Michael McNamara

technology, networking, virtualization and IP telephony

Avaya VPN Client Release 10.06.200 for Windows 8

by

AVC-setupAvaya has released version 10.06.200 of their VPN client (formerly Contivity Extranet Client) that supports both 32-bit and 64-bit versions of Windows 8.

This single client supports the following operating systems (in both 32-bit and 64-bit versions);

  • Windows XP
  • Windows Vista
  • Windows 7
  • Windows 8

Resolved Issues

  • wi01041435 – Traffic to overlapping network of Split net and Local net got blocked.
  • wi01031645 – AVC SwapAdapter feature does not reprioritize the VPN Adapter binding order for SSL tunnel types.
  • wi01011920 – AVC may Orphan NetBT NameList registry entries if ungracefully terminated.
  • wi01047768 – NVR interoperability – banner issues with specific IP address pool for Windows 7 users
  • wi01043584 – Installing AVC over same version in silent mode causes error
  • wi01058523 – AVC 10.06.104 IPSec Tunnels might drop during server initiated rekey
  • wi01049421 – Unsigned EAC Miniport Driver Blocked by Windows XP OS. A new binder.exe utility has been included in the installation directory (default: %ProgramFiles%\Avaya\Avaya VPN Client) on Windows XP systems to assist with remediating this issue.
  • wi01056647 – AVC may crash when connecting through an unstable wireless access point
  • wi01059319 – Sometimes WINS Servers may not take effect in Windows XP
  • wi01068400 – Dial-up not working properly on 32 bit platforms
  • wi01028196 – AVC fails to properly identify Windows XP x64 operating system which may result in improper client operation
  • wi00951988 – Unsupported Installation Change is not disabled properly.

Activation of VPN Adapter Failed

wi00928966 – Users who upgrade from a v10.05 or earlier release to v10.06 on Windows XP may receive the following error dialogue when attempting to establish an IPSec VPN tunnel – “Activation of VPN Adapter Failed”. This issue occurs when the AVC filter driver is not upgraded correctly during software installation.
As a precautionary measure, rebooting the machine before an upgrade installation is highly recommended. If the problem does occur, the workaround would be to uninstall and then reinstall the client. Please note, uninstall will remove all profiles and configurations. If users want to carry them over to the following reinstallation, they can use the Import/Export feature to export them before uninstall and import them back after reinstallation. For more details about the Import/Export feature please see Section 7 of this document.)

You should refer to the release notes for all the details, including the interoperability issues.

AVC32-10.06.200.exe (32-bit Windows XP, Windows Vista, Windows 7, Windows 8)
MD5: 006e21051924d92634b62600c071418b
AVC64-10.06.200.exe (64-bit Windows XP, Windows Vista, Windows 7, Windows 8)
MD5: 34c860667260ce196139521196fca946

Cheers!

Avaya VPN Client Release 10.06.104 for Windows 7

by

Avaya has released version 10.06.104 of their VPN client (formerly Contivity Extranet Client) that supports both 32-bit and 64-bit versions of Windows 7.

This single client supports the following operating systems (in both 32-bit and 64-bit versions);

  • Windows XP
  • Windows Vista
  • Windows 7

Resolved Issues

  • wi01009468 BSOD (Blue Screen of Death) may occur on Windows 7 multi-core machines if Symantec Endpoint Protection v11.x is installed.
  • wi01002823 AVC 10.04.108+ Incompatibility with AT&T 4G USB Modem
  • wi01011943 AVC “Display Warning” or “Disconnect” Limitation. Previously the VPN client would be abruptly terminated if a user attempted to shut down or restart the host machine. Now the tunnel is gracefully disconnected prior to shut down or restart.
  • wi01032791 Disconnect the VPN tunnel when AVC service is closed/stopped

Open Issues

  • wi01011920 AVC may Orphan NetBT NameList registry entries if ungracefully terminated. The workaround is to clear the NetBT NameList or gracefully terminate the VPN Client before rebooting or restarting the host PC.
  • wi01031645 AVC SwapAdapter feature does not reprioritize the VPN Adapter binding order for SSL tunnel types.

