%
`
`_W%iri<:«*::si2;»g:%;L’
`
`..__.'—._..._.,._....__...,...,...V..._.,...:.:_._,7._ ,.
`
`Aventafl "
`
`Petitioner Apple - Ex. 1022, p. 1
`
`Petitioner Apple - Ex. 1022, p. 1
`
`

`
`AVENTAIL CONNECT 3.1/2.6 ADMlNISTRATOR’S GUIDE
`
`© 1996-1999 Aventail Corporation. All rights reserved.
`
`808 Howell Street, Second Floor
`Seattle, WA 98101
`USA
`
`http://wvvvv.aventail.com/
`
`Printed in the United States of America.
`
`TRADEMARKS AND COPYRIGHTS
`
`Aventail is a registered trademark of Aventail Corporation. AutoSOCKS, Internet
`Policy Manager, Aventail VPN, Aventail VPN Client, Aventail ExtraNet Center,
`and Aventail ExtraNet Server are trademarks of Aventail Corporation.
`
`Socks5Toolkit is a trademark of NEC Corporation. MD4 Message-Digest Algo-
`rithm and MD5 Message-Digest Algorithm are trademarks of RSA Data Security,
`Inc. Microsoft, MS, Windows, Vwndows 95, Windows 98, and Vlfindows NT are
`either registered trademarks or trademarks of Microsoft Corporation. RealAudio
`is a trademark of RealNetworks. SecurlD, SoftlD, ACE/Server, and SDTI are
`either registered trademarks or trademarks of Security Dynamics Technologies,
`Inc.
`
`This product includes software written by Dr. Stephen Henson.
`
`Other product names mentioned in this manual may be trademarks or registered
`trademarks of their respective companies and are the sole property of their
`respective manufacturers.
`
`© 1995-1996 NEC Corporation. All rights reserved.
`
`© 1990-1992 RSA Data Security, Inc. All rights reserved.
`
`© 1996 Hi/fn lnc., including one or more U.S. patents: 4701745, 5016009,
`5126739, and 5146221, and other patents pending.
`
`© 1996-1997 Consensus Development Corporation. All rights reserved.
`
`Aventail Connect 3 1/2. 6 Administrators Guide - I
`
`Petitioner Apple - Ex. 1022, p. 2
`
`Petitioner Apple - Ex. 1022, p. 2
`
`

`
`céhiéiiié I
`
`Table of Contents
`
`TROUBLESHOOTING
`
`Trademarks and Copyrights .
`
`.
`
`.
`
`.
`
`.
`
`_
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`,
`
`_
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`4
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`I
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`i
`
`1
`
`INTRODUCTION .
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`,
`
`.
`
`.
`
`.
`
`T
`
`.
`
`.
`
`.
`
`.
`
`,
`
`,
`
`.
`
`,
`
`,
`
`T
`
`,
`
`.
`
`.
`
`.
`
`.
`
`3
`
`About This Document .
`
`.
`
`I
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`.
`
`.
`
`.
`.
`
`.
`
`.
`.
`
`.
`
`.
`.
`
`.
`
`.
`.
`
`.
`
`.
`.
`
`.
`
`_
`.
`
`.
`
`.
`.
`
`.
`
`.
`.
`
`.
`
`.
`.
`
`.
`
`.
`.
`
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`. 3
`. 4
`
`Document Organization _
`Document Conventions .
`
`.
`.
`
`.
`.
`
`.
`.
`
`Aventail Technical Support .
`About Aventail Corporation .
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`. 5
`. 5
`
`ADMINISTRATOR’S GUIDE
`
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`Getting Started .
`.
`.
`.
`.
`Network Security in a Nutshell .
`.
`.
`.
`.
`What is Aventail Connect’? .
`.
`.
`.
`.
`What Does Aventail Connect Do? .
`How Does Aventail Connect Work’? .
`
`.
`.
`.
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`.
`.
`.
`
`Aventail Connect Platform Requirements .
`Interface Features .
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`
`.
`.
`4
`.
`.
`
`.
`.
`
`.
`.
`.
`I
`.
`
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`
`.
`.
`.
`.
`T
`
`.
`,
`
`.
`.
`.
`.
`.
`
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`
`I
`
`.
`.
`.
`.
`.
`
`.
`.
`
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`
`.
`
`. 6
`. 6
`.
`7
`. 9
`11
`
`13
`14
`
`14
`
`Installation Source Media .
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`.
`.
`.
`.
`.
`I
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`Installing Aventail Connect
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`Configuration Files .
`Customized Configuration and Distribution .
`Individual Installation .
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`A.
`.
`.
`Network Installation .
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`
`.
`
`.
`.
`.
`.
`.
`
`.
`
`.
`.
`.
`.
`.
`
`.
`
`.
`.
`.
`.
`.
`
`.
`
`.
`.
`.
`.
`.
`
`.
`
`.
`.
`.
`.
`.
`
`.
`
`.
`.
`.
`.
`.
`
`.
`
`.
`.
`.
`.
`.
`
`.
`
`.
`.
`.
`.
`.
`
`.
`
`.
`.
`.
`.
`.
`
`.
`
`.
`.
`.
`.
`.
`
`.
`
`.
`.
`.
`.
`.
`
`.
`
`.
`.
`.
`.
`.
`
`,
`
`.
`.
`.
`.
`.
`
`.
`
`.
`.
`.
`.
`.
`
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`
`15
`15
`16
`16
`18
`
`21
`22
`
`Administrative Setup .
`Customizer .
`.
`.
`.
`.
`.
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`_
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`
`I
`.
`.
`I
`.
`
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`
`1
`.
`.
`.
`.
`
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`.
`.
`.
`
`33
`.
`. 35
`. 39
`. 42
`. 45
`
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`Configuring Aventail Connect .
`Define an Extranet (SOCKS) Server .
`Define a Destination .
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`Enter Redirection Rules .
`.
`.
`.
`.
`.
`.
`.
`.
`I
`Define Name Resolution .
`,
`.
`.
`.
`.
`.
`.
`.
`.
`
`Manage Authentication Modules .
`Advanced Tab Options .
`.
`.
`.
`.
`.
`.
`.
`Enable Password Protection .
`.
`.
`.
`
`.
`.
`.
`
`.
`.
`.
`
`.
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`.
`
`.
`.
`.
`
`.
`.
`.
`
`.
`.
`.
`
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`Multiple Firewall Traversal
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`Example Network Configuration .
`Configuration Using Aventail ExtraNet Server .
`
`.
`.
`.
`
`.
`.
`.
`
`.
`.
`.
`
`.
`.
`.
`
`.
`.
`.
`
`.
`.
`.
`
`.
`.
`.
`
`.
`.
`.
`
`.
`.
`.
`
`.
`.
`.
`
`.
`.
`.
`
`.
`.
`.
`
`.
`.
`.
`
`.
`.
`.
`
`.
`.
`.
`
`.
`.
`.
`
`.
`.
`.
`
`.
`.
`.
`
`.
`.
`.
`
`.
`.
`.
`
`.
`.
`.
`
`.
`.
`.
`
`.
`.
`.
`
`.
`.
`.
`
`.
`.
`.
`
`.
`.
`.
`
`.
`.
`.
`
`.
`I
`.
`
`.
`.
`.
`
`.
`.
`.
`
`. 46
`. 62
`. 67
`
`. 68
`. 76
`.
`76
`
`Aventail Connect 3. 1/2. 6 Administrator’s Guide - ii
`
`Petitioner Apple - Ex. 1022, p. 3
`
`Petitioner Apple - Ex. 1022, p. 3
`
`

