Users Guide

3. In the Priority field, enter a priority number for the map. Negotiation requests for security associations try
to match the highest-priority map first. If that map does not match, the negotiation request continues
down the list to the next-highest priority map until a match is made.
4. Click the Version drop-down list and select V1 to create an IPsec map for remote peers using IKEv1.
5. (Optional) Configure Perfect Forward Secrecy (PFS) settings for the dynamic peer by assigning a Diffie-
Hellman prime modulus group. PFS provides an additional level of security by ensuring that the IPsec SA
key was not derived from any other key, and therefore, cannot be compromised if another key is broken.
Click the Set PFS drop-down list and select one of the following groups:
l Group 1: 768-bit Diffie–Hellman prime modulus group.
l Group 2: 1024-bit Diffie–Hellman prime modulus group.
l Group 14: 2048-bit Diffie–Hellman prime modulus group.
l Group 19: 256-bit random Diffie–Hellman ECP modulus group.
l Group 20: 384-bit random Diffie–Hellman ECP modulus group.
6. Select the transform set for the map to define a specific encryption and authentication type used by the
dynamic peer. Click the Transform Set drop-down list, and select the transform set for the dynamic peer.
To view current configuration settings for an IPsec transform-set, access the command-line interface and issue the
command crypto ipsec transform-set tag <transform-set-name>.
7. Set the Life Time to define the lifetime of the security association for the dynamic peer in seconds or
kilobytes. The default value is 7200 seconds. To change this value, uncheck the default checkbox and enter
a value between 300 and 86400 seconds or 1000 and 1000000000 kilobytes.
8. Click Done.
Finalizing WebUI changes
When you have finished configuring your IPsec VPN settings, click Apply to apply the new settings before
navigating to other pages.
Configuring a Basic L2TP VPN in the CLI
Use the following procedures to use the command-line interface to configure a remote access VPN for L2TP
IPsec:
1. Define the authentication method and server addresses:
(host)(config) #vpdn group l2tp
enable
client configuration {dns|wins} <ipaddr1> [<ipaddr2>]
2. Enable authentication methods for IKEv1 clients:
vpdn group l2tp ppp authentication {cache-securid|chap|eap|mschap|mschapv2|pap
3. Create address pools:
(host)(config) #ip local pool <pool> <start-ipaddr> <end-ipaddr>
4. Configure source NAT:
(host)(config) #ip access-list session srcnatuser any any src-nat pool <pool> position 1
5. If you are configuring a VPN to support machine authentication using certificates, define server certificates
for VPN clients using IKEv1:
(host)(config) #crypto-local isakmp server-certificate <cert>
6. If you are configuring a VPN to support IKEv1 Clients using pre-shared keys, you can configure a global IKE
key by entering 0.0.0.0 for both the address and netmask parameters in the command below, or configure
an IKE key for an individual subnet by specifying the IP address and netmask for that subnet:
crypto isakmp key <key> address <ipaddr|> netmask <mask>
Dell Networking W-Series ArubaOS 6.5.x | User Guide Virtual Private Networks |
352