Interoperability

  • McAfee ViruScan v8.8
  • Microsoft Internet Explorer v8
  • Microsoft Windows 7 IPv6 6to5 Adapter Duplicates
  • Avaya NetDirect Client
  • DNS Binding Priority with Windows Operating Systems

You should refer to the release notes for all the details, including the interoperability issues.

AVC32-10.06.104.exe (32-bit Windows XP, Windows Vista, Windows 7)
AVC64-10.06.104.exe (64-bit Windows XP, Windows Vista, Windows 7)

Cheers!

Avaya VPN Client Release 10.06.022 for Windows 7

by

Avaya has released version 10.06.022 of their VPN client (formerly Contivity client) that supports both 32-bit and 64-bit versions of Windows 7. This single client supports the following operating systems (in both 32-bit and 64-bit versions);

  • Windows XP
  • Windows Vista
  • Windows 7

Resolved Issues

  • wi01003255 – Split Tunnel Failure on Windows 7
  • wi00860526,wi00972868 – Mobility for IPSEC doesn’t work properly on Windows 7 and XP.
  • wi00947857 – IPsec split tunneling mode enabled_inverse_local does not enforce its restrictions on sessions already established before the tunnel was created.
  • wi00956803 – Cached VPN adapter drivers not cleaned up on Windows 7
  • wi00995550 – Disconnecting a tunnel may cause service crash
  • wi00981906 – Fetching banner from different AVG when DNS Round Robin used
  • wi01006672 AVC may Orphan DNS Suffix Entries if ungracefully terminated.

New Outstanding issues

  • wi01011920 – AVC may Orphan NetBT NameList registry entries if ungracefully terminated. The workaround is to clear the NetBT NameList or gracefully terminate the VPN Client before rebooting or restarting the host PC.

New Known Issues

  • wi00928966 – Users who upgrade from a v10.05 or earlier release to v10.06 on Windows XP may receive the following error dialogue when attempting to establish an IPSec VPN tunnel – “Activation of VPN Adapter Failed”. This issue occurs when the AVC filter driver is not upgraded correctly during software installation. As a precautionary measure, rebooting the machine before an upgrade installation is highly recommended. If the problem does occur, the workaround would be to uninstall and then reinstall the client. Please note, uninstall will remove all profiles and configurations. If users want to carry them over to the following reinstallation, they can use the Import/Export feature to export them before uninstall and import them back after reinstallation. For more details about the Import/Export feature please see Section 7 of this document.)
  • wi00951988 – Component modification after installation is not supported.
  • wi00932075 – Canceling uninstall in the middle may cause faulty rollback.

You should refer to the release notes for all the details.

I will continue to host the client files on my website.

AVC32-10.06.022.exe (32-bit Windows XP, Windows Vista, Windows 7)
AVC64-10.06.022.exe (64-bit Windows XP, Windows Vista, Windows 7)

Cheers!

Juniper SRX VPN Branch Office

by

Juniper SRX 210We recently started replacing our aging Avaya VPN Routers (formerly Nortel Contivity) with Juniper SRX series gateways. We chose a Juniper SRX 650 to replace our Avaya VPN Router 1750 and we chose the Juniper SRX 210H to replace the Avaya VPN Router 1010 and 1050 models. While it was fairly easy to get both route based tunnels and policy based tunnels setup we had an interesting time trying to route all traffic at the branch back to the main office (as opposed to routing it directly to the Internet on the branch Juniper SRX 210H) so it could be policed by our corporate firewalls and content filtering solutions. We were able to accomplish this configuration through the use of VRFs and I’m going to outline how we did it (just in case anyone else is trying to follow in our footsteps – or better yet can improve the configuration).