`
`UTILITIES REFERENCE GUIDE
`
`System Menu Commands.
`Close .
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`Hide lcon .
`.
`.
`.
`.
`.
`.
`.
`.
`
`.
`.
`
`.
`4
`.
`
`.
`.
`.
`
`.
`.
`.
`
`.
`.
`.
`
`.
`.
`.
`
`.
`.
`.
`
`4
`.
`
`.
`
`.
`.
`
`.
`.
`
`4
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`.
`
`.
`
`Table of Contents
`
`.
`
`.
`
`.
`.
`.
`.
`.
`
`.
`
`.
`
`.
`.
`.
`.
`.
`
`_
`
`.
`
`.
`.
`.
`.
`.
`
`I
`
`.
`
`.
`.
`.
`,
`.
`
`.
`
`.
`
`.
`.
`.
`.
`.
`
`I
`
`.
`
`.
`.
`.
`.
`.
`
`.
`
`.
`
`.
`.
`.
`.
`.
`
`.
`
`.
`
`.
`.
`.
`.
`.
`
`.
`
`.
`
`.
`.
`.
`.
`.
`
`.
`
`.
`
`.
`.
`.
`.
`.
`
`.
`
`.
`
`.
`.
`.
`.
`.
`
`. 80
`
`.
`
`81
`
`.
`81
`.
`81
`.
`81
`, 82
`.
`83
`
`.
`
`.
`.
`.
`.
`.
`
`.
`
`I
`,
`.
`.
`.
`
`.
`.
`.
`.
`.
`.
`Help .
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`About .
`.
`.
`.
`.
`.
`Credentials .
`.
`.
`.
`.
`.
`Configuration File .
`Utilities .
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`.
`.
`.
`
`4
`.
`.
`.
`_
`
`.
`.
`.
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`,
`.
`.
`.
`.
`.
`.
`Config Tool .
`.
`.
`.
`.
`.
`.
`I
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`Logging Tool .
`.
`.
`.
`.
`.
`,
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`,
`S5 Ping .
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`Secure Extranet Explorer .
`How Extranet Neighborhood Works .
`Installing Extranet Neighborhood .
`.
`.
`Configuring Extranet Neighborhood .
`SEE Properties .
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`.
`.
`.
`.
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`.
`.
`.
`.
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`.
`.
`.
`.
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`.
`.
`.
`.
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`.
`.
`.
`.
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`.
`.
`.
`.
`.
`.
`
`.
`.
`.
`.
`.
`
`.
`.
`.
`.
`.
`.
`.
`.
`
`TROUBLESHOOTING
`
`.
`.
`.
`.
`.
`
`.
`.
`.
`.
`.
`.
`.
`.
`
`I
`
`.
`.
`.
`.
`.
`
`.
`.
`.
`.
`.
`.
`.
`.
`
`.
`
`.
`.
`.
`.
`.
`
`.
`,
`.
`.
`.
`.
`.
`.
`
`.
`
`.
`.
`.
`.
`.
`.
`.
`.
`
`.
`
`.
`.
`.
`.
`.
`.
`.
`.
`
`.
`
`.
`.
`.
`.
`.
`.
`.
`.
`
`.
`
`.
`.
`.
`.
`.
`.
`.
`.
`
`.
`
`.
`.
`.
`.
`.
`.
`.
`.
`
`.
`
`.
`.
`.
`.
`.
`.
`.
`.
`
`,
`
`.
`.
`.
`.
`.
`.
`.
`.
`
`.
`
`4
`.
`.
`.
`.
`.
`.
`.
`
`.
`
`.
`.
`.
`.
`.
`.
`.
`.
`
`.
`
`.
`.
`.
`.
`.
`.
`.
`.
`
`.
`
`.
`.
`.
`.
`.
`.
`.
`.
`
`.
`
`.
`.
`.
`.
`.
`.
`.
`.
`
`.
`
`.
`.
`.
`.
`.
`.
`.
`.
`
`84
`.
`. 84
`.
`92
`. 95
`. 96
`. 97
`.
`97
`101
`
`. 107
`
`Aventail Connect Installation Problems .
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`I
`.
`.
`.
`.
`.
`.
`.
`.
`Network Connectivity Problems .
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`Aventail Connect Configuration Problems .
`Application and TCP/IP Stack interoperability Problems .
`Aventail Connect Trace Logging .
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`Error Messages .
`.
`.
`.
`.
`.
`.
`.
`4
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`Reporting Aventail Connect Problems .
`_
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`,
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`.
`.
`.
`.
`.
`
`.
`
`.
`.
`.
`.
`.
`.
`
`.
`
`.
`.
`.
`.
`.
`.
`
`.
`
`.
`.
`.
`.
`.
`.
`
`.
`
`.
`.
`.
`.
`_
`.
`
`.
`
`.
`.
`.
`.
`.
`.
`
`.
`
`.
`.
`.
`.
`.
`.
`
`.
`
`.
`.
`.
`.
`.
`.
`
`.
`
`.
`.
`.
`.
`,
`.
`
`.
`
`.
`.
`.
`.
`.
`.
`
`.
`
`.
`.
`.
`.
`.
`.
`
`.
`
`.
`.
`.
`.
`.
`.
`
`.
`
`. 108
`. 108
`. 110
`.
`110
`.
`111
`.
`112
`
`.
`
`113
`
`GLOSSARY .
`
`INDEX .
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`.
`
`. 117
`
`Aventail Connect 3. 1/2. 6 Administrator’s Guide - iii
`
`Petitioner Apple - Ex. 1022, p. 4
`
`Petitioner Apple - Ex. 1022, p. 4
`
`

