The most commonly encountered issues when connecting with the Cisco Secure Client can be fixed by altering your browser settings. If you are having problems, please see the following notes:
In these notes the term "Security Gateway" refers to the Cisco device to which the Cisco Secure Client connects. Examples of Security Gateways include the Adaptive Security Appliance 5500 and Catalyst 6000.
The complete release notes for this product cover additional issues and are available from Cisco's website.
SSL uses certificates to identify peers in a connection. The Security Gateway has a certificate installed that is used to establish its identity. The certificate may be issued from a widely trusted source, such as Verisign or Thawte, that your computer is already configured to trust. Or it may be issued from a self-signed certificate that your computer does not trust automatically, resulting in security warnings during connection establishment.
The Microsoft Internet Explorer Security Alert window opens when you establish a Microsoft Internet Explorer connection to a Security Gateway that uses an untrusted certificate. The upper half of the Security Alert window shows the following text:
Information you exchange with this site cannot be viewed or changed by others. However, there is a problem with the site's security certificate. The security certificate was issued by a company you have not chosen to trust. View the certificate to determine whether you want to trust the certifying authority.
Follow this procedure to install a self-signed certificate as a trusted root certificate on a client in response to a Microsoft Internet Explorer Security Alert window:
The following procedure explains how to install a self-signed certificate as a trusted root certificate on a client in response to a "Web Site Certified by an Unknown Authority" window. This window opens when you establish a Netscape, Mozilla, or Firefox connection to a Security Gateway that is not recognized as a trusted site. This window shows the following text:
Unable to verify the identity of <Hostname_or_IP_address> as a trusted site.
Install the certificate as a trusted root certificate as follows:
TYou should enable two checkboxes under Internet Explorer’s advanced setting when using the VPN client.
If you have Internet Explorer configured with a proxy, you must activate the Use HTTP 1.1 through proxy connections setting to use the VPN Client. Additionally, the Use HTTP 1.1 setting must be checked. If these option are not set, the VPN connection will not come up, and the installation process appears to hang indefinitely.
You can check to see if Internet Explorer is configured to use a proxy by going to Tools > Options > Connections > LAN Settings. If any of the checkboxes on the resulting dialog box are checked, you may be connecting through a proxy.
In Internet Explorer, choose Internet Options from the Tools menu. Click the Advanced tab, and under the HTTP 1.1 Settings, check Use HTTP 1.1 through proxy connections and Use HTTP 1.1.