Users Guide

Enabling Source NAT
In the Source NAT section of the IPSEC tab, select Enable Source NAT if the IP addresses of clients must be
translated to access the network. If source NAT is enabled, click the NAT pool drop-down list and select an
existing NAT pool. To create a new NATpool:
1. Navigate to Configuration > Network > IP > NAT Pools.
2. Click Add.
3. In the Pool Name field, enter a name for the new NAT pool, up to 63 alphanumeric characters.
4. In the Start IP address field, enter the dotted-decimal IP address that defines the beginning of the range
of source NAT addresses in the pool.
5. In the End IP address field, enter the dotted-decimal IP address that defines the end of the range of source
NAT addresses in the pool.
6. In the Destination NAT IP Address field, enter the destination NAT IP address in dotted-decimal format.
If you do not enter an address into this field, the NAT pool uses the destination NAT IP 0.0.0.0.
7. Click Done to close the NAT pools tab.
8. Navigate to Configuration > Advanced Services > VPN Services and click the IPSEC tab to return to the
IPSEC window.
9. Click the NAT Pool drop-down list and select the NAT pool you just created.
Selecting Certificates
To configure the VPN to support machine authentication using certificates, define the IKE Server certificates for
VPN clients using IKEv2. Note that these certificate must be imported into the controller, as described in
Management Access on page 824.
1. Select the IKEv2 server certificate for client machines using IKEv2 by clicking the IKEv2 Server Certificate
drop-down list and selecting an available certificate name.
2. If you are configuring a VPN to support IKEv2 clients using certificates, you must also assign one or more
trusted CA certificates to VPN clients.
a. Under CA Certificate Assigned for VPN-clients, click Add.
b. Select a CA certificate from the drop-down list of CA certificates imported in the controller.
c. Click Done.
d. Repeat the above steps to add additional CA certificates.
Configuring IKE Policies
ArubaOS contains several predefined default IKE policies, as described in Table 78. If you do not want to use
any of these predefined policies, you can use the procedures below to delete a factory-default policy, edit an
existing policy, or create your own custom IKE policy instead.
The IKE policy selections must be reflected in the VPN client configuration. When using a third-party VPN client, set
the VPN configuration on clients to match the choices made above. In case the Dell dialer is used, these
configurations must be made on the dialer prior to downloading the dialer onto the local client.
1. Scroll down to the IKE Policies section of the IPSEC tab, then click Edit to edit an existing policy or click Add
to create a new policy.
You can also delete a predefined factory-default IKE policy by clicking Delete.
2. Enter a number into the Priority field to set the priority for this policy. Enter a priority of 1 for the
configuration to take priority over the Default setting.
3. Select the IKE version. Click the Version drop-down list and select V2 for IKEv2.
Dell Networking W-Series ArubaOS 6.5.x | User Guide Virtual Private Networks |
354