`
`Introduction
`
`_ntroduction
`
`Welcome to the Aventail Connect 3.1/2.6 secure Windows client for 16- and 32-
`
`bit Windows applications. The client component of the Aventail ExtraNet Center,
`Aventail Connect is a secure proxy client based on SOCKS 5, the IETF standard
`for authenticated firewall traversal. Aventail Connect delivers enhanced security
`and simplifies SOCKS deployment for users and network managers.
`
`Aventail Connect redirects VVinSock calls and reroutes them based upon a set of
`routing directives (rules) assigned when Aventail Connect is configured. (For
`more information about WinSock, TCP/IP, and general network communications,
`see “Getting Started")
`
`On larger networks, Aventail Connect can address multiple SOCKS 5 servers
`based on end destination and type of service. This feature enables network
`administrators to effectively monitor and direct network traffic.
`
`Aventail Connect is a proxy client, but when used with SSL it provides the ability
`to encrypt inbound or outbound information.
`
`Features of Aventail Connect:
`
`- Aventail Connect supports X.509 client certificates for strong authenti~
`cation with SSL (when encryption is enabled)
`
`- Automated Customizer utility simplifies client configuration, distribution,
`and installation
`
`- SSL compression detects low bandwidth connections and compresses
`encrypted data (when encryption is enabled)
`
`- Secure Extranet Explorer (via Extranet Neighborhood icon on desk-
`top) allows users to securely access Windows or SMB hosts over an
`extranet connection (Windows 95, Windows 98, and Windows NT 4.0
`only)
`
`- Supports WinSock 2 (LSP) applications in Windows 98, and Windows
`NT 4.0, and V\finSock 1.1 and V\finSock 2 applications in Vifindows 95
`
`- Supports V\finSock 1.1 applications in Vwndows 3.1, Vifindows for Work-
`groups 311, and Windows NT 3.51
`
`- Multi Proxy feature allows you to use a SOCKS server or an HTTP
`proxy to control outbound access
`
`- Allows the use of port ranges for redirection rules
`
`- Provides integration with SoftlDT'“ and SecurlDT"" tokens
`- Provides automated installation and uninstallation
`
`- Credential cache timeout feature allows administrators to specify when
`credentials expire
`
`- Provides optional password protection for configuration files
`
`- Supports both SOCKS v4 and SOCKS v5 (RFC 1928 and RFC 1929)
`standards
`
`Aventail Connect 3. 1/26 Administrator's Guide - 1
`
`Petitioner Apple - Ex. 1022, p. 5
`
`Petitioner Apple - Ex. 1022, p. 5
`
`

