.
For example, if using the default IP address, go to: http://192.168.111.1
6From the navigation bar on the left side, select Administration =>
Upgrade.
The Upgrade page appears.
http://www.watchguard.com/upgrade
7Paste the Feature Key in the appropriate field.
8Click Submit.
2MUVPN Client
Configure the SOHO 6 for MUVPN Clients
Configure the SOHO 6 for MUVPN Clients
Flow these steps to configure your SOHO 6:
1With your Web browser, go to the System Status page using the
Trusted IP address of the SOHO 6.
For example, if using the default IP address, go to: http://192.168.111.1
2From the navigation bar on the right side, select VPN => MUVPN
Clients.
The MUVPN Clients page appears.
3Click the Add button.
The Add MUVPN Client page appears.
MUVPN Client Guide3
CHAPTER 1: Configure the SOHO 6
4Enter a Username in the appropriate field.
This Username will be used as the E-mail Address when setting up the MUVPN
client. In our example, Helmdog.
5Enter a Passphrase in the appropriate field.
This passphrase will be used as the Pre-Shared Key when setting up the MUVPN
client. In our example, pL4n3phr34k
6Enter the Virtual IP address which will be used by the MUVPN
computer when connecting to the SOHO 6 in the appropriate field.
In our example, 192.168.111.4.
7Select the Authentication Algorithm.
In our example, SHA1-HMAC.
8Select the Encryption Algorithm.
In our example, 3DECS-CBC.
9Click the Submit button.
4MUVPN Client
CHAPTER 2Preparation, Installation, and
Connection
Watch Guard® Mobile User VPN (MUVPN)™ client uses Internet Protocol
Security (IPSec) to establish a secure connection over an unsecured
network from a remote computer to your protected network.
For example, the MUVPN client is installed on an employee’s computer,
on the road or working from home. The employee establishes a standard
Internet connection and activates the MUVPN client. The MUVPN client
then creates an encrypted tunnel to your trusted network, protected
behind a SOHO 6. The MUVPN client allows you to provide remote
access to your internal networks without compromising security.
®
ZoneAlarm
optional feature with the MUVPN client to provide further security for
your end users.
, a personal firewall software application, is included as an
The purpose of this guide is to assist users of the SOHO 6 to set up the
MUVPN client on an end-user’s remote computer and to explain the
features of the personal firewall.
MUVPN Client Guide7
CHAPTER 2: Preparation, Installation, and Connection
Prepare the Remote Computers
The MUVPN client is only compatible with the Windows operating
system. Every Windows system used as a MUVPN remote computer must
have the following system requirements.
System requirements
•PC-compatible computer with Pentium processor or equivalent
•Compatible operating systems and minimum RAM:
- Microsoft Windows 98: 32 MB
- Microsoft Windows ME: 64 MB
- Microsoft Windows NT 4.0 Workstation: 32 MB
- Microsoft Windows 2000 Professional: 64 MB
- Microsoft Windows XP: 64 MB
•The latest service packs for each operating system are recommended,
but not necessarily required.
•10 MB hard disk space
•Native Microsoft TCP/IP communications protocol
•Microsoft Internet Explorer 5.0 or later
•An Internet Service Provider account
•A Dial-Up or Broadband (DSL or Cable modem) Connection
Additionally, in order for Windows file and print sharing to occur
through the MUVPN client tunnel each Windows operating system must
have the proper components installed and configured to use the remote
WINS and DNS servers on the trusted and optional networks behind the
Firebox.
N
OTE
However, if you plan to use the MUVPN client virtual adapter, the WINS
not
and DNS settings are
on the Firebox.
8MUVPN Client
configured on the client computers, but rather
Windows 98/ME operating system setup
The following networking components must be configured and installed
on a remote computer running Windows 98/ME in order for the MUVPN
client to function properly.
Configuring networking names
From the Windows desktop:
1Select Start => Settings => Control Panel. Double-click the Network
icon.
The Network window appears.
2Verify that the Client for Microsoft Networks is installed.
If Client for Microsoft Networks is not installed, you
instructions, see the following section, “Installing the Client for Microsoft
Networks”.
3Click the Identification tab.
4Enter a name for the remote computer.
This
must
be a unique name on the remote network.
5Enter the domain name you are connecting to.
This should be the same as the Logon to Windows NT domain value.
6Enter a description for your computer (optional).
7Click OK. Click OK to close and save changes to the Network control
panel.
Click Cancel if you do not want to save any changes.
8Reboot the machine.
Prepare the Remote Computers
must
install it. For
Installing the Client for Microsoft Networks
From the Networks window:
1Click the Configuration tab. Click Add.
The Select Network Component Type window appears.
