Support for Cisco's version of DTLS was included in GnuTLS from 3.0.21 onwards.
+Support for Cisco's version of DTLS was included in GnuTLS from 3.0.21 onwards (commited in fd5ca1af).
GlobalProtect mode is requested by adding --protocol=gp +to the command line: +
+ openconnect --protocol=gp vpn.example.com ++ +
To authenticate, you connect to the secure web server (POST /ssl-vpn/login.esp), provide a username, password, and (optionally) a certificate, and receive an authcookie. The username, authcookie, and a couple other bits of information obtained at login are combined into the OpenConnect cookie.
+To connect to the secure tunnel, the cookie is used to read routing and tunnel configuration information (POST /ssl-vpn/getconfig.esp).
+Next, a HIP report (security scanner report) is +generated by the client and submitted to the server, if required.
+Finally, either an HTTPS-based or ESP-based tunnel is setup:
The HIP ('Host Integrity Protection') mechanism is a security +scanner for the PAN GlobalProtect +VPNs, in the same vein as Cisco's CSD and Juniper's Host Checker (tncc.jar).
+ +It is somewhat less intrusive than CSD or TNCC, because it +does not appear to work by downloading a trojan binary from the VPN +server. Instead, it runs a HIP report generator (built-in as part of +the official GlobalProtect VPN client software), which generates an +"HIP report" XML file.
+ +HIP flow used in the official clients:
+/ssl-vpn/hipreportcheck.esp), including its MD5 digest and gateway-assigned IP address in the report./ssl-vpn/hipreport.esp).If all goes well, the client should have the expected level of +access to resources on the network after these steps are +complete. However, two things can go wrong:
+ +OpenConnect supports HIP report generation and submission by passing the --csd-wrapper=SCRIPT argument with a shell script to generate a HIP report in the format expected by the
+server. This shell script must output the HIP report to standard output and exit successfully (status code 0). The HIP script is called with the following command-line arguments:
+ --cookie: a URL-encoded string, as output by openconnect + --authenticate --protocol=gp, which includes parameters + --from the /ssl-vpn/login.esp response + + --computer: local hostname, which can be overriden with + --openconnect local-hostname=HOSTNAME + + --client-ip: IPv4 address allocated by the GlobalProtect VPN for + this client (included in /ssl-vpn/getconfig.esp + response) + + --md5: The md5 digest to encode into this HIP report. All that + really matters is that the value in the HIP report + submission should match the value in the HIP report check. ++ +
An example hipreport.sh script is included in the
+openconnect distribution.
Depending on how picky your GlobalProtect
+VPN is, it may be necessary to spoof or alter some of the parameters
+of the HIP report to match the output of one of the official
+clients. In order to capture the contents of the official Windows
+client's HIP reports, enable the highest logging level for the "PanGPS
+Service", and then sift through the giant PanGPS.log file
+(which should be in the same directory as the executables, normally
+c:\Program Files\PaloAlto Networks\GlobalProtect) to find
+the HIP report submission.
OpenConnect is an SSL VPN client initially created to support Cisco's AnyConnect SSL VPN. It has since been ported to support the Juniper SSL VPN which is now known as Pulse Connect Secure.
+OpenConnect is an SSL VPN client initially created to support Cisco's AnyConnect SSL VPN. +It has since been ported to support the Juniper SSL VPN (which is now known as Pulse Connect Secure), +and to the Palo Alto Networks GlobalProtect SSL VPN.
OpenConnect is released under the GNU Lesser Public License, version 2.1.
Like vpnc, OpenConnect is not officially supported by, or associated in any way -with, Cisco Systems, Juniper Networks or Pulse Secure. It just happens to interoperate with their equipment. +with, Cisco Systems, Juniper Networks, Pulse Secure, or Palo Alto Networks. +It just happens to interoperate with their equipment.
-Development of OpenConnect was started after a trial of the Cisco +
Development of OpenConnect was started after a trial of the Cisco client under Linux found it to have many deficiencies:
For the time being, Juniper mode is requested by adding --juniper +
Juniper mode is requested by adding --protocol=nc to the command line:
- openconnect --juniper vpn.example.com + openconnect --protocol=nc vpn.example.com
Network Connect works very similarly to @@ -65,7 +65,7 @@ pass the cookie to OpenConnect with its -C option, for example:
-Many sites require a Java applet to run certain tests as a precondition of authentication. This works by sending a DSPREAUTH cookie @@ -80,7 +80,7 @@ along with the tncc-preload.so from this repository. It may also be necessary to pass a Mozilla-compatible user agent string:
- ./openconnect --juniper --useragent 'Mozilla/5.0 (Linux) Firefox' --csd-wrapper=./tncc-wrapper.py vpn.example.com + ./openconnect --protocol=nc --useragent 'Mozilla/5.0 (Linux) Firefox' --csd-wrapper=./tncc-wrapper.py vpn.example.com