`
`Introduction
`
`- Enables network redirection through successive extranet (SOCKS)
`servers
`
`-
`
`-
`
`includes a logging utility to troubleshoot problems with network connec-
`fions
`
`includes a Configuration wizard for simplified step-by-step creation of
`configuration files
`'
`
`- Allows internal network connections to pass through without interfer-
`ence
`
`- Supports multiple authentication methods including SOCKS v4 identifi-
`cation, username/password, CHAP, CRAM, HTTP Basic (username/
`password), and SSL 3.0
`
`_:.
`““
`
`NOTE: Not all versions of Aventail Connect have encryption
`enabled.
`
`Aventail Connect 3. 1/2.6 Administrator's Guide - 2
`
`Petitioner Apple - Ex. 1022, p. 6
`
`Petitioner Apple - Ex. 1022, p. 6
`
`

`
`introduction
`
`ABOUT THIS DOCUMENT
`
`This Administratofs Guide provides basic information about Aventail Connect. It
`includes entry-level data for non-technical users, plus installation, setup, and
`configuration information for network administrators. This information is also
`available via Aventail Connect Help and the Aventail Web site at
`http://www.aventaiI.comlcontentlproducts/docsl.
`
`DOCUMENT ORGANIZATION
`
`This document is divided into three main sections: Administratofs Guide, Utili-
`ties Reference Guide, and Troubleshooting.
`
`The Administrator's Guide describes procedures for setting up, installing, and
`configuring Aventail Connect for individual and multiple networked workstations.
`it also describes how to create a customized Aventail Connect package for distri-
`bution to multiple users.
`
`The Utilities Reference Guide describes the Aventail Connect system menu
`commands and utility programs. It contains detailed information about using the
`S5 Ping utility and the Logging Tool, and documents the authentication/encryp-
`tion modules and settings.
`
`The document concludes with Troubleshooting and the Glossary.
`
`You can also use the Quick Start Card, a short document designed to help you
`install Aventail Connect to an individual workstation, and the Aventail Connect
`flowchart, at
`‘
`http:/lwww.aventaiI.comIcontents/solutionslpresentationslquickstartl
`vpnclient.pdf.
`
`Aventail Connect 3. 1/2.6 Administrator's Guide - 3
`
`Petitioner Apple - Ex. 1022, p. 7
`
`Petitioner Apple - Ex. 1022, p. 7
`
`

`
`Introduction
`
`DOCUMENT CONVENTIONS
`
`The following typographic conventions are used in this document. Exceptions
`may be made for online material; for instance, italics may be difficult to read
`online.
`
` Filenames, extensions, directory names,
`
`
`keynames, and pathnames.
`Command-line commands, options, and portions
`of syntax that must be typed exactly as shown.
`
`Bold
`
`Italic
`
`Dialog box controls (Edit... buttons), e-mail
`addresses (support@aventail.com), URLs,
`(www.aventaiI.com), and IP addresses
`(165.121.6.26).
`
`Placeholders that represent information the user
`must insert.
`
`SEE ALSO: A reference to additional useful information.
`
`
`
`NOTE:
`
`Information the user should be aware of to increase
`
`understanding and/or efficiency of the software.
`
`CAUTION: An operational item that the user should be aware of to
`avoid a network policy/software conflict, or/apse, which
`may create a MINOR security flaw.
`
`WARNING: An operational item that the user should be aware of to
`avoid a network policy/software conflict, or lapse, which
`may create a SERIOUS security flaw.
`
`Aventail Connect 3. 1/2.6 Administrator's Guide - 4
`
`Petitioner Apple - Ex. 1022, p. 8
`
`Petitioner Apple - Ex. 1022, p. 8
`
`

