How to Create VPN Profiles

Before connecting for the first time, you need at least one working VPN profile. Upon initial connection or if no working VPN profile for automated connections has yet been defined, the Barracuda VPN Client for Windows appears with the Default profile’s Connect dialog. Instead of creating a new profile, you can also edit the default profile. To create and configure a new VPN profile, use the profile wizard, or create the profile manually. You can create multiple profiles for several users with individual certificates. The VPN Client for Windows also offers the option to import VPN profiles created in Barracuda Firewall Admin.

• For successful certificate authentication, both client and root certificates must be available. The VPN Client for Windows supports the certificate types DER-encoded binary x.509, PKCS #12, and PEM-encoded binary x.509. You can also export certificates either to a text file or to the clipboard for further use elsewhere.

• Barracuda Authentication requires a valid certificate file (*.lic). This certificate file must be saved locally on the client system using it.

Configure a VPN profile for every VPN server you might want to access. In this way, you can use the client’s Direct Access functionality (see How to Configure the Barracuda VPN Client for Windows) that lets you keep your VPN connection automatically up in the background via different VPN gateways.

1. Launch the VPN Client for Windows by left-clicking the Barracuda Network Access Client icon 

    in the system tray.
   

2. Connect using your administrative credentials.

3. In the Barracuda VPN Client window, select Preferences from the left menu.

   
   The client shows the Default profile’s Connect dialog. VPN profiles can be chosen using the Profile drop-down menu. Click Connect to initiate a connection using the chosen profile.

4. In the left menu of the Barracuda VPN Control window, select New, or right-click anywhere within the empty white space in the Barracuda VPN Control window. Then, select New (Wizard).

5. In the Profile Wizard window, type the VPN server address into the upper field and, optionally, include a name in the lower field.

6. If desired, select the following check boxes:

   • Remember my user name – The VPN connection GUI remembers the last-entered username. For security reasons, this is disabled by default.

   • Use Access Control Service – If enabled, the health state will be validated via the Access Control Service before a connection is established.

7. Click Next. The Authentication Method window opens. You can later choose a different method for authentication in case you have chosen the wrong one.

8. Select the authentication method to be used.

   • Choosing Username and Password or SecurID will enable the Finish button, allowing you to complete the configuration process at this point.

9. If you select Certificate or Barracuda Personal License, click Next.

   • If you have chosen Barracuda personal License, browse for the license file, and click Finish.

   • If you have chosen Certificate, enter your certificate data and click Finish to complete the wizard.

You can later call the wizard again at any time by right-clicking Modify Profile (Wizard) ... at the respective VPN profile entry.

1. Launch the VPN Client, and connect as described in the above section. 

2. In the left menu, select Preferences to open the Barracuda VPN Control dialog.
   

3. Right-click anywhere within the empty white space in the Barracuda VPN Control window, and select New.
   

    

4. In the Connection Entries tab, enter a description of the connection entry. This name will be displayed as profile name in the Connection dialog window.

5. In the Certificate section, choose the authentication method required by the VPN server. For more information, see the Advanced profile Settings section in How to Configure the Barracuda VPN Client for Windows.

6. In the Remote Server section, enter the host names or IP addresses of the VPN server. Separate multiple entries using a semicolon (';'). 

7. If required, configure the sections in the Advanced Settings tab. For more information, see the Advanced Profile Settings section below.

8. Click OK.

The newly created VPN profile can now be chosen as a preconfigured profile from the VPN Client dialog. You can later edit the settings at any time by right-clicking Modify Profile at the respective VPN profile entry.

The profile configuration is done via the Connection Entries and Advanced Settings tabs. To edit and modify connection entries and advanced VPN profile settings, select the profile in the list, right-click it, and select Modify Profile.

The Certification Authorities configuration area helps you manage the server certificates for all your VPN connections. Click View > Certification Authorities (CA) in Barracuda VPN Control to display it. Use the Certification Authorities configuration window to import certificates into the certificate store.

The following parameter is available for User/Password authentication:

• Temporary Root Certificate – Set to Not Available whenever a connection to the VPN server has never been established or if the certificate file has been deleted. As soon as a certificate is available, it can be viewed by using the Show… menu item or deleted by using the Clear menu item.

The following parameters are available for Barracuda Authentication:

• File – Select the certificate (*.lic) file needed for authentication at the VPN server.

• Hash – (read-only) After a certificate has been loaded, its hash is displayed in this field.

• Certificate File Password – If a certificate file has been loaded, the password for certificate usage can be changed here. Enter the new password and confirm it.

The following parameters are available for X.509 authentication:

• Subject /Issuer – After selecting the X.509 certificate, its subject and issuer are displayed here.

• Use serial number – States whether the certificate’s serial number is used in the authentication process.

• Valid to – Displays date and time for the X.509 certificate's expiration.

• Key specific – Hash value of the certificate file.

• Key usage – Value of the KeyUsage keyCertSign bit. Possible values are Exchange (public key exchange) or Signing (digital signature).

• Private Encrypt – Switches encryption procedure (private key for encryption, public for decryption) depending on whether crypto API is supported or not.

• Probe Encrypt – Shows whether encryption probing is supported or not.

• Prompt for user and password – Enable to request both certificate validation and user / password validation.

• Temporary Root Certificate – After a temporary root certificate is provided by the server, it can be viewed using the Show… menu item or deleted using the Clear menu item.

• Show external X509 Certificate – If an external X.509 certificate has been loaded, its properties can be viewed here.

• External File – Path to the external X.509 certificate. 

Individual settings, such as connection details, can be configured in the Advanced Settings tab of the respective profile.

Configure the following section when connecting to the VPN server via a proxy: 

• via Proxy – Whether a proxy should be used and, if so, what type it is. Default: No Proxy.

• Proxy[:Port] – IP address and port for the proxy. If HTTP Proxy is selected, the system’s proxy server is automatically set as default. If not, the value is by default empty.

• Proxy user / domain – The username and domain required for authentication at the proxy server, if required. Default is empty.

• Simulate SSL – Set to Yes when using a proxy server requiring an SSL handshake. Default: No. 

Changes to this section should only be done by experts. Keep in mind that the VPN server must support the settings configured here.

• Authentication algorithm – The algorithm to be used for authenticating to the VPN server. Default: MD5.

• Encryption Algorithm – The algorithm to be used for encryption. Default: AES.

• Tunnel Mode – The protocol to be used for tunnel traffic. The available options depend on the chosen proxy type: Default is Response (UDP).

  • Response (UDP) for Socks 5

  • Reliability (TCP) for HTTP Proxy and Socks 4

  • No Proxy gives access to both protocol types and offers an additional one called Optimized (Hybrid) that indicates a combination of Response (UDP) and Reliability (TCP).