Online support / tutorials

The steps, in order

Open each step to see what to do, the pitfall to avoid and the tip that saves time. Tick them off as you go.

1. 1

   Check the workstation and the gatewayEnterprise 7.7 has stricter requirements than Standard 6.87.

   • Supported operating systems are Windows 10 or 11, 64-bit, on x86-64 processors.
   • The gateway must support IKEv2 (or SSL/OpenVPN): IKEv1 no longer exists in 7.x.
   • DES, 3DES, MD5, SHA-1, DH 1, 2 and 5 algorithms are no longer accepted.
   • RSA certificates under 2048 bits and ECDSA certificates under 256 bits are rejected.

   Pitfall

   An IKEv1 tunnel that works perfectly in Standard simply cannot be recreated. Adapt your VPN configuration before you migrate.

   Tip

   Open the current configuration and note the IKE version and the tunnel algorithms: within two minutes you will know whether the gateway needs to change.

   Step completed
2. 2

   Document the Standard configurationAnything you do not write down will be lost.

   • Write down the gateway address, Local and Remote IDs, algorithms, remote networks, DNS and “all traffic through the tunnel” mode.
   • Take screenshots of every tab of the tunnel.
   • Back up the user certificate (P12 file), the pre-shared key and the gateway’s CA chain.

   Pitfall

   Assuming the .tgb export is always enough. Only a configuration exported from a Standard 6.8.210 client can be imported into Enterprise 7.7.013, and IKEv1 VPN configurations cannot be imported into Enterprise 7.7. In all other cases, keep the export as a reference only and recreate the configuration.

   Tip

   Keep screenshots, P12 and CA chain together in one folder, outside the workstation you are migrating.

   Step completed
3. 3

   Get the Enterprise license readyA subscription license, separate from the Standard license.

   • Obtain an Enterprise license number before migration day.
   • Choose the activation e-mail address. For deployments, use the computer name so you can trace each activation.

   Pitfall

   The ACTIVMAIL parameter must be formatted as an e-mail address.

   Tip

   ACTIVMAIL=%ComputerName%@company.com shows the computer name in the activation console.

   Step completed
4. 4

   Uninstall the Standard clientWith internet access, so the license is released.

   • Open the Windows Control Panel > Programs and Features.
   • Select “TheGreenBow VPN Client”, then click Uninstall (see chapter 5 of the Standard 6.8 Administrator’s Guide).
   • Restart the workstation.

   Pitfall

   Uninstalling offline: the Standard activation is not released on the server side and still counts.

   Tip

   Make sure step 2 is complete before you click: once uninstalled, the configuration can no longer be viewed.

   Step completed
5. 5

   Install Enterprise 7.7In silent mode, with automatic activation.

   Two installation modes are available: silent mode, from the command line, and manual installation. For a manual installation, double-click the MSI file and follow the wizard, described in section 2.2 “Installation procedure” of the Administrator’s Guide.

   In silent mode:

   • Open a command prompt as administrator.
   • Run the installer with your license and activation e-mail:

   msiexec /i "<directory>\TheGreenBow_VPN_ENTERPRISE.msi" /q LICENSE=<license_number> ACTIVMAIL=<email> NOACTIVWIN=1 AUTOACTIV=1

   Copy

   To learn more about the VPN Client installation parameters, see chapter 7 “Parameters and properties of the MSI installer” of the Deployment Guide (PDF).

   Pitfall

   A workstation clock out of sync causes activation errors 54 or 31. Check the time before installing.

   Tip

   A SmartScreen “unrecognized app” warning may appear when the installer starts. It is due to the new code-signing certificate and does not indicate a problem.

   Step completed
6. 6

   Recreate the VPN configurationIn the Windows Enterprise VPN Client Configuration Panel, from your notes.

   • Create the IKEv2 tunnel with the parameters noted in step 2.
   • Import the gateway’s full CA chain: its certificate is now checked by default.
   • If your token is not recognized, describe it in vpnconf.ini, placed in the installation directory.

   Pitfalls

   • Elliptic-curve client certificate with an RSA gateway using method 14: the tunnel does not open. In IKE Auth > More Parameters, add Method14_RSASSA_PKCS1 set to true, respecting the case.
   • The More Parameters tab is hidden by default: to show it, check Show more parameters on the General tab of the Options window (Administrator’s Guide, section 25.2.4).

   Tip

   Automatic certificate selection follows ANSSI recommendations on Key Usage. If your certificate is not offered, check its extensions first.

   Key Usage and Extended Key Usage constraints: see sections 19.8.2 and 19.8.3 of the Administrator’s Guide.

   Step completed
7. 7

   Test and back upA tunnel that opens is only the beginning.

   • Test opening the tunnel, access to resources, renegotiation and resuming from sleep.
   • Export the new configuration as a password-protected .tgb.

   Pitfall

   The export password must be at least 16 characters long, with an uppercase letter, a lowercase letter and a special character. Otherwise, the export is refused.

   See section 12.2 “Exporting a VPN configuration” of the Administrator’s Guide.

   Tip

   This .tgb becomes your template: deploy it to other workstations with TGBCONF_PATH at installation.

   Step completed