Cisco VPN client autoconnect

Here is something that is worth sharing, how to get a VPN client to automatically connect to the VPN destination (ASA, VPN concentrator etc.). This can help in situations where you need to mimic a VPN appliance (ASA5505) using a windows box. The feature which allows this is the autoinitiate, and the logic behind it is based on wireless behavior, but can be used in a wired environment as well. The behavior is conditioned on the IP network your computer is connecting to when it negotiates an IP address from DHCP or uses a statically configured one. Again, your address is what matters, not the destination address, this comes from the assumption that if you are in the corporate network you will not need a VPN but if you are at home you will, that change is in your IP address, not in the destination. Once the concept is clear, it’s all about configuring it, and this is done by editing the vpnclient.ini, which is located at c:Program FilesCisco SystemsVPN Client . Here is a sample file, with the important lines in bold: [main] ClientLanguage= StatefulFirewall=0 ConnectOnOpen=0 AutoInitiationEnable=1 AutoInitiationRetryInterval=2 AutoInitiationList=MY-CORP-NET [MY-CORP-NET] Network=192.168.10.0 Mask=255.255.255.0 ConnectionEntry=CORP-VPN1 [GUI] WindowWidth=637 WindowHeight=330 WindowX=577 WindowY=198 VisibleTab=0 ConnectionAttribute=0 AdvancedView=1 LogWindowWidth=0 LogWindowHeight=0 LogWindowX=0 LogWindowY=0 ShowCACerts=1 MinimizeOnConnect=1 UseWindowSettings=1 ShowTooltips=1 ShowConnectHistory=0 AccessibilityOption=0 DefaultConnectionEntry=CORP-VPN1 As you can see, the main thing is to insert a bunch of lines in the beginning of the file, between the [main] and the [gui] sections. What you are saying there is enable the autoinitiator feature (first two lines), then the list of networks that if you are using an ip address from you will automatically connect/reconnect to the corresponding VPN entry. Every entry in the AutoInitiationList= should have a corresponding bracket enclosed entry ([MY-CORP-NET] in our example) that specify a network, and the VPN profile to use when your IP address is coming from that network range. As you probably figured out, this can allow multiple connection entries which can be pointing to multiple VPN profiles. With that, it might make sense to save the profile password locally (not very secure but sometimes it’s the only option) and initiate the VPN client at the windows initiation or prior to login. Don’t forget to restart the VPN service after making the changes. More can be found at: http://www.cisco.com/en/US/docs/security/vpn_client/cisco_vpn_client/vpn_client500_501/administration/5vcAch7.html That’s it, happy VPNning …