Users Guide

3. Click the Default Role drop-down list and select the default user role for authenticated VPN users. (For
detailed information on creating and managing user roles and policies, see Roles and Policies on page 370.)
4. (Optional) If you use client certificates for user authentication, select the Check certificate common
name against AAA server checkbox to verify that the certificate's common name exists in the server.
This parameter is enabled by default in the default-cap and default-rap VPN profiles, and disabled by
default on all other VPN profiles.
5. (Optional) Set Max Authentication failures to an integer value. The default value is 0, which disables this
feature.
6. (Optional) Regardless of how an authentication server is contacted, the Export VPN IP address as a
route option causes any VPN client address to be exported to OSPF using IPC. Note that the Framed-IP-
Address attribute is assigned the IP address as long as any server returns the attribute. The Framed-IP-
Address value always has a higher priority than the local address pool.
7. (Optional) Enabling PAN Firewall Integration requires IPmapping at Palo Alto Networks firewalls. (For
more information about PAN firewall integration, see Palo Alto Networks Firewall Integration on page 672.)
8. Click Apply.
9. In the Default profile menu in the left window pane, select Server Group.
10.From the Server Group drop-down list, select the server group to be used for VPN authentication.
11.Click Apply.
To configure VPN authentication via the command-line interface, access the CLI in config mode and issue the
following commands:
(host)(config) #aaa authentication vpn default
cert-cn-lookup
clone
default-role <role>
export-route
max-authentication-failure <number>
pan-integration
radius-accounting <server_group_name>
server-group <name>
user-idle-timeout <seconds>
Configuring a Basic VPN for L2TP/IPsec
The combination of Layer-2 Tunneling Protocol and Internet Protocol Security (L2TP/IPsec) creates a highly-
secure technology that enables VPN connections across public networks such as the Internet. L2TP/IPsec
provides a logical transport mechanism on which to transmit PPP frames, tunneling, or encapsulation, so that
the PPP frames can be sent across an IP network. L2TP/IPsec relies on the PPP connection process to perform
user authentication and protocol configuration. With L2TP/IPsec, the user authentication process is encrypted
using the Data Encryption Standard (DES) or Triple DES (3DES) algorithm.
L2TP/IPsec using IKEv1 requires two levels of authentication:
l Computer-level authentication with a preshared key to create the IPsec security associations (SAs) to
protect the L2TP-encapsulated data.
l User-level authentication through a PPP-based authentication protocol using passwords, SecureID, digital
certificates, or smart cards after successful creation of the SAs.
Note that only Windows 7 (and later versions), StrongSwan 4.3, and VIA clients support IKEv2. For additional
information on the authentication types supported by these clients, see
Working with IKEv2 Clients on page 344.
Dell Networking W-Series ArubaOS 6.5.x | User Guide Virtual Private Networks | 348