Installation guide

BlackBerry Enterprise Solution 85

VPN solution on the Wi-Fi enabled BlackBerry device

The Wi-Fi enabled BlackBerry device has a built-in VPN client that supports several VPN concentrators. Visit

www.blackberry.com/products/wlan/sys_req.shtml for a list of currently supported VPN concentrators.

If the Wi-Fi enabled BlackBerry device has a VPN profile, it logs into the VPN concentrator automatically after

connecting to the enterprise Wi-Fi network. To create a VPN profile, the BlackBerry Enterprise Server

administrator must configure the VPN client settings (for example, the IP address of the VPN concentrator, user

names and passwords, and cryptographic methods to be used) on the Wi-Fi enabled BlackBerry device, or on the

BlackBerry Enterprise Server using IT policy rules. Depending on the security policy of your organization, the

BlackBerry Enterprise Server administrator or the BlackBerry device user can save each user name and password

to the Wi-Fi enabled BlackBerry device to prevent the Wi-Fi enabled BlackBerry device from prompting the user

for credentials the first time (or each time) that the Wi-Fi enabled BlackBerry device connects to the enterprise

Wi-Fi network.

The Wi-Fi enabled BlackBerry device is also compatible with VPN environments that use two-factor

authentication using hard tokens or software tokens for user credentials. When the Wi-Fi enabled BlackBerry

device tries to log into the VPN, the Wi-Fi enabled BlackBerry device uses automatically generated or user-

provided credentials with the hard token or software token.

Appendix I: Algorithm suites that the BlackBerry device supports for

negotiating SSL connections

Wi-Fi enabled BlackBerry devices support the following direct mode TLS algorithm suites for negotiating SSL

connections to the BlackBerry Infrastructure.

• DH_anon_WITH_3DES_EDE_CBC_SHA

• DH_anon_WITH_AES_128_CBC_SHA

• DH_anon_WITH_AES_256_CBC_SHA

• DH_anon_WITH_DES_CBC_SHA

• DH_anon_WITH_RC4_128_MD5

• DH_anon_EXPORT_WITH_DES40_CBC_SHA

• DH_anon_EXPORT_WITH_RC4_40_MD5

• DHE_DSS_EXPORT_WITH_DES40_CBC_SHA

• DHE_RSA_EXPORT_WITH_DES40_CBC_SHA

• DHE_DSS_WITH_3DES_EDE_CBC_SHA

• DHE_DSS_WITH_AES_128_CBC_SHA

• DHE_DSS_WITH_AES_256_CBC_SHA

• DHE_DSS_WITH_DES_CBC_SHA

• DHE_RSA_WITH_AES_128_CBC_SHA

• DHE_RSA_WITH_AES_256_CBC_SHA

• DHE_RSA_WITH_3DES_EDE_CBC_SHA

• DHE_RSA_WITH_DES_CBC_SHA

• RSA_EXPORT_WITH_RC4_40_MD5

• RSA_EXPORT_WITH_DES40_CBC_SHA

• RSA_WITH_DES_CBC_SHA

• RSA_WITH_RC4_128_SHA

2008 Research In Motion Limited. All rights

reserved.