Release Notes Symantec TM VPN Client Enterprise This document contains the following information about the Symantec Enterprise VPN Client, Version 7.0.1: What s new System requirements Installing the VPN Client patch release Service and support For the most current product information, refer to the electronic release notes at www.symantec.com. July 19, 2002
2 SymantecTM Enterprise VPN Client What s new What s new New features This section describes new VPN Client features as well as the problems that have been fixed in the 7.0.1 patch release. Automatic MTU size calculation The correct MTU size for the current connection is automatically calculated when the Using PPPoE connection option is checked. If an adjustment is necessary, the calculated MTU size will display and the adjustment will take place after a restart. Enabling this option has no effect on product compatibility with other PPPoE software (for example, WinPoet); rather, enabling this option ensures that the correct MTU size is automatically calculated for the current connection. Note: Make sure you have connected to the Internet using the appropriate ISP connection to be adjusted, before checking the Using PPPoE connection option. To revert to your previous settings, uncheck the Using PPPoE connection option and restart your computer. Personal firewall changes Support for Microsoft Networking has been improved on Windows 2000 and Windows XP operating systems. If File/Print Sharing is enabled, local LAN browsing without WINS works; if File/Print Sharing is disabled, certain Microsoft Networking broadcasts are dropped, and your computer does not appear in your neighbor s network neighborhood. You should enable file/print sharing for connectivity between PCs on your local LAN segment. For example, when using a laptop computer in an office protected by a corporate firewall, enable File/Print sharing. When using your laptop at home on the Internet, you should disable File/Print sharing. You do not have to restart your system after enabling or disabling File/Print Sharing for the changes to take affect. Note: The File/Print Sharing feature should only be enabled if you are protected by another firewall.
SymantecTM Enterprise VPN Client What s new 3 Resolved Issues Suppressing the logon dialog If you have saved your logon password, and want to suppress the log on dialog, add the command line switch /d at the end of the target line in the Symantec Enterprise VPN Client shortcut. For example, the syntax of the command line would be: C:\Program Files\Symantec\VPNClient\nsetup.exe /d Network browsing and drive mapping problems If File/Print Sharing is enabled, local LAN browsing and mapping of network drives may not work. See Personal firewall changes on page 2. This problem occurred on all platforms and has been fixed. Unable to obtain new DHCP address In some scenarios, the VPN Client may be unable to obtain a new DHCP address. This could happen if your laptop obtains a DHCP address while it is connected to a corporate network, and is then reconnected to your home network that uses a different DHCP server. In this situation, you would not be able to use the DHCP address from your home network and you would have problems connecting to the Internet. The problem occurred on Microsoft Windows 2000 and Microsoft XP operating systems and has been fixed. Confusing error message when gateway is not accessible during tunnel download If the security gateway is inaccessible, or if the IP address or DNS name for the gateway is not properly typed, the resulting error message does not clearly explain the problem. The message has been fixed and now fully explains the problem and solution. Client ID confusing to user when defining gateway In previous releases, when a security gateway is defined, the VPN client user name became the default Client ID. This was confusing, since the default client id is seldom the correct value and users do not notice that the default client id may not be correct for their environment.
4 SymantecTM Enterprise VPN Client What s new In version 7.0.1 the Client ID field is now blank. When defining a security gateway, be sure to enter the desired value in the Client ID text box. Tunnel does not pass traffic after certain rekey operations If the VPN client performs a rekey, the tunnel may be unable to pass network traffic and you see the following message in the log file: isakmpd[776]: 457 libvpnapi Error: Failed to tell daemon vpnd to Add TunnelId 1.isakmp.6 This problem has been fixed. DNS and WINS information not restored after gateway disconnect In some scenarios, the VPN client does not restore DNS and WINS information after a gateway is disconnected. This causes problems in resolving network names when the gateway is not connected. This problem has been fixed. Lost user preferences if there is more than one VPN client user on a system If there are multiple VPN client users installed on a system, some of the user option settings (such as save logon password and auto-dial on program start) may not be properly saved when switching from one user to another. This problem has been fixed.