`
`Introduction
`
`AVENTAIL TECHNICAL SUPPORT
`
`Contact Aventail Technical Support if you have questions about installation, con-
`figuration, or general usage of Aventail Connect. Refer to the Aventail Support
`Web site, at http:/Iwww.aventail.comlindex.phtmlIsupportl
`online_support.phtml, or the Aventail Knowledge Base, at
`http://www.aventaiI.comlindex.phtml?page_id=03110000, for the latest tech-
`nical notes and information. Refer to the readme . txt documentation for addi-
`tional information not included in the Administrators Guide.
`
`Aventail Technical Support:
`Web site: http://www.aventail.com/index.phtml/support/index.phtml
`. E-mail: support@aventai|.com
`Phone: 206.215.0078
`Fax: 206.215.1120
`
`ABOUT AVENTAIL CORPORATION
`
`Aventail Corporation is the leading vendor of extranet software. lts extranet solu-
`tions allow organizations to secure their networked communications and man-
`age their employees’ access to the Internet. Building an extranet gives
`organizations the ability to dynamically create a private communication or data
`channel over the Internet. Aventail’s adherence to open security standards sim-
`plifles extranet deployment, enables interoperability, and leverages corporations’
`existing network investments. lts extranet solutions allow companies to extend
`the reach of their corporate extranets to customers, partners, remote offices, and
`worldwide employees.
`
`Aventail Corporation
`808 Howell Street, Second Floor
`Seattle, WA 98101
`Phone:206.215.1111
`Fax:206.215.1120
`
`http://www.aventail.com/
`info@aventail.com
`
`E?
`
`Aventail
`
`An aventail is a piece of chainmail armor worn around the neck area. In the 14"‘
`century, knights wore an aventail to protect themselves while in combat. Today,
`Aventail continues the tradition of protection by allowing organizations to
`securely communicate over the Internet.
`
`Aventail Connect 3. 1/2.6 Administrator's Guide - 5
`
`Petitioner Apple - Ex. 1022, p. 9
`
`Petitioner Apple - Ex. 1022, p. 9
`
`

`
` iiiii¢i.;..-...-s;;;;..i.,.-5 auras]
`
`Administrators Guide
`
`This section includes procedural and background information on installing Aven-
`tail Connect on both single and networked workstations. it includes:
`
`-
`
`"Getting Started," with brief explanations of network security and com-
`munications
`
`- Definitions of SOCKS and Aventail Connect
`
`- Aventail Connect platform and installation requirements, with an intro-
`duction to Winsock 2 and LSP architecture
`
`-
`
`"Installing Aventail Connect," which includes network diagrams of
`Aventail ExtraNet Center and SOCKS v4—based sewer configurations
`- Directions on how to create and edit configuration files, and an intro-
`duction to the Aventail Customizer
`
`
`
`NOTE: Aventail understands the importance of a flexible, easy—to—use
`installation process. If you have feedback regarding the Aventail
`Connect installation procedures, or if there are additional features
`you want to see implemented, please e-mail comments to
`support@aventaiI.com. Your input is appreciated.
`
`GETTING STARTED
`
`If you are new to Aventail Connect technology, the following section will help you
`understand what Aventail Connect is and does, and its relationship to network
`security in general.
`
`NETWORK SECURITY IN A NUTSHELL
`
`Escalating security threats are forcing companies to seek ways to safeguard
`their corporate networks and the information they exchange. The first response
`to these concerns has been the development of security firewal|s—software bar-
`riers that control the flow of information. But firewalls are not designed to handle
`complex security issues, such as monitoring network usage, providing private
`communication over public networks, and enabling remote users to gain secure
`access to internal network resources.
`
`Enter SOCKS v5, an Internet Engineering Task Force (lETF)—approved security
`protocol targeted at securely traversing corporate firewalls, SOCKS was origi-
`nally developed in 1990, and is now maintained by NEC. SOCKS acts as a cir-
`cuit—level proxy mechanism that manages the flow and security of data traffic to
`and from your local area network (LAN) or extranet. An application whose traffic
`
`Aventail Connect 3. 1/26 Administrator's Guide - 6
`
`Petitioner Apple - Ex. 1022, p. 10
`
`Petitioner Apple - Ex. 1022, p. 10
`
`

