Manualshelf

Users Guide

ManualsBrandsDell ManualsAccess PlatformsW-Series Controller AOS
351352353354355356357358359360
Table Of Contents
355| Virtual Private Networks Dell Networking W-Series ArubaOS 6.5.x| User Guide
4. Set the Encryption type. Click the Encryption drop-down list and select one of the following encryption
types:
l DES
l 3DES
l AES128
l AES192
l AES256
5. Set the HASH function. Click the Hash drop-down list and select one of the following hash types:
l MD5
l SHA
l SHA1-96
l SHA2-256-128
l SHA2-384-192
6. ArubaOS VPNs support IKEv2 client authentication using RSA digital certificates or Elliptic Curve Digital
Signature Algorithm (ECDSA) certificates. To set the authentication type for the IKE rule, click the
Authentication drop-down list and select one of the following types:
l RSA
l ECDSA-256
l ECDSA-384
7. Diffie-Hellman is a key agreement algorithm that allows two parties to agree upon a shared secret, and is
used within IKE to securely establish session keys. To set the Diffie–Hellman Group for the ISAKMP policy,
click the Diffie–Hellman Group drop-down list and select one of the following groups:
l Group 1: 768-bit Diffie–Hellman prime modulus group.
l Group 2: 1024-bit Diffie–Hellman prime modulus group.
l Group 19: 256-bit random Diffie–Hellman ECP modulus group.
l Group 20: 384-bit random Diffie–Hellman ECP modulus group.
Configuring Diffie–Hellman Group 1 and Group 2 types are not permitted if the controller is operating in the FIPS
mode.
8. Set the Pseudo-Random Function (PRF) value. This algorithm is an HMAC function to used to hash certain
values during the key exchange:
l PRF-HMAC-MD5
l PRF-HMAC-SHA1
l PRF-HMAC-SHA256
l PRF-HMAC-SHA384
9. Set the Security Association Lifetime to define the lifetime of the security association in seconds. The
default value is 7200 seconds. To change this value, uncheck the default checkbox and enter a value
between 300 and 86400 seconds.
10.Click Done.
Setting the IPsec Dynamic Map
Dynamic maps enable IPsec SA negotiations from dynamically addressed IPsec peers. ArubaOS has predefined
IPsec dynamic maps for IKEv2. If you do not want to use these predefined maps, you can use the procedures