SymantecTM Enterprise VPN Client System requirements 5 System requirements Operating system This section describes the minimum hardware and software computer configuration for the VPN Client software. Windows 2000 with Service Pack 1 or 2 Windows 98 Windows 98 SE Hardware requirements Windows Millennium Windows NT Server/Workstation with Service Pack 6a or later Windows XP Professional Hardware requirements are as specified by Microsoft for operating systems support: 9 MB free hard drive space for files Microsoft TCP/IP This protocol must be installed and bound to the network adapters that will be used by the VPN Client. You can verify this by connecting to the Internet, browsing to, and attempting to ping the IP address of the VPN server. Network adapter Your network adapter must be installed and configured as you intend to use it with the VPN Client. The VPN Client supports the Microsoft Dial-Up Adapter and network interface cards (NICs). The following interface configurations are supported. - Dial-up - One or more NICs (Ethernet/Token Ring) - Dial-up and one or more NICs (Ethernet/Token Ring)
6 SymantecTM Enterprise VPN Client Installing the VPN Client patch release Unsupported network adapters The following network adapters (NICs) are not supported by the VPN Client: Linksys EC2T PCMCIA Ethernet card IBM Auto 16/4 Token Ring PCMCIA card HP EN-1207D-TX PCI 10/100 Fast Ethernet Model Installing the VPN Client patch release Service and support This section describes how to install the VPN Client patch release. Before beginning, make sure you have installed the 7.0 Symantec VPN Client. You must be running the 7.0 client before you can install the version 7.01 patch release. Also, close all other applications before you begin. To install the VPN Client patch release 1 Download the appropriate self-extracting executable (SEVPNDES701.EXE or SEVPN3DES701.EXE) of the 7.0.1 patch release from the support section of Symantec s Web site at www.symantec.com/techsupp/. 2 On your computer s hard drive, double-click on the file to begin installation. 3 Restart the computer once the installation is complete. For access to technical product information, our Corporate knowledge base, FAQs, and online Symantec Support, visit the Services and Support section of our Corporate Web Site at www.symantec.com/techsupp/. This section provides limitations associated with this patch release. Where possible, a workaround is suggested. Unless specified, these issues apply to Windows 2000, Windows 98, Windows NT, Windows ME, and Windows XP mobile clients. Users must reconnect when VPN Policy changes If your system administrator makes changes to your VPN configuration, while you are connected, you must disconnect and then reconnect the tunnel to take advantage of the new or changed settings.
SymantecTM Enterprise VPN Client 7 Unable to reconnect when returning from standby mode Cannot reconnect a tunnel after leaving standby mode. This issue applies to Windows 2000 and Windows XP operating systems. Exit and then log on to the VPN Client. Adapter card disabled when set to duplex In Windows XP Professional, if you change the setting of the Xircom Credit Card Elite Ethernet Adapter to duplex, with the VPN Client installed, the card becomes disabled. Do not make any configuration changes to the adapter card after the VPN Client software is installed. If you need to make changes, you must first uninstall the VPN Client software, make changes, and then reinstall the client software. No automatic WINS support on Windows 98 or Windows Millennium If your internal network uses WINS, find the computer by name or the internal host may fail. Do one of the following: Use DNS names such as host.company.com. Use a numeric IP address such as 1.2.3.4. Type individual computer names with their IP addresses in the lmhosts file and use the #PRE keyword. Type the WINS server addresses under TCP/IP Properties for the LAN adapters used for tunnels, then restart. For dial-up connections, go to the Properties page of the connection inside the Dial-Up Networking folder. Then click the TCP/IP Settings button. You must type your ISP DNS server IP addresses at the same time.