2Select Client. Click Add.
The Select Network Client window appears.
3Select Microsoft from the list on the left. Select Client for Microsoft
Networks from the list on the right. Click OK.
4Select Client for Microsoft Networks.
5Click Properties.
6Enable the Log on to Windows NT domain option.
MUVPN Client Guide9
CHAPTER 2: Preparation, Installation, and Connection
7In the Windows NT Domain field, type the domain name.
For example, your domains might be sales, office, and warehouse.
8Enable the Logon and Restore Network Connections option.
Installing Dial-Up Networking
The Mobile User VPN Adapter, which supports L2TP, installs only if Dialup Networking is already installed on your computer. If Dial-up
Networking is not installed, follow these instructions.
From the Windows desktop:
1Select Start => Settings => Control Panel. Double-click the Add/
Remove Programs icon.
The Add/Remove Properties window appears.
2Click the Windows Setup tab.
The Windows Setup dialog box appears and searches for installed components.
3Enable the Communications checkbox and click the OK button.
The Copying Files dialog box appears and copies the necessary files.
4The Dial-Up Networking Setup dialog box appears and prompts you
to restart the computer. Click the OK button.
The computer reboots.
Further, Windows 98 requires that the Dial-up Networking component be
updated with the 1.4 patch. Please see the Microsoft Web site to receive
this free update.
Configuring the WINS and DNS settings
Yo u must configure the remote computer to use the WINS and DNS
servers of the trusted network behind the Firebox only if you do not plan
to use the MUVPN client’s virtual adapter.
From the Windows desktop:
1Select Start => Settings => Control Panel. Double-click the Network
icon.
The Network window appears.
2Select the network component TCP/IP => Dial-Up Adapter, then click
the Properties button.
The TCP/IP Properties Information dialog box appears.
3Click the OK button.
10MUVPN Client
Prepare the Remote Computers
4Click the DNS Configuration tab.
Verify that the Enable DNS option has been enabled.
5Under the “DNS Server Search Order” heading, enter your DNS
server IP address, then click the Add button.
If you have multiple remote DNS servers repeat this step.
N
OTE
Yo u
must
list the DNS server on the Private network behind the Firebox
first.
6Click the WINS Configuration tab.
7Verify that the Enable WINS Resolution option has been enabled.
8Under the “WINS Server Search Order” heading, enter your WINS
server IP address, then click the Add button.
If you have multiple remote WINS servers repeat this step.
9Click the OK button to close the TCP/IP Properties window.
10 Click the OK button to close the Network window.
The System Settings Change dialog box appears.
11 Click the Ye s button to restart the computer and implement the
changes.
Windows NT operating system setup
The following networking components must be installed and configured
on a remote computer running Windows NT in order for the MUVPN
client to function properly.
Installing Remote Access Services on Windows NT
The Mobile User VPN Adapter, which supports L2TP, installs only if the
Remote Access Services (RAS) network component is already installed on
the computer.
Follow the Windows desktop:
1Select Start => Settings => Control Panel. Double-click the Network
icon.
2Select the Services tab.
3Click the Add button.
MUVPN Client Guide11
CHAPTER 2: Preparation, Installation, and Connection
4Select Remote Access Services from the list, then click the OK button.
5Enter the path to the Windows NT install files or insert your system
installation CD, then click the OK button.
The Remote Access Setup dialog box appears.
6 Click the Ye s button to add a RAS capable device and enable you to
add a modem.
7Click the Add button and complete the Install New Modem wizard.
If there is no modem installed, you can enable the Don't detect my modem;
I will select it from a list checkbox then add a Standard 28800 modem.
Windows NT requires at least one RAS device such as a modem if the
RAS component is installed. If no modems are available, a dial-up
networking, serial cable between two computers can be selected.
8Select the modem added in the last step in the Add RAS Device dialog
box, then click the OK button.
9Click the Continue button, then click the Close button.
10 Reboot your computer.
N
OTE
Configuring the WINS and DNS settings
Yo u must configure the remote computer to use the WINS and DNS
servers of the trusted network behind the Firebox only if you do not plan
to use the MUVPN client’s virtual adapter.
From the Windows desktop:
1Select Start => Settings => Control Panel. Double-click the Network
icon.
The Network window appears.
2Click the Protocols tab.
3Select the TCP/IP protocol and click the Properties button.
The Microsoft TCP/IP Properties window appears.
4Click the DNS tab.
5Click the Add button.
6Enter your DNS server IP address in the appropriate field.
If you have multiple remote DNS servers repeat the previous three steps.
12MUVPN Client
Loading...
+ 46 hidden pages
You need points to download manuals.
1 point = 1 manual.
You can buy points or you can get point for every manual you upload.