Mobile IPSec VPN Client - Windows

Mobile IPSec VPN Client
For Mobile and Remote Virtual Private Networks

Designed specifically for the mobile work force, the Mobile IPSec VPN Client provides the vital ability for remote users to initiate VPN communication with corporate resources. Road warriors and telecommuters need to access mission critical networks over the Internet and often use unsecured public networks or untrusted local networks. A VPN connection may connect end-users that need a secure host to transmit sensitive information.

The Mobile IPSec VPN Client uses the IPSec ESP tunnel mode to form a secure communications channel to a network secured by a GTA Firewall. It provides VPN capability to desktop and notebook computers running Microsoft Windows, Linux and Mac operating systems, enabling secure client-to-client or client-to-gateway communication over TCP/IP networks. The Mobile IPSec VPN Client can be used with IPSec gateways and firewalls, or another host running IPSec compatible VPN software such as another Mobile IPSec VPN Client. Secured encrypted communications can be initiated in any IP environment, such as Ethernet LAN, NAT, DSL or dial-up.

Macintosh IPSec VPN Client

Simple Configuration and Installation
The Mobile IPSec VPN Client is easy to configure and install. Firewall administrators configure the Mobile IPSec Client on the firewall in a few simple steps and all installation and certificate information is provided via the GTA Remote Access Portal. Users can log in and download the installer, certificates, and installation guide for Windows, Linux and Mac operating systems. IPSec Client policies are also dynamically generated and available for download via the firewall.

Interoperability
The Mobile IPSec VPN Client transparently creates a VPN when operating on the Internet, including when utilizing NAT-T. With the client, secure connections can be made with all IPSec complaint network products, such as routers, gateway encryptors, and firewalls. Multiple encryption and authentication algorithms are employed, including DES, 3DES, AES, MD-5 and SHA-1. IKE is supported in main, quick and aggressive modes. Additionally, the Mobile IPSec VPN Client supports certificates for connectivity to third party firewalls and VPN devices that support them. Certificates from Microsoft, Netscape, Entrust, Verisign and Baltimore Technologies are used with Simple Certificate Enrollment Protocol (SCEP). XAUTH (Extended Authentication Protocol) V.6 supports RSA SecurID and RADIUS.

Security Standards

• IPSec with IKE RFCs 2401 and 2409
• Tunnel Mode
• Transport Mode
• NAT-T RFCs 3947 and 3948
• X.509 Certificate Support - PKCS#12, PEM, SmartCard
• Pre-shared Key Authentication
• XAUTH Authentication
• DES 56-bit Encryption
• 3DES 168-bit Encryption
• AES with 128-, 192-, or 256-bit Encryption
• HMAC MD-5 128 Authentication Hash Algorithm
• HMAC SHA-1 160-bit Authencation Hash Algorithm
• Diffie Hellman Group 1, Group 2, Group 5, Group 14 Support
• IP Payload Compression Protocol (IPCOMP)

VPN Configuration Wizard provides a format for entering primary VPN configuration specifications, and automatically creates the necessary VPN policy. Manual configuration and management of digital certificates is available a graphical user interface.

Create and distribute customized installations for easy setup. Policies and be imported or exported allowing easy implementation of the same policy on multiple PC workstations. The USB drive mode allows pre-loading a policy and a USB drive which is required to be installed on the PC workstation for the VPN tunnel to operate.

Security policies can be locked and hidden to ensure network security. By locking the policy and using the hidden mode, network administrators can prevent unauthorized or accidental changes to the VPN policy, reducing the calls for support.

If a computer has not logged in with the VPN gateway (GTA firewall), the connection is denied (1a). if a computer provides authorization credentials such as a password and pre-shared secret, the VPN gateway adds the computer to its list of computers allowed to connect (1b).

Once authorized, a computer can use encryption to prevent digital eavesdropping (packet sniffing) by any in-between points on the Internet, including unauthorized hosts.