`
`Administrator's Guide
`
`is proxied by SOCKS is considered "socl<sified.” SOCKS is more than a stan-
`dard security firewall. Other features:
`
`- Client Authentication: (SOCKS v5 only) Authentication allows network
`managers to provide selected user access to internal and external
`areas of a network.
`
`- Traffic Encryption: (SOCKS v5 only) Encryption ensures that network
`traffic is private and secure.
`
`- UDP Support: (SOCKS v5 only) User Datagram Protocol (UDP) traffic
`has traditionally been difficult to proxy, with the exception of SOCKS v5.
`- Aventail Connect supports X.509 client certificates within SSL.
`
`- Cross-Platform Support: Unlike many other security solutions, SOCKS
`can be used on various platforms, such as Vwndows NT. Windows 95,
`Windows 98, and various forms of UNIX.
`
`
`
`NOTE: Not all versions of Aventail Connect include the SSL module for
`encryption.
`
`WHAT IS AVENTAIL CONNECT?
`
`Aventail Connect is the client component of the Aventail ExtraNet Center. Aven-
`tail Connect (works) with the_Aventail ExtraNet Server, the SOCKS 5 server com-
`ponent ofthe Aventail ExtraNet Center. You can use Aventail Connect as a
`simple proxy client for managed outbound access, and for secure inbound
`access.
`
`Aventail Connect automates the “socksiflcation" of Transmission Control Proto-
`colllnternet Protocol (TCPl|P) client applications, making it simple for worksta-
`tions to take advantage of the SOC KS v5 protocol. When you run Aventail
`Connect on your system, it, automatically routes appropriate network traffic, from
`a Vlfinsock (Vwndows sockets) application to an extranet (SOCKS) server, or,
`through successive servers, (V\finSock is a Windows, component that.,connects a_
`Windows PC to the Internet using_,TCP/l P.) The SOCKS server then sends the
`traffic to the Internet or the external network. Network administrators can define
`a set of rules that route this traffic.
`
`y
`
`Aventail Connect is designed to run transparently on each workstation, without
`adding overhead to the user’s desktop. In most cases, users will interactywithm
`Aventail Connect only when it prompts them to enter authentication credentials
`for a connection to a secure extranet (SOCKS) server. Users may also occasion-
`ally need to start and exit Aventail Connect, although network administrators
`often configure it to run automatically at startup. Aventail Connect does not
`require administrators to manually establish an encrypted tunnel; Aventail Con-
`nect can establish an encrypted tunnel automatically.
`
`To understand Aventail Connect, you first need to understand a few basics of
`TCP/lP communications.
`
`Aventail Connect 3.1/2.6 Administrator's Guide - 7
`
`Petitioner Apple - Ex. 1022, p. 11
`
`Petitioner Apple - Ex. 1022, p. 11
`
`

`
`Administrator's Guide
`
`TCP/IP COMMUNICATIONS
`
`Vwndows TCP/IP networking applications (such as telnet, e—mail, Web browsers;
`and ftp) use VVinSock to gain access to networks or the lntemet. Wmsock is the
`core component of TCP/IP under Windows, and is the interface that most V\fin-
`dows applications use to communicate to TCP/IP.
`
`it
`
`WINSOCK CONNECTION TO A REMOTE HOST
`
`Via VVInSock,A an application goes through the following steps to connect to a
`remote host on the lnternet or corporate extranet:
`
`1. The application executes a Domain Name System (DNS) lookup to convert
`the hostname into an Internet Protocol (IP) address or, in rare cases, it will do
`a reverse DNS lookup to convert the IP address into a hostname. if the appli-
`cation already knows the IP address, this step is skipped.
`
`2. The applicationlrequests a connection to the specified remote host. This
`causes the underlying stack to begin the TCP handshake, when two comput-
`ers initiate communication with each other. When the handshake is complete,
`the application is notified that the connection is established, and data can then
`be transmitted and received.
`
`3. The application sends and receives data.
`
`Aventa/‘I Connect 3. 1/2.6 Administrator's Guide v 8
`
`Petitioner Apple - Ex. 1022, p. 12
`
`Petitioner Apple - Ex. 1022, p. 12
`
`

`
`Administrator's Guide
`
`WHAT Does AVENTAIL CONNECT Do?
`
`Aventall Connect stlipsw in between Vvinsoclseand thepu,ntderlyingTCP/,lP stack.”
`(See diagLam.,beL9wi)i Ageneppltcetl9._r11t1a.t§tt§itzeMeer1.\!\An§g§.|s.§i1sLth.e_IQP/
`|.E.§.t.ec.t.. Av9ntei.It Qgnnect3..1ei§,a.iLayered_§9rv'
`E59. ‘
`S’ .(L;§iP),..Ayen:ei!..;;
`
`..s=L1ea9e,.statattsompre§§in9t.ii.9r eiigryetingt
`i°r example) before -
`routing it to the TCP/lP stack for transport over the network, The routing is deter-
`mined by the rules described in the configuration file.
`-
`
`Windows TCPi1P application
`(uses either Winsock 1.1 or
`V‘-iinsock 2)
`
`'I'Uir1Soi:K 1.1
`(convert; calls
`I.aWir¢Soi::2]
`
`-
`Aventail Connect
`{Layered Service Provider}
`
`Multiple LSPS can
`be ma,,ed at this
`level
`
`TCPIIP Stack
`
`Physical network
`
`Windows TC P/IP applications and Aventail Connect have no direct contact with
`one another; instead, each of them communicates through VVinSock. Multiple
`LSP applications can be installed at the LSP level.
`
`Aventail Connect 3‘ 1/2.6 Administrator’s Guide - 9
`
`Petitioner Apple - Ex. 1022, p. 13
`
`Petitioner Apple - Ex. 1022, p. 13
`
`

