The three most commonly encountered issues when connecting with the Cisco SSL VPN Client can be fixed by altering your browser settings. If you are having problems please see the following notes:
In these notes the term "Security Gateway" refers to the Cisco device to which the SSL client connects. Examples of Security Gateways include the VPN Concentrator 3000, Adaptive Security Appliance 5500, and Catalyst 6000.
The complete release notes for this product cover additional issues and are available from Cisco's website.
We recommend that Microsoft Internet Explorer (MSIE) users add the Security Gateway to the list of trusted sites. Doing so enables the ActiveX control to install with minimal interaction from the user. This is particularly important for users of Windows XP SP2 with enhanced security. See the following sections for instructions.
Follow these steps to use Microsoft Internet Explorer to add a Security Gateway to the list of trusted sites:
SSL uses certificates to identify peers in a connection. The Security Gateway has a certificate installed that is used to establish its identity. This certificate may be issued from a widely trusted source, such as Verisign or Thawte, that your computer is already configured to trust, or it may be a self-signed certificate that your computer will not trust automatically. This results in the Security warnings during connection establishment.
This section explains how to install a self-signed certificate as a trusted root certificate on a client in response to the browser alert windows.
The Microsoft Internet Explorer Security Alert window opens when you establish a Microsoft Internet Explorer connection to a Security Gateway that uses an untrusted certificate. The upper half of the Security Alert window shows the following text:
Information you exchange with this site cannot be viewed or changed by others. However, there is a problem with the site's security certificate. The security certificate was issued by a company you have not chosen to trust. View the certificate to determine whether you want to trust the certifying authority.
Follow this procedure to install a self-signed certificate as a trusted root certificate on a client in response to a Microsoft Internet Explorer Security Alert window:
The following procedure explains how to install a self-signed certificate as a trusted root certificate on a client in response to a "Web Site Certified by an Unknown Authority" window. This window opens when you establish a Netscape, Mozilla, or Firefox connection to a Security Gateway that is not recognized as a trusted site. This window shows the following text:
Unable to verify the identity of <Hostname_or_IP_address> as a trusted site.
Install the certificate as a trusted root certificate as follows:
There are two checkboxes under Internet Explorer's advanced settings that should be checked when using the SSL VPN Client.
If you have Internet Explorer configured with a proxy, you must activate the Use HTTP 1.1 through proxy connections setting to use the SVC. Additionally, the Use HTTP 1.1 setting must be checked. If these option are not set, the SSL VPN connection will not come up, and the installation process will appear to hang indefinately.
You can check to see if Internet Explorer is configured to use a proxy by going to Tools > Options > Connections > LAN Settings. If any of the checkboxes on the resulting dialog box are checked you may be connecting through a proxy.
In Internet Explorer, choose Internet Options from the Tools menu. Click the Advanced tab, and under the HTTP 1.1 Settings, check Use HTTP 1.1 through proxy connections and Use HTTP 1.1.