University of Colorado at Boulder    
Map A to Z Index Search CU Home
ITS logo
Information Technology Services News | ITS Search

Virtual Private Network (VPN) Information
online resources for network services

 

 
VPN Overview
Support and Information
VPN Software Downloads and Instructions

Learn More
On the ITS site
  ITS Help Centers
  Network Engineering & Operations

 

Installation Instructions for VPN Client on Linux

If you use the client download from this website, the configuration should be preset and usable immediately. There is only a small setup procedure as defined below that is necessary before using the VPN.

1. Download the VPN client here. (If you haven't done so already)

Note: You will need to use your CU Login Name and IdentiKey password to download the client.

2. Extract the files from the compressed tarball.

3. Run the installer as root. (Note: it's always better to execute commands with sudo rather than logging in as root if at all possible.)

>sudo ./vpn_install

Cisco Systems VPN Client Version 4.6.02 (0030) Linux Installer Copyright (C) 1998-2004 Cisco Systems, Inc. All Rights Reserved.

By installing this product you agree that you have read the license.txt file (The VPN Client license) and will comply with its terms.

Directory where binaries will be installed [/usr/local/bin] (common default, but your choice)

Automatically start the VPN service at boot time [yes]no (if you're connecting a lot, you may want to have it start automatically)

In order to build the VPN kernel module, you must have the kernel headers for the version of the kernel you are running.
(you may need to download the kernel source code from Redhat if you chose not to install it during the OS installation.)

Directory containing linux kernel source code
[/lib/modules/2.6.9-11.ELsmp/build] (this is where the kernel source code would be with different numbers depending on your OS version)
Binaries will be installed in "/usr/local/bin". Modules will be installed in "/lib/modules/2.6.9-11.ELsmp/CiscoVPN".
The VPN service will *NOT* be started automatically at boot time.
Kernel source from "/lib/modules/2.6.9-11.ELsmp/build" will be used to build the module.

Is the above correct [y]

Shutting down /opt/cisco-vpnclient/bin/vpnclient: module cisco_ipsec is not running.
Stopped: /etc/init.d/vpnclient_init (VPN init script)
Making module
make -C /lib/modules/2.6.9-11.ELsmp/build
SUBDIRS=/home/buffalor/Desktop/vpnclient modules
make[1]: Entering directory `/usr/src/kernels/2.6.9-11.EL-smp-i686' Building modules, stage 2. MODPOST make[1]: Leaving directory `/usr/src/kernels/2.6.9-11.EL-smp-i686' Create module directory "/lib/modules/2.6.9-11.ELsmp/CiscoVPN".
Copying module to directory "/lib/modules/2.6.9-11.ELsmp/CiscoVPN".
Already have group 'bin'

Creating start/stop script "/etc/init.d/vpnclient_init".
/etc/init.d/vpnclient_init

Installing license.txt (VPN Client license) in "/opt/cisco-vpnclient/":

Installing bundled user profiles in "/etc/opt/cisco-vpnclient/Profiles/":
Replaced Profiles: cuboulder housing oncampus sample

Copying binaries to directory "/opt/cisco-vpnclient/bin".
Adding symlinks to "/usr/local/bin".
/opt/cisco-vpnclient/bin/vpnclient
/opt/cisco-vpnclient/bin/cisco_cert_mgr
/opt/cisco-vpnclient/bin/ipseclog
Copying setuid binaries to directory "/opt/cisco-vpnclient/bin".
/opt/cisco-vpnclient/bin/cvpnd
Copying libraries to directory "/opt/cisco-vpnclient/lib".
/opt/cisco-vpnclient/lib/libvpnapi.so
Copying header files to directory "/opt/cisco-vpnclient/include".
/opt/cisco-vpnclient/include/vpnapi.h

Setting permissions.
/opt/cisco-vpnclient/bin/cvpnd (setuid root)
/opt/cisco-vpnclient (group bin readable)
/etc/opt/cisco-vpnclient (permissions not changed)
You may wish to change these permissions to restrict access to root.
You must run "/etc/init.d/vpnclient_init start" before using the client.
You will need to run this script every time you reboot your computer. (only if you have chosen not to have the vpn client automatically start at boot.)

4. Initialize the VPN client

>sudo /etc/init.d/vpnclient_init start

5. Start the vpn client.

Instructions for On & Off Campus Connections

1. For on campus connections:

>vpnclient connect oncampus

Cisco Systems VPN Client Version 4.6.02 (0030)
Copyright (C) 1998-2004 Cisco Systems, Inc. All Rights Reserved.
Client Type(s): Linux
Running on: Linux 2.6.9-11.ELsmp #1 SMP Fri May 20 18:26:27 EDT 2005 i686
Config file directory: /etc/opt/cisco-vpnclient

Initializing the VPN connection.
Contacting the gateway at 192.168.66.4
Contacting the gateway at 192.168.66.5 (balancing)
User Authentication for oncampus...

Enter Username and Password.

Username []: buffalor (enter your identikey username)
Password []: (enter your identikey password)
Authenticating user.
Negotiating security policies.
Securing communication channel.

Your VPN connection is secure.

VPN tunnel information.
Client address: 128.138.102.15 (actual address may vary)
Server address: 192.168.66.5 (actual address may vary)
Encryption: 168-bit 3-DES
Authentication: HMAC-MD5
IP Compression: None
NAT passthrough is active on port UDP 10000
Local LAN Access is disabled

2. For off campus connections:

>vpnclient connect cuboulder

Cisco Systems VPN Client Version 4.6.02 (0030)
Copyright (C) 1998-2004 Cisco Systems, Inc. All Rights Reserved.
Client Type(s): Linux
Running on: Linux 2.6.9-11.ELsmp #1 SMP Fri May 20 18:26:27 EDT 2005 i686
Config file directory: /etc/opt/cisco-vpnclient

Initializing the VPN connection.
Contacting the gateway at 192.168.66.4
Contacting the gateway at 192.168.66.5 (balancing)
User Authentication for oncampus...

Enter Username and Password.

Username []: buffalor (enter your identikey username)
Password []: (enter your identikey password)
Authenticating user.
Negotiating security policies.
Securing communication channel.

Your VPN connection is secure.

VPN tunnel information.
Client address: 128.138.102.15 (actual address may vary)
Server address: 192.168.66.5 (actual address may vary)
Encryption: 168-bit 3-DES
Authentication: HMAC-MD5
IP Compression: None
NAT passthrough is active on port UDP 10000
Local LAN Access is disabled

3. To disconnect, press Ctrl+c in the shell that you started the client from.

Getting Help

Help Docs
IT Service Center
(303) 735-HELP
help@colorado.edu

       
       Support | Training | Facilities | About ITS | ITS Home
 

Last reviewed: June 26, 2006

itsfeedback@colorado.edu  | Policies | Privacy
© 2000
The Regents of the University of Colorado