Cisco VPN Client Readme file
============================


This file describes the contents of the Cisco VPN Client files for the Linux platform

Refer to the Bug Navigator on Cisco Connection Online for open issues:
http://www.cisco.com/support/bugtools/bugtool.shtml



Revision: Release 4.8.00.0490

Files:    
vpnclient-linux-x86_64-4.8.00.0490-k9.tar.gz

Contents:


New Features:

Two new Certificate features have been added to dynamically map a Certificate to a profile without
manual selection by the user.  See the Certificate notes at the end of this document for details.


Versioning Notes:

This release is a Beta for the VPN Client installed on biarch* linux systems for x86_64 platforms.
The client is NOT compatible with pure 64-bit operating systems.
The client operates on both 32-bit i386 and biarch x86_64 operating systems.
On i386 32-bit operating systems, this release is not cosidered a Beta.
The VPN Client now requires GLIBC_2.2 and libstdc++.so.5.  Distributions like RedHat 9 and SuSe 9 comply with these requirements.

* biarch = 64-bit kernel that allows execution of 32-bit applications.


4.7.00.0640 is expected to be the last release of the non-x86 version of the Linux VPN Client.
The non-x86 version supports platforms that do not have the GLIBC_2.2 and libstdc++.so.5 (such as versions prior to RedHat 9 and SuSe 9).



Resolved Issues


CSCsc39924  unity linux client fails to install on machines running kernel 2.6.14
CSCeh67124  unity clients should not filter local multi/broadcast beside firewall
CSCei03756  unity linux 64 bit machines application unable to communicate
CSCei32030  unity certificatekeyusage precedence failover 


Unresolved Issues



Revision: Release 4.6 Rel
Files:    vpnclient-linux-x86_64-4.6.03.0190.Rel-k9.tar.gz

Contents: - See Release Notes for Release 4.6 Rel at:
            http://www.cisco.com/univercd/cc/td/doc/product/vpn/client/index.htm


Certificate Matching Details:

1. Cerificate Extended Key Usage Matching
Profile Keyword: CertMatchEKU

Description:
This parameter specifies the list of Extended Key Usage fields that the client should honor. When 
this profile keyword is specified, the client looks only at those certs (irrespective of certificate 
store) whose Extended Key Usage fields match those that are specified by the profile keyword, during 
a connection attempt.

ie. When this profile keyword is specified, for any given cert, at least one of the Extended Key 
Usage fields specified in the profile keyword must be present in the certificate's Extended Key 
Usage field.

This keyword applies to connection attempts only and not to any other 
certificate-related operation (viz. listing certs, viewing certs, etc).
This keyword applies of all forms of certificate selection 
( viz. CertSerialHash, CertMatchDN, CertSubjectName, CertName).
The value of this keyword is a comma separated list of Extended Key Usage OID strings.

Example:
CertMatchEKU=1.3.6.1.5.5.7.3.2,1.3.6.1.5.5.7.3.1
1.3.6.1.5.5.7.3.2 => Client Authentication
1.3.6.1.5.5.7.3.1 => Server Authentication

Custom Extended Key Usage Strings must be of the form 
1.3.6.1.5.5.7.3.X, where X can be any number.


2. Certificate Key Usage Matching
Profile Keyword: CertMatchKU

Description:
The feature allows the profile selection of Certificates based on the Key Usage as well as the DN and 
Extended Key Usage fields.  This keyword overrides the vpnclient.ini keyword "CertificateKeyUsage".

CertMatchKU=0,3,4,5

DIGITAL_SIGNATURE  8
NON_REPUDIATION    7
KEY_ENCIPHERMENT   6
DATA_ENCIPHERMENT  5
KEY_AGREEMENT      4
KEY_CERT_SIGN      3
CRL_SIGN           2
ENCIPHER_ONLY      1
DECIPHER_ONLY      0

If the Certificate matches any of the usages in the CertMatchKU field, it will pass on to the next 
criteria.  Otherwise the Certificate will not be selected.

[Main]
Host=1.2.3.4
AuthType=3
CertStore=2
CertName=myMultipleCerts
CertMatchKU=7
!CertSubjectName=
!CertSerialHash=

If two identical Certificates except for Key Usage were available to the profile above, only the one 
with Non-Repudiation would be chosen.


3. Certificate Fall Through.
This behavior is implicit and does not have any profile keyword associated with it. For a given 
connection attempt, a certificate can be selected using one or more of four keywords given below 
(in order of precedence).

a) CertMatchEKU and CertMatchKU
b) CertSerialHash
c) CertMatchDN
d) CertSubjectName
e) CertName

If the client cannot find a cert in the given cert store using all four Certificate keywords noted above, 
the connection attempt fails.

Sample profile:

[Main]
Host=10.10.10.10
AuthType=3
CertStore=2
!UserName=
!UserPassword=
CertMatchKU=7
CertMatchEKU=1.3.6.1.5.5.7.3.2,1.3.6.1.5.5.7.3.1
CertMatchDN=issuer-ou*"vpn group",ea*"Cisco.com"
!CertSerialHash=

The profile above will only match certificates that have a Key Usage of "Non-Repudiation" AND have EITHER 
Client or Server Authentication in the Extended Key Usage.  The Issuer-ou field MUST contain "vpn group" 
and the email address for the user Certificate MUST contain "cisco.com" (case insensitive). 

The scenario above would allow a common workstation to connect users based on their smart card 
certificates.  A user could walk up, put in their card, and hit connect.  The generic profile above would
find the proper certificate on their card (without restarting the client or modifying the profile) and 
prompt them for their Certificate password, username, and password.  The concentrator could also be 
configured to connect without a username and rely entirely upon the Certificates for authentication.

Note the use of the "!" character in the profile.  This prevents the previous user's information from 
being retained between connections.






# Firewall configuration written by Cisco Systems
# Designed for the Linux VPN Client 4.8.00.0490 Virtual Adapter
# Blocks ALL traffic on eth0 except for tunneled traffic
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]

# Allow all traffic in both directions through the VA adapter
-A INPUT -i cipsec0 -j ACCEPT
-A OUTPUT -o cipsec0 -j ACCEPT

# Accept all encrypted VPN Client traffic in either direction on eth0
-A INPUT -i eth0 -p udp -s 0/0 --sport 500 -d 0/0 --dport 500 -j ACCEPT 
-A OUTPUT -o eth0 -p udp -s 0/0 --sport 500 -d 0/0 --dport 500 -j ACCEPT 

-A INPUT -i eth0 -p udp -s 0/0 --sport 4500 -d 0/0 --dport 4500 -j ACCEPT 
-A OUTPUT -o eth0 -p udp -s 0/0 --sport 4500 -d 0/0 --dport 4500 -j ACCEPT 

-A OUTPUT -o eth0 -p udp -s 0/0 --sport 1024: -d 0/0 --dport 29747 -j ACCEPT 

# Block all other traffic in either direction on eth0
-A INPUT -i eth0 -j REJECT 
-A OUTPUT -o eth0 -j REJECT
COMMIT