Creating a Road Warrior-to-Gateway Connection

1. From the Start Menu of the Windows client, select Programs, SoftRemoteLT, Security Policy Editor.

   
   
   

   
   
   
   

2. The Security Policy Editor menu will appear. From the tool-bar select Options.

   
   
   

   
   
   
   

3. From the Options menu choose Certificate Manager.

   
   
   

   
   
   
   

4. The Certificate Manager window will appear. In the current tab, My Certificates, click the Import Certificate button.

   
   
   

   
   
   
   

5. Select the Browse button from the Import Personal Certificate menu, to search for the PKCS#12 Certificate. Make certain under the File of Type pull-down menu Personal Certificate (PKCS12)(*.p12) is selected. Once the file has been located click Open.

   
   
   

   
   
   
   

6. On the Import Personal Certificate menu make certain the PKCS#12 Personal Certificate check-box is selected under the Import Type.
7. Enter the password used when the certificate was created into the Password field and click the Import button.

   
   
   

   
   
   
   

8. You will be prompted to verify the certificate. Click Yes.

   
   
   

   
   
   
   

9. The certificate will now be listed in the My Certificates tab of the Certificate Manager.

   
   
   

   
   
   
   

10. From the Certificate Manager menu select the Root CA Certificate tab and click the Import Certificate... button.

    
    
    

    
    
    
    

11. Under the Files of Type pull-down menu choose Binary certificate files (*.der) in the Import CA Certificate menu.
12. Browse to where the saved certificate is, select the certificate and click Import.
13. Click the Close button after adding these certificates.

    
    
    

    
    
    
    

14. From the Security Policy Editor window click Edit from the tool-bar, then select Add and Connection.

    
    
    

    
    
    
    
    1. Rename the new connection to an appropriate name such as in the example below. When new connection is first created you have the option to rename it. To change it later select Edit from the tool-bar and then click Rename.
    2. Under Connection Security, select Secure.
    3. Confirm the Only Connect Manually checkbox is not checked.
    4. Under Remote Party Identity and Address, from the ID Type pull-down select Distinguished Name.
    5. Click the Edit Name... button.
    6. Fill in the Edit Distinguished Name fields with the CA Certificate from the Guardian Digital VPN server that was imported earlier.

       
       
       

       
       
       
       

    7. Next the IP Address of the Guardian Digital VPN server needs to be entered in to the IP Address field located next to the Edit Name... button.
    8. Confirm the Protocol field is set to All.
    9. Make certain the Connect Using checkbox is not checked and the entire field is grayed out.

    
    
    
    
    
    
    

15. Expand the new connection that was just created in the Network Security Policy section by clicking on the '+' next to the name.
16. Two options will appear. Select My Identity by clicking on it once.

    
    
    

    
    
    
    
    1. Under Select Certificate found in the My Identity portion of the right-side window, select from the pull-down menu the certificate that was imported earlier.
    2. From the ID Type pull-down menu Distinguished Name should be selected. The fields around it should be grayed out and filled in with information from the certificate.
    3. In the Internet Interface pull-down make sure Any is selected. This will gray out the other fields in this section.

    
    
    
    
    
    
    

17. From the Network Security Policy window select the second option below the new connection, Security Policy.
    1. Under Select Phase 1 Negotiation Mode, select Main Mode.
    2. Check the Enable Perfect Forward Secrecy (PFS) box.
    3. From the PFS Key Group pull-down menu select Diffie Hellman Group 2.\
    4. Remove the check from Enable Replay Detection.

    
    
    
    
    
    
    

18. In Network Security Policy expand the Security Policy by clicking the '+', then expand Authentication (Phase 1), and highlight Proposal 1.
    1. For the Authentication Method choose RSA Signatures.
    2. Under Encryption and Data Integrity Algorithms, for Encrypt Alg, choose Triple DES.
    3. Select SHA-1 for the Hash Alg.
    4. Under SA Life, choose Seconds, and enter 300 (5 minutes) for the number of seconds.
    5. Lastly select Diffie-Hellman Group 2 from the Key Group pull-down menu.
    
    
    
    
    
    
    

19. Returning to the Network Security Policy window, expand Key Exchange (Phase 2) by clicking the '+', and highlight Proposal 1.
    1. In the IP Sec Protocols section, select Seconds from the SA Life pull-down, enter 300 in the Seconds field and select None for Compression.
    2. Check Encapsulation Protocol (ESP) next.
    3. For Encrypt Alg. select Triple DES.
    4. Select SHA-1 for Hash Alg.
    5. From the Encapsulation pull-down menu select Tunnel.
    6. Uncheck Authentication Protocol (AH).
    
    
    
    
    
    
    

20. The settings are now all configured for this connection. Go to the File menu on the tool bar and select Save.