Configure the Juniper SRX 210 Branch Office

Login to the serial console of the Juniper SRX gateway with the username of “root” (password should be blank). We’ll start the configuration by loading the factory defaults and then setting up some basic system information. We’ll add a user called “admin” for future use.

root@% cli
root> configure
Entering configuration mode
[edit]
load factory-default
set system host-name vpn-srx210h-gw
set system domain-name vpn.acme.org
set system time-zone America/New_York
set system root-authentication plain-text-password
set system login user admin full-name Administrator
set system login user admin uid 100
set system login user admin class super-user
set system login user admin authentication plain-text-password

Lets set the SNMP information including a reference to the routing-instance “centralized-internet”. This will allow us to perform SNMP polls against this VRF from the specific IP management workstations we’ve listed below.

set snmp description "Juniper SRX 210H"
set snmp location "Local Branch Office (Somewhere, USA)"
set snmp contact "Technology Team"
set snmp community readonlystring authorization read-only
set snmp community readonlystring routing-instance centralized-internet clients 10.1.20.50/32
set snmp community readonlystring routing-instance centralized-internet clients 10.2.20.50/32
set snmp community readwritestring authorization read-write
set snmp routing-instance-access
commit

Let’s start by configuring the WAN (public) and LAN (private) IP addresses. The interface ge-0/0 is the public interface which will connect to the Internet Service Provider. The interface vlan.0 is the private interface which is made up of physical interfaces ge-0/1 – ge0/7. We’ll also delete the factory default address of 192.168.1.1.

set interface ge0/0/0 unit 0 family inet address 1.51.88.10/30
set routing-options static route 0.0.0.0/0 next-hop 1.51.88.9
set interface vlan unit 0 family inet address 10.1.200.1/24
delete interfaces vlan unit 0 family inet address 192.168.1.1/24

Let’s enable the web management GUI on the public interface and set the TCP port to 10443 as opposed to the default of 443.

set system services web-management https interface ge-0/0/0.0
set system services web-management https port 10443

Let’s enable the system services we want to allow in the untrust zone.

set security zones security-zone untrust host-inbound-traffic system-services ike
set security zones security-zone untrust host-inbound-traffic system-services ping
set security zones security-zone untrust host-inbound-traffic system-services https

Let’s repeat those commands for the specific public interface.

set security zones security-zone untrust interface ge-0/0/0 host-inbound-traffic system-services ike
set security zones security-zone untrust interface ge-0/0/0 host-inbound-traffic system-services ping
set security zones security-zone untrust interface ge-0/0/0 host-inbound-traffic system-services https

Let’s build the VPN tunnel interfaces to Juniper SRX 650. We’ll need to assign IP addresses to these interfaces since we’re setting up a Point to MultiPoint network with route based VPN tunnels.

set interfaces st0 unit 0 family inet address 10.1.255.120/24
set interfaces st0 unit 0 family inet mtu 1500

Let’s finish up setting up the security zones and adding the VPN interfaces.

set security zones security-zone vpn interfaces st0.0
set security zones security-zone untrust interfaces ge-0/0/0.0
set security zones security-zone trust interfaces vlan.0
set security zones security-zone trust host-inbound-traffic system-services all

Let’s not forget to allow the remote management via the web interface. (added 10/18/2011)

set security zones security-zone vpn host-inbound-traffic system-services all
set security zones security-zone vpn host-inbound-traffic protocols all
set system services web-management http interface st0.0

Let’s setup the IKE policies and pre-shared-key for both VPN tunnels, please make sure to replace the preshared-key and IP addressing below with the values that’s specific to your installation (not the example one). I use the acronym PDC to stand for Primary Data Center since we have both a primary and alternate/standby.