8 SymantecTM Enterprise VPN Client WinPoET software WinPoET s PPPoE device driver is incompatible with our product. (WinPoET is a trademark of Wind River Systems, Inc). Do one of the following: Use a different PPPoE software package. Use an intermediary device (such as a Nexland ISB2LAN or ISBPro) between your service provider s modem and your PC. Have your DSL line provisioned to not require PPPoE. Network log on for Windows Millennium dial-up adapters This issue occurs when there are no LAN adapters installed in a computer. If Net Use is run in a DOS box, it reports, You must log on before performing this operation. Do the following: 1 In the Dial-Up Networking folder, right-click on the name of a connection that a tunnel will be going over. 2 In the Properties dialog click Security panel. 3 In the Advanced Security Options checkbox, select Log on to Network. VPN Client driver error messages in Device Manager On Windows 98 and ME, the Device Manager displays the VPN Client driver with a yellow exclamation point, and the driver status indicates that This device is either not present, not working, or does not have all the drivers installed (code 10). This message is incorrect. The VPN Client driver works properly.
SymantecTM Enterprise VPN Client 9 Autodial feature may not connect correctly with IBM Global Dialer When using the IBM Global Dialer with the autodial feature, the connection to your ISP may not work correctly. This may result in losing the ability to ping or connect to your VPN Server across the Internet. Complete the following procedure: Network adapters on Windows NT 1 Disable the VPN Client s autodial function. 2 Start the IBM Global Dialer before you start the VPN Client. 3 When using the autodial function, if your user name appears in the format: login.internet.<company>.<username> 4 Edit the entry to remove the login string, for example: internet.<company>.<username> After installing VPN Client, network adapters that were previously disabled might be re-enabled. None. Upgrading Windows operating systems VPN Client does not support upgrading to a different Windows operating system; for example, upgrading to Windows Millennium. RAS server on NT Uninstall VPN Client before upgrading the Windows operating system. Re-install VPN Client after the upgrade is complete. You cannot use the VPN Client on an NT server supporting incoming RAS connections. These are dial-in connections. Use a Windows 2000 server instead.
10 SymantecTM Enterprise VPN Client Write access to the VPN product directory is required VPN Client users must have write access to the VPN Client directory. Otherwise, users will be unable to use the VPN Client. This problem occurs if the VPN Client is installed on an NTFS partition and users do not have write access to the VPN Client directory. Grant write access to the VPN directory for all users who will be using the VPN Client. Using Lotus Notes/Outlook 2002 on Windows 2000 (with Service Pack 2) Sending Lotus Notes/Outlook 2002 mail through the VPN tunnel fails. The VPN Client needs a hotfix from Microsoft. Contact Microsoft for the Windows 2000 hotfix. Refer to the following knowledge base article: Q301337. Tunnels using Entrust certificates Issue 1: When connecting a tunnel using Entrust certificates, the following error message may be logged: 120 isakmpd info: If you don t want to enforce phase1 id to be included in peer cert, set config variable isakmpd.enforce_id_cert=0 Perform the following steps: 1 Edit the config.cf file in the VPNClient directory. 2 Uncomment the line isakmpd.enforce_id_in_cert=0, save the file. 3 Logout, and log back into the VPN Client.
SymantecTM Enterprise VPN Client 11 Issue 2: When configuring the Entrust certificate, you copy the entrust.ini and user.epf files to the VPNClient directory. When the VPN Client is uninstalled, the entrust.ini file is not deleted. Therefore, when you reinstall the VPN Client and reconfigure Entrust certificates, you are prompted that the file already exists. When prompted, choose to overwrite the existing entrust.ini file. Installing into a non-default directory on Windows XP If you install version 7.0 or higher of the VPN Client in a directory other than the default on Windows XP, if the directory path ends with a trailing slash (\), the VPN Client will not work properly. Do not end a non-default directory path with a trailing slash (\) when installing the VPN Client on Windows XP.
12 SymantecTM Enterprise VPN Client