FAQ on HKUVPN (Virtual Private Network)    Show all answers   Hide all answers

If you are using an ISP's network and have a valid HKU Network account, you can connect to the HKUVPN service to access many HKU online services.

Follow instruction at http://www.itservices.hku.hk/home/networks/vpn.htm to install the HKUVPN client on your PC.

Note: the HKUVPN service is for current staff & students only.

The VPN disconnects itself after 30 minutes of idle time. In order to give our users a fair share of the VPN network usage, there is a time limit of 4 hours for each connection session.

If your computer is protected by a personal firewall or you connect VPN behind a home router, you cannot connect to the VPN. You have to allow the following protocols to pass through the firewall in order to connect to VPN:

For Windows native VPN client:
UDP  500   Internet Key Exchange (IKE)
UDP  4500  IPsec NAT-T
IP Protocol  50  Encapsulating Security Payload (ESP)

Note: For home routers, enabling "IPsec Passthrough" often permits above protocols.

For Cisco AnyConect VPN client:
UDP   443   SSL
TPC   443   SSL

Note: If you have a home router, you have to configure it properly to allow VPN traffic to pass through.

Start Symantec Client Firewall program
=> select Client Firewall
=> click Configure icon
=> click Network Tab
=> click Add icon to add rule
=> select Individually
=> enter vpn2.hku.hk
=> click OK to save the setting.

For Kaspersky Anti-virus 2012 or Kaspersky Internet Security 2012:
Start Kaspersky Anti-virus or Kaspersky Internet Security program
=> click Settings
=> select Advanced Settings icon and then click Threats and exclusions
=> click Settings... under the Exclusions section
=> click Trusted application tab, then click Add and select Browse...
=> Locate the vpnagent program (C:\Program Files\Cisco\Cisco AnyConnect VPN Client), Select vpnagent and click Open
=> check the boxes against Do not inherit restrictions from the parent process (application) and Do not scan network traffic
=> click OK and then click OK save the settings

For Kaspersky Anti-Virus 6.0 for Windows Workstations
Start Kaspersky Anti-Virus 6.0 for Windows Workstations program
=> click Settings
=> click Trusted zone... under the Exclusions section
=> click Trusted application tab, then click Add and select Browse...
=> Locate the vpnagent program (C:\Program Files\Cisco\Cisco AnyConnect VPN Client), Select vpnagent and click Open
=> check the box against Do not scan network traffic
=> click OK and then click OK save the settings

In IE, click menu Tools => Internet Options => Connections => select Never dial a connection.

Please see http://www.itservices.hku.hk/faq/hallnet/Disable_ICS.htm

Q6a. Error 619: Access was denied because the username and /or password was invalid on the domain.

Q6b. Error 768: The connection attempt failed because of failure to encrypt data

Q6c. Error 769: The specified destination is not reachable

It is found that HKUVPN2 connection cannot be established if one of the following software is installed:
360安全衛士
金山毒霸
QQ電腦管家

To resume HKUVPN2 connection, it is advised to uninstall the above software, and then install Sophos anti-virus to protect your computer. (For students only)
HKU Portal -> Search for "Sophos" -> Download Sophos Anti-Virus (Each student can now download ONE copy ONLY)

If HKUVPN2 connection still fails, you should check your computer to make sure IPSec Services have been started.

For Windows XP
Right click "My Computer" - > Manage -> (left pane) Services -> (centre pane) IPSec Service Make sure the above "IPSec Services" is started. If not, start it and set its "Startup Type" to "Auto".

Windows 7 or Vista
Right click "My Computer" - > Manage -> (left pane) Services ->
(centre pane) IKE and AuthIP IPSec Keying Modules ->
(centre pane) IPsec Policy Agent

Make sure the above are started. If not, start them and set their "Startup Type" to "Auto".