Linux VPN Client for Cisco VPNs: vpnc

配置Cisco VPN客户端的一篇参考文章：引自http://www.linuxplanet.com/linuxplanet/tutorials/6773/1

The Cisco VPN client, vpnc, enables your Linux workstation to connect to a Cisco 3000 series VPN concentrator PIX firewall. Until vpnc existed, corporate employees were often relegated to connecting to their company's network via a Windows machine or with Cisco's problematic VPN client for Linux. Thankfully, those days are over, but not without slight configuration effort. In this article we show you how to get it up and running.

Information You Will Need

802.11ac Action Plan: A Network-Readiness Checklist

Download Now

Before you can connect, you will likely need to know the following information. If you do not have it, now is a good time to gather:

• IPSEC gateway: the hostname or IP of the VPN server
• IPSEC ID: the groupname
• IPSEC secret: the shared password for the group
• your username
• your password

The group name and shared password is the most often used method for connecting to the Cisco IPSEC VPN. In lieu of certificates, this pre-shared key enables the forming of an IPSEC tunnel based on the shared secret.

Install Options

Depending on your Linux distribution, you will need to install the vpnc program before we can begin. Fedora, by default, now installs vpnc, so Fedora users can skip to the next section. Ubuntu users can run apt-get install vpnc as root.

Configuring vpnc ManuallyYou will likely want to use NetworkManager to enable quick VPN connections with a mouse-click in GNOME. Fedora's NetworkManager is already prepared, but in Ubuntu you will need to install the network-manager-vpnc package.

If you are short on time, or the "jt make it work" type, this section is optional, so feel free to skip ahead to the NetworkManager section below.

Now that vpnc is installed, you will notice an /etc/vpnc/ directory. This is where we will be working for a bit. Creating a configuration file is optional, but without it, you will enter all the necessary information manually every time you wish to connect to the VPN. If you wish to test your IP, group information, and user credentials, go ahead and manually run 'vpnc' as root.

The configuration file for vpnc is quite simple. Create a file named after the network you wish to connect to, for example: /etc/vpnc/enp.conf

Inside, you need to enter the information we talked about in the beginning of this article. Replace the example values with your information:

• IPSec gateway: vpn17.example.com
• IPSec ID: groupa
• IPSec secret: groupapassword
• Xauth username: charlie
• Xauth password: passw0rd

Except, the group password needs to be decoded before handing it to vpnc. This is the major pain point for most users, and vpnc should automatically do this, but it does not. Enter the group password you were given by the VPN administrator into this Web page, and use the result as your group password:http://www.unix-ag.uni-kl.de/~massar/bin/cisco-decode.

If you enter your username and password into the configuration file, ensure the permissions do not allow world-read access, especially if other user accounts exist on your workstation or laptop. In fact, you should think twice about storing this password at all, just in case your machine is ever compromised. If your password is not stored in the configuration file, you will be prompted for it when connecting.

Now that the configuration file exists, you can simply run sudo vpnc enp.conf(or leave off the .conf). You will now be connected to the VPN. If everything worked, and you will notice a new 'tun' interface in the 'ifconfig' output.

To disconnect from the VPN, simply run sudo vpnc-disconnect

Do note that the default route gets replaced with the VPN router (so all traffic goes through the VPN) when you are connected. See the vpnc man page for help changing this behavior, or simply remember to disconnect from the VPN when you are done.

Pro Tip: if you have established SSH connections, they will drop when you connect to the VPN. To avoid this, do not let vpnc change your default route. Configure vpnc to add just the routes to the networks you wish to access via the VPN, ensuring you specify tun0 as the interface. All your normal traffic will survive VPN connects and disconnects, including your existing SSH sessions (assuming they are not to IPs within the range of the VPN network).

Using NetworkManager

If the NetworkManager vpnc plug-in is installed, you will be able to select the Cisco VPN option. The next screen will require that you enter the above mentioned information for the VPN connection. The GUI also presents you with the option to save your password.To create a new VPN connection using GNOME's NetworkManager, click the network icon in the upper-right hand corner of the screen, then select VPN Connections -> Configure VPN. Click "Add" to create a new VPN connection.

After you click Apply, you're done. To connect to the VPN, simply select the VPN name you entered via the NetworkManager Gnome applet under VPN Connections, and it will connect automatically.

When he's not writing for Enterprise Networking Planet or riding his motorcycle, Charlie Schluting is the Associate Director of Computing Infrastructure at Portland State University. Charlie also operatesOmniTraining.net, and recently finished Network Ninja, a must-read for every network engineer.