`
`
`
`NOTE: Aventail Connect does not alter or replace WinSock or any other
`core TCP//P components (files) provided by the operating system.
`
`Administrator's Guide
`
`When the Aventail Connect LSP receives a connection request, it determines V
`whether or not the con_nection need;to be redirected (to__a__r_1 Aventail ExtraNet
`$.9J.\!.9I.)...a..[1d./.51!&nC.l’¥.9.!§£5..(lfl S..S.L)... Vlmen.red.irection and enc.rypfi.on are. nottnec-.
`essary, Aventail Cognnewct simply passes the connection request, and any subse-
`quent transmitted data, to the TCP/lP stack.
`
`L
`
`The two most popular versions of V\finSock are versions 1.1 and 2. Aventail Con-
`nect 3.1, like all LSPs, requires V\finSocK 2; V\finSock 1.1 does not support LSPs.
`VVinSock 2 includes backward-compatibility with all V\flnSock 1.1 applications.
`Not every platform supports VVinSock 2 and its LSP structure.
`
`- V\findows 98 and Vwndows NT 4.0 support V\finSock 2 natively. (Wm-
`dows NT 4.0 requires Service Pack 3 or above, available from
`Microsoft.)
`
`- V\findows 95 supports V\finSock 1.1. Vwndows 95 can also support VVin-
`Sock 2, but you must install a patch (available from Microsoft) to add
`support for V\AnSock 2.
`
`- Vwndows 3.1, Windows for Workgroups 3.11, and Windows NT 3.51 do .
`not support V\/inSock 2; they support only VVinSock 1.1.
`
`For those platforms that do not support V\finSock 2 and LSP applications, Aven-
`tail includes Aventail Connect 2.6 on the Aventail Connect 3.1/2.6 CD. Aventail
`Connect 2.6 was designed for operating systems that support only VVinSock 1.1.
`On Vwndows 3.1, Vwndows for Workgroups 3.11, or Vwndows NT 3.51 operating
`systems, setup will install Aventail Connect 2.6. lfyou are working on a Vlfindows
`95 operating system, setup will detect whether you have installed the Microsoft
`Windows 95 V\/inSock 2 Update. If setup detects the Microsoft update, which
`upgrades Windows 95 to support V\finSock 2, setup will install Aventail Connect’
`3.1. if setup does not detect the Microsoft update, it will install Aventail Connect
`26.
`
`The Aventail Connect 2.6 user interface is identical to that of Aventail Connect
`3.1; however, Aventail ,Connect 3.1 includes MultiProxy. functionality (see “Multi-
`ple Firewall Traversal”). Aventail Connect 2.6 does not include MultiProxy.
`
`in the future, more Windows applications may require V\finSock 2.
`
`During installation, setup determines which version ofAventail Connect to install.
`On V\flnSock 2 platforms, Aventail Connect 31 is installed. On V\finSock 1.1 plat-
`forms, Aventail Connect 2.6 is installed. The following table shows how setup
`determines which version of Aventail Connect to install.
`
`Aventail Connect 3. 1/2. 6 Administrator’s Guide - 10
`
`Petitioner Apple - Ex. 1022, p. 14
`
`Petitioner Apple - Ex. 1022, p. 14
`
`

`
`Administrator's Guide
`
`
`
`
`
`
`Windows 98,
`Winsock 2
`E Aventail Connect 3.1
`Vlfindows NT 4.0
`
`it
`
`Windows 95
`
`P Vlfith Microsoft
`patch: Winsock 2
`
`Aventail Connect 3.1
`
`w‘.'n1;c;;;; {fit ’ 1'
`Windows for Workgroups 3.11,
`Vwndows NT 3.51
`
`Vlfithout Microsoft
`patch: Winsock 1.1
`vlia§6£fi.i
`" C
`’
`
`Aventail Connect 2.6
`
`‘T ?{Q;}lTa"ai*E*5aE;cT’§.ET
`
`You can create custom packages that include one or both versions of Aventail
`Connect (3.1 and 2.6). Setup will determine which version to install on each
`workstation. (For more information, see “Customizer.")
`
`WINDOWS 95 AND WINSocK
`
`The Microsoft Vwndows 95 V\/lnSock 2 Update upgrades V\finSock 1.1 to VVIn-
`Sock 2 in Vwndows 95. This patch (filename w95ws2setup . exe) is available
`from the Microsoft Web site, at http:/lwww.microsoft.com/Windows95Idown-
`loadslcontents/wuadmintools/s_wunetworkingtoolsIW95Sockets2l
`default.asp. Unless you need specific Aventail Connect 3.1 features, Aventail
`recommends that you do not upgrade from Winsock 1.1 to WinSock 2. If you do
`not upgrade to V\/lnSock 2, Aventail Connect 2.6 will be installed on Vwndows 95
`systems,
`
`If you do need to install the Microsoft V\/indows 95 V\flnSock 2 Update, follow the
`instructions provided by Microsoft. Reboot your computer after upgrading, prior
`to installing Aventail Connect.
`
`How Does AVENTAIL CONNECT WORK?
`
`The following three steps are identical to standard WinSock communications
`steps described above; however, nested inside them are additional actions and
`options introduced by Aventail Connect.
`
`1. The application does a DNS lookup to convert the hostname to an IP address
`or, in rare cases, it will do a reverse DNS lookup to convert the IP address to a
`hostname. If the application already knows the IP address, this entire step is
`skipped. Otherwise, Aventail Connect does the following:
`
`-
`
`If the hostname matches a local d°.main .s,trin9.o.,r..d9es.no.t.match..a,.redi-
`rection rule, Aventail Connect passes the Wnarne resolution query ,
`l_
`through to the,TCF’/|,P,stack on the localv workstation... The...T.CP/IP stack
`performs the lookup as if Aventail Connect were not running.
`
`Aventail Connect 3. 1/2. 6 Administrator's Guide - 11
`
`Petitioner Apple - Ex. 1022, p. 15
`
`Petitioner Apple - Ex. 1022, p. 15
`
`