set security ike policy PDC-IKE mode main
set security ike policy PDC-IKE proposal-set standard
set security ike policy PDC-IKE pre-shared-key ascii-text "c3DrmFiRei37NpW65GnygdOorykE0ZjnpyX"
set security ike gateway PDC-GW ike-policy PDC-IKE
set security ike gateway PDC-GW address 2.1.1.25
set security ike gateway PDC-GW external-interface ge-0/0/0.0

set security ipsec policy ACME-VPN proposal-set standard
set security ipsec policy ACME-VPN perfect-forward-secrecy keys group2

set security ipsec vpn PDC-VPN ike gateway PDC-GW
set security ipsec vpn PDC-VPN ike ipsec-policy ACME-VPN
set security ipsec vpn PDC-VPN bind-interface st0.0
set security ipsec vpn PDC-VPN establish-tunnels immediately

The Juniper SRX still acts as a firewall so we need to create policies to allow the traffic to flow. I’ll set everything wide open for this example.

edit security policies from-zone trust to-zone vpn
set policy local-to-spokes match source-address any
set policy local-to-spokes match destination-address any
set policy local-to-spokes match application any
set policy local-to-spokes then permit
exit

edit security policies from-zone vpn to-zone trust
set policy local-to-spokes match source-address any
set policy local-to-spokes match destination-address any
set policy local-to-spokes match application any
set policy local-to-spokes then permit
exit

edit security policies from-zone vpn to-zone vpn
set policy local-to-spokes match source-address any
set policy local-to-spokes match destination-address any
set policy local-to-spokes match application any
set policy local-to-spokes then permit
exit

We’ll create a virtual routing instance setting the next-hop to interface st0.0

set routing-options interface-routes rib-group inet centralized
set routing-options rib-groups centralized import-rib inet.0
set routing-options rib-groups centralized import-rib centralized-internet.inet.0

We’ll create a virtual routing instance setting the next-hop to interface st0.0

set routing-instances centralized-internet instance-type virtual-router
set routing-instances centralized-internet interface st0.0
set routing-instances centralized-internet routing-options static route 0.0.0.0/0 next-hop st0.0

This filter will direct all traffic to the centralized-internet routing table. The first term allows us to add an exception although it’s not used today but can be for testing and troubleshooting by changing the IP address to a valid LAN client IP address. This filter allows traffic from 10.1.200.254 to be routed based on the default routing-instance which would send it directly out to the Internet as opposed to routing it over the VPN tunnel back to the main office.

set firewall filter centralized-internet-filter term 1 from destination-address 10.1.200.254/32
set firewall filter centralized-internet-filter term 1 then accept
set firewall filter centralized-internet-filter term 2 then routing-instance centralized-internet

We’ll apply the filter we created above to traffic ingressing the interface vlan.0.

set interface vlan unit 0 family inet filter input centralized-internet-filter

Let’s configure a DHCP relay instance to forward DHCP requests to a centralized server (10.1.1.40).

set forwarding-options helpers bootp relay-agent-option
set forwarding-options helpers bootp description "Branch DHCP Relay"
set forwarding-options helpers bootp server 10.1.1.40 routing-instance centralized-internet
set forwarding-options helpers bootp vpn
set forwarding-options helpers bootp interface vlan.0

Let’s configure the TCP-MSS value so we don’t have any MTU issues tunneling over IPSec

set security flow tcp-mss ipsec-vpn mss 1350

Let’s configure the debug options so we can troubleshoot any IKE/IPSEC issues.

set security ike traceoptions file size 1m
set security ike traceoptions flag policy-manager
set security ike traceoptions flag ike
set security ike traceoptions flag routing-socket

We need to disable IDP to prevent unwanted error messages from filling the log.

set system processes idp-policy disable

Now we need to commit and save all the changes we’ve made above.

commit

If you have issues committing the changes with errors such as :

root# commit
[edit system]
'autoinstallation'
incompatible with 'forwarding-options helpers bootp'
[edit forwarding-options helpers]
'bootp'
incompatible with 'system autoinstallation'
error: commit failed: (statements constraint check failed)

Just issue the following command and re-issue the commit

root# delete system autoinstallation

If you are connected to the public Internet you can sync the date/time via NTP over the public interface.

root# set date ntp 173.9.142.98

Configure the Juniper SRX 650 Main Office

Now we need to configure the Juniper SRX 650 which is the main office side of the tunnel.

