Overview:

In short, the process can be described at a high level as download the client; unpack the client to the right folder; run the client install script that will compile it; answer the questions during the install; start the client kernel process and then run the client from the command line to connect. In order to build the VPN kernel module, you must already have the kernel headers properly installed for the version of the kernel you are running and know where they are located.

Contents

• Cisco Documentation
• Before you Begin...
• Installation Commands Step by Step (in brief)
• Un-installing the Client

---

Cisco Documentation

From the Cisco vpnclient-linux-4.8.02.0030-readme.txt :

|| ||

|||| ||||

..:||||||:..:||||||:..

|| ||

C I S C O

Release-Notes

=========================================================================

Revisions:

Release 4.8.02.0030

Files:

vpnclient-linux-x86_64-4.8.02.0030-k9.tar.gz - Linux 32-bit and x86_64 (biarch)

Resolved Issues:

CSCsi82396 Linux VPNclient fails to import chained certificates when using SCEP

CSCsh21567 Mac OS X and Linux license need update

CSCsq09360 Linux IPSec VPN client does not install on linux kernels > 2.6.22

Contents: - See Release Notes for Release 4.8 at:

http://www.cisco.com/en/US/docs/security/vpn_client/cisco_vpn_client/vpn_client48/release/notes/48client.html

Previous revision:

Release 4.8.01.0640

Files:

vpnclient-linux-x86_64-4.8.01.0640-k9.tar.gz - Linux 32-bit and x86_64 (biarch)

---

Before you Begin...

• The VPN client consists of a kernel module and a few command-line executables.
• The kernel module is not pre-compiled, so you need to make sure that kernel sources for each kernel version that you are intending to use with this client are properly installed.
• After successfully establishing a secure connection to the server, the client will listen for packets from the VPN server on 2 ports,UDP 500 and UDP 4500, by default. This means you have to punch a hole in your ipchains/iptables firewall for it. The module will also use IP protocol 50 (ESP) to communicate with the VPN server. That protocol is not filtered by most Linux firewall configurations, however.
• The CISCO documentation mentions several other ports, quoting:
• UDP port 500
• UDP port 10000 and 500 (or any other port number being used for IPSec/UDP)
• IP protocol 50 (ESP)
• NAT-T port 4500 UDP

Allow these ports through your firewall if you don't want any surprises.

• VPN client may not work, when the operating system is running in "Security Enhanced" mode (SELinux). We suggest that you not run the system in this mode, if you plan on using the vpn client. To do this, cd to the /etc/selinux folder ... then edit the config file as follows (change "enforcing" to "disabled"). In this example, it's simply been commented out:
  [root@linuxbox selinux]# more config
  # This file controls the state of SELinux on the system.
  # SELINUX= can take one of these three values:
  # enforcing - SELinux security policy is enforced.
  # permissive - SELinux prints warnings instead of enforcing.
  # disabled - SELinux is fully disabled.
  #SELINUX=enforcing
  SELINUX=disabled
  # SELINUXTYPE= type of policy in use. Possible values are:
  # targeted - Only targeted network daemons are protected.
  # strict - Full SELinux protection.
  SELINUXTYPE=targeted
  [root@linuxbox selinux]#

---

Installation Commands Step by Step (in brief)

Below are step by step quick-start instructions. Be sure to connect to your ISP before starting.

Become super user (root) terminal session:

[user@vpnclient]$ su -
Password: {root's password}

-or-

open a Root Terminal session for instance in Debian

• Change directory to /usr/src:

[root@vpnclient root]# cd /usr/src

• Download the tar ball from the EIU web site:

[root@localhost root]# wget http://its.eiu.edu/software/vpnclient-linux-x86_64-4.8.02.0030-k9.tar.gz

-or- get it with your web browser

Decompress and extract it so that you end up with the files in /usr/src/vpnclient:

[root@vpnclient src]# tar xzvf vpnclient-linux-x86_64-4.8.02.0030-k9.tar.gz

Change directory to /usr/src/vpnclient:

[root@vpnclient src]# cd vpnclient

• Execute the installer script and answer the prompts:

[root@localhost vpnclient]# ./vpn_install

Directory where binaries will be installed [/usr/local/bin] (hit enter)

Automatically start the VPN service at boot time [yes] (hit enter)

The rest of the install text at this point depends on your distribution and kernel... you MUST have the Linux-Headers for yours properly installed before this point and you must get the location of your linux-headers path correct here OR the compile of vpn client will fail.

Is the above correct [y] y

Making module...

... if the compile completed without errors then you're ready to continue.

• Load the VPN client's module into the running kernel:

[root@localhost vpnclient]# /etc/init.d/vpnclient_init start
Starting /opt/cisco-vpnclient/bin/vpnclient: Done

• At this point, we recommend that you restart the operating system ... otherwise, you may get the following message, when invoking the vpnclient: vpnclient: error while loading shared libraries: /opt/cisco-vpnclient/lib/libvpnapi.so: cannot restore segment prot after reloc: Permission denied
• EIU VPN requires a profile to connect. Two are provided, one for off campus users (eiu) and one for on campus users (at_eiu).

• The profiles are already installed in /etc/CiscoSystemsVPNClient/Profiles/:

• To connect, enter your user name and password when prompted:

issue the command: /etc/init.d/vpnclient_init start (if not already started)

For an at home/off campus example:
[root@localhost Profiles]# vpnclient connect eiu

For an on campus example:
[root@localhost Profiles]# vpnclient connect at_eiu

Enter Username and Password.

Username []: (your eiu email username)
Password []: ***************

Note: Leave this terminal session open in order to stay VPN connected.

Note: If you open up another terminal window, and type "ifconfig" you should see - as well as the settings for your network interface, eth0 - another interface listed: "cipsec0" - this is the vpnclient interface. Its IP Address will be listed as well.

• You should now be connected to the EIU network. If the connection attempt fails and you are sure you got your ID and password right then suspect your firewall first. Try disabling it completely then try the connection again! If the firewall interferes with the VPN, you will need to adjust your firewall configuration (see the Before you Begin section at top).

---

Un-installing the Client

• Use the vpn_uninstall script that comes with the client (/usr/src/vpnclient/vpn_uninstall in our example) to remove the client.