`
`Administrator's Guide
`
`-
`
`-
`
`If the destination hostname matches a redirection rule domain name
`(i.e., the host is part of a domain we are proxying traffic to) then Aventail
`Connect creates a false DNS entry (HOSTENT) that it can recognize
`during the connection request. Aventail Connect will forward the host-,
`name to the extranet (SOCKS) server in step 2 and the SOCKS server
`performs the hostname resolution.
`
`,
`
`If the DNS proxy option is enabled and the domain cannot be looked up
`directly, Aventail Connect creates a false DNS entry that it can recog-
`nize Iater, and returns this to the calling application. The false entry tells
`Aventail Connect that the DNS lookup must be proxied, andthat it m,u,s,t__
`send the fully qualified hostname to the SOCKS server with the SOCKS
`connection request.
`
`Q
`
`CAUTION:
`
`The reverse DNS process can create unexpected
`delays, causing Aventail Connect to behave unpredict-
`ably. Aventail recommends that you do not enable this
`option unless you specifically require the Reverse DNS
`functionality
`
`2. The application requests a connection to the remote host. This causes the
`underlying stack to begin the TCP handshake. When the handshake is com-
`plete, the application is notified that the connection is established and that
`data may now be transmitted and received. Aventail Connect does the
`following:
`
`a. Aventail Connect checks the connection request.
`
`-
`
`-
`
`If the request contains a false DNS entry (from step 1), it will be
`proxied.
`
`If the request contains a.ro,uta.b|e ll? address, and the rulesin the, .
`configuratign. file. say. it must be rzrexied. .Ay.entai.l.,.C.orin.ectwill ca.ll..
`Vtfinsock to begin, the TCP handshakewith the server designated
`in the configuration file.
`
`-
`
`If the request contains a ,re_allP address gandgthe configuration file
`rule says that it does not need to be p,roxi,e,d, the request will be
`passed to V\finSock and processing jumps to step 3 as if Aventail
`Connect were not running.
`b. When the connection is completed, Aventail Connect begins the
`SOCKS negotiation.
`
`-
`
`It sends the list of authentication methods enabled in the configu-
`ration file.
`
`-
`
`- Once the server selects an authenticatipnmethod, Aventail Con-
`nect executes the specified authentication processing.
`It then sends the proxy request to the" extranet (SOCKS) server.
`This includes either the IP address provided by the application or
`the DNS entry (hostname) provided in step 1.
`c. When the SOCKS negotiation is completed, Aventail Connect notifies
`the application. From the applications point of view, the entire SOCKS
`
`Aventail Connect 3. 1/2. 6 Administrator’s Guide ~ 12
`
`Petitioner Apple - Ex. 1022, p. 16
`
`Petitioner Apple - Ex. 1022, p. 16
`
`

`
`Administrators Guide
`
`negotiation, including the authentication negotiation, is merely the TCP
`handshaking.
`
`3. The application transmits and receives data.
`
`if an encryption module is enabled and selected by the SOCKS server, Aven-
`tail Connect encrypts the data on its way to the serveron behalf ofthe appli-
`cation. if data is being returned, Aventail Connect decrypts it so that the
`application sees cleartext data.
`
`AVENTAIL CONNECT PLATFORM REQUIREMENTS
`
`The following table lists the minimum system requirements for each of the plat-
`forms that Aventail Connect supports.
`
`
`
`Windows 98;
`Windows NT 4.0
`(requires
`Microsoft Service
`Pack 3 or above)
`
`Windows 95;
`VVlfld0WS NT 3.51
`
`L
`
`Windows 3.1;
`Windows for
`Workgroups 3.11
`
`x86-based or
`Pentium personal
`computer
`
`16 MB
`
`Netvvork-accessible
`SOCKS v4 or v5 compliant
`server
`
`x86—based or
`Pentium personal
`computer
`x86-based or
`Pentium personal
`computer
`
`i
`
`L
`
`8 MB
`
`4 MB
`
`J.
`
`Network-accessible
`SOCKS v4 or v5 compliant
`server
`Network—accessib|e
`SOCKS v4 or v5 compliant
`server
`
`._J
`
`Aventail Connect 3.1 runs on the following operating systems:
`- Windows 98
`
`~ Vlfindows NT 4.0 (with Service Pack 3 or above, available from
`Microsoft)
`
`- Windows 95, with the Microsoft V\f