Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 402 / 861

401 Providing remote access using VPN tunnels
Importing Client VPN information
Special processing is required for a default-ike user. If the Phase 1 ID is default-ikeuser, the Symantec
Client VPN user may be prompted for the user ID for the external authentication server. This value is
used for the Phase 1 ID for that gateway connection. If the user does not enter an ID or cancels from
the prompt, the application generates a Phase 1 ID based on the time of the package. This ensures that
all Phase 1 IDs are unique for each gateway.
When a package is loaded by the Symantec Client VPN, it is logged to the client log file. Any errors are
also logged.
Importing Client VPN information
Large amounts of Symantec Client VPN tunnel information can be imported into the security gateway
from your existing corporate database. By converting tunnel information into a specific format that
SGMI understands, you can import this information without re-keying it.
The minimum security gateway memory requirements for importing tunnels is 9 KB for each tunnel.
Prerequisites
Complete the following tasks before beginning this procedure:
■
“Creating the pkimpvpn file” on page 401
To import Client VPN tunnels
1 In the SGMI, on the File menu, click Import VPN Tunnels .
2 Browse to the pkimpvpn file in the sg directory.
3 Click Import VPN Tunnels .
File import can take several minutes. After the tunnel information is imported, a message is
displayed explaining the new entities that have been created. You can then view your secure
tunnels by clicking the Tunnels tab.
Related information
None.
Creating the pkimpvpn file
For the SGMI to read your tunnel data, it must appear in a particular format in a file called pkimpvpn.
Therefore, you must first convert your tunnel template information into the following format:
tunnel_name vpn_policy global_ike_policy local_entity local_entity_type
local_security_gateway remote_entity remote_entity_type filters
For example:
Mobile_tunnel13 ike_default_crypto global_ike_policy engineering_subnet ENT_SUBNET
local_gateway jsmith ENT_USER
Each entry must be a single line in the pkimpvpn file. You can find a sample pkimpvpn file in the /var/
lib/sg directory. The file is called pkimpvpn.sample.
Referencing the example above, this table explains the information that must appear in each of the
fields of the pkimpvpn file.
Table 10-2 pkimpvpn file format
Field Field name Example Description
1 tunnel_name Mobile_tunnel3 Name of the secure tunnel.
2 vpn_policy vpn_policy VPN policy name. Spaces are not permitted in the name.