Let’s create an IKE policy for this specific connection. Please remember to substitute the preshared-key and IP addresses I use in the example below.

set security ike policy TESTLAB-IKE mode main
set security ike policy TESTLAB-IKE proposal-set standard
set security ike policy TESTLAB-IKE pre-shared-key ascii-text "c3DrmFiRei37NpW65GnygdOorykE0ZjnpyX"

Let’s create a gateway and tie it together with our IKE policy. Let’s set the public IP address of the branch office VPN site.

set security ike gateway TESTLAB-GW ike-policy TESTLAB-IKE
set security ike gateway TESTLAB-GW address 1.51.88.10
set security ike gateway TESTLAB-GW external-interface ge-0/0/0.0

Let’s create a VPN policy and tie all the policies together binding it to st0.10 which is a multipoint interface on the main office side.

set security ipsec vpn TESTLAB-VPN ike gateway TESTLAB-GW
set security ipsec vpn TESTLAB-VPN ike ipsec-policy ACME-VPN
set security ipsec vpn TESTLAB-VPN bind-interface st0.10
set security ipsec vpn TESTLAB-VPN establish-tunnels immediately

Since we’re not yet doing OSPF we need to create a static route in the appropriate routing instance.

set routing-instances routing-table-lan routing-options static route 10.1.200.1/24 next-hop 10.1.220.10

I’m omitting a few steps on the Juniper SRX 650 to implement the Multipoint VPN feature but it’s well documented (as most of this is) in the Juniper documentation.

References;

Cheers!

Avaya VPN Client Release 10.05.150 for Windows 7

by

Avaya has released version 10.05.150 of their VPN client (formerly Contivity client) that supports both 32-bit and 64-bit versions of Windows 7. This single client supports the following operating systems (in both 32-bit and 64-bit versions);

  • Windows XP
  • Windows Vista
  • Windows 7

The release notes mention the following compatibility issues;

User may experience Blue Screen of Death (BSOD) during VPN tunneling if McAfee VirusScan v8.8 is installed on the machine. It’s due to an issue with McAfee driver mfewfpk.sys. McAfee provided a hot fix in October, 2011 and also embedded it into McAfee VirusScan v8.8 Repost 1. Please either apply the patch or use the v8.8 Repost 1.

The Avaya VPN Client (AVC) must not be installed on the same client machine in which either the Avaya VPN Gateway (AVG) NetDirect Installable Client (NDIC) or NetDirect portable client (ActiveX or Java-based) is installed, or vice-versa. Doing so may result in unexpected client behaviors. The AVC client may report “Failed to Activate the VPN Adapter”. Ensure that conflicting clients are uninstalled prior to installation of either AVC or NDIC/NetDirect.

The following issues have been resolved;

  • wi00938485 Splittun Disabled/Enable_Inverse Failure on Windows7
  • wi00924999 If users connect AVC to AVG from behind a non-IPsec-aware NAT box, they might experience intermittent banner retrieval failure or disconnection.
  • wi00947500 Sometimes the upload speed is low.
  • wi00887226 In rare occasions network applications might be impacted because of dropped packets.
  • wi00924795 Custom taskbar icons have wrong file names.

You should refer to the release notes for all the details.

I will continue to host the client files on my website.

AVC32-10.05.150.exe (32-bit Windows XP, Windows Vista, Windows 7)
AVC64-10.05.150.exe (64-bit Windows XP, Windows Vista, Windows 7)

Cheers

Update: June 29, 2012

I’ve posted the new client in this post. I’m going to close this post to comments, please make any comments in the new post.

Recent Posts

Categories

SUBSCRIBE BY EMAIL