Users Guide

entering a username and password. IKE Phase 1 authentication can be done with either an IKE preshared key
or digital certificates; for XAuth clients using smart cards, the smart card digital certificates must be used for IKE
authentication. The client is authenticated with the internal database on the controller.
On the controller, you must configure the following:
1. Add entries for Cisco VPN XAuth clients to the controller’s internal database, or to an external RADIUS or
LDAP server. For details on configuring an authentication server, see Authentication Servers on page 175.
For each client, you need to create an entry in the internal database with the entire Principal name (SubjectAltname
in X.509 certificates) or Common Name as it appears on the certificate.
2. Verify that the server with the client data is part of the server group associated with the VPN authentication
profile.
3. In the L2TP and XAUTH Parameters section of the Configuration > VPN Services > IPsec tab, enable
L2TP.
4. In the L2TP and XAUTH Parameters section of the Configuration > VPN Services > IPsec tab, enable
XAuth to enable prompting for the username and password.
5. The Phase 1 IKE exchange for XAuth clients can be either Main Mode or Aggressive Mode. Aggressive
Mode condenses the IKE SA negotiations into three packets (versus six packets for Main Mode). In the
Aggressive Mode section of the Configuration > VPN Services > IPsec tab, enter the authentication
group name for aggressive mode to associate this setting to multiple clients. Make sure that the group
name matches the aggressive mode group name configured in the VPN client software.
6. Configure other VPNsettings as described in Configuring a VPN for L2TP/IPsec with IKEv2 on page 353,
while ensuring that the following settings are selected:
l In the L2TP and XAUTH Parameters section of the Configuration > VPN Services > IPSEC tab,
enable L2TP.
l In the L2TP and XAUTH Parameters section of the Configuration > VPN Services> IPSEC tab,
enable XAuth to enable prompting for the username and password.
l Define an IKE policy to use RSA or ECDSA authentication.
Configuring a VPN for XAuth Clients Using a Username and Password
This section describes how to configure a remote access VPN on the controller for Cisco VPN XAuth clients
using passwords. IKE Phase 1 authentication is done with an IKE preshared key; users are then prompted to
enter their username and password, which is verified with the internal database on the controller.
On the controller, you must configure the following:
1. Add entries for Cisco VPN XAuth clients to the controller’s internal database. For details on configuring an
authentication server, see Authentication Servers on page 175
For each client, you need to create an entry in the internal database with the entire Principal name (SubjectAltname
in X.509 certificates) or Common Name as it appears on the certificate.
2. Verify that the server with the client data is part of the server group associated with the VPN authentication
profile.
3. Configure other VPN settings as described in Configuring a VPN for L2TP/IPsec with IKEv2 on page 353,
while ensuring that the following settings are selected:
l In the L2TP and XAUTH Parameters section of the Configuration > VPN Services > IPSEC tab,
enable L2TP.
Dell Networking W-Series ArubaOS 6.5.x | User Guide Virtual Private Networks | 360