Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

What's the most efficient way to generate Cisco VPN .pcf files for distribution to end-users? This is for ASA 5500-series firewalls.

Coming from a Mac workstation, I no longer have access to a working Cisco VPN client. Can this be done outside of the client software?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

The .pcf file is just a text document and it is designed to be edited just like any other INI file. It is hard to find the documentation on the format but here is a good starting point: http://www.cisco.com/en/US/docs/security/vpn_client/cisco_vpn_client/vpn_client500_501/administration/5vcA.pdf#page119

Specifically Chapter 5-1 Preconfiguring the VPN Client for Remote Users this is for vpn client version 5.0 but the format does not change a whole lot.

The nice thing is that not all the values have to be set, just the ones important to you, or that you want the user to interact with.

Here is the a sample from the pdf in case Cisco moves it:

[main]
Description=connection to TechPubs server
Host=10.10.99.30
AuthType=1
GroupName=docusers
GroupPwd=
enc_GroupPwd=158E47893BDCD398BF863675204775622C49<SNIPPED>
EnableISPConnect=0
ISPConnectType=0
ISPConnect=
ISPCommand=
Username=alice
SaveUserPassword=0
UserPassword=
enc_UserPassword=
NTDomain=
EnableBackup=1
BackupServer=Engineering1, Engineering2, Engineering 3, Engineering4
EnableMSLogon=0
MSLogonType=0
EnableNat=1
EnableLocalLAN=0
TunnelingMode=0
TCPTunnelingPort=10000
CertStore=0
CertName=
CertPath=
CertSubjectName
SendCertChain=0
VerifyCertDN=CN=”ID Cert”,OU*”Cisco”,ISSUER-CN!=”Entrust”,ISSURE-OU!*”wonderland”
DHGroup=2
PeerTimeOut=90
ForceNetLogin=

As you can see there is a GroupPwd and an enc_GroupPwd field either one can be set and as what Evan Anderson mentioned, there are plenty of tools that will break the encoded fielded so it gains very little security if you are trying to keep this a secret from your users.

Save that in notepad with a .pcf extensions and your users can import it for you.

Though the quickest way to create a pcf file is just do a remote session to your first mobile users computer. Enter the information in the vpn client, and then email yourself the pcf file it created. The building it by hand method is really designed to turn on features not available through the gui.

Good luck.

share|improve this answer

They can be created outside the client software, fortunately. They're just text files. Cisco has some documentation about the format available. Be aware that the "encryption" for any pre-shared keys isn't documented, so getting passwords into that format will probably be difficult.

share|improve this answer
1  
There isn't any official documentation for the algorithm, but it has been reverse engineered. There's a lot of working code out there to decrypt the group password, but not a whole lot to encrypt it. –  James Sneeringer May 2 '13 at 18:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.