Users Guide

Certificate-based authentication is only supported for site-to-site VPN between two controllers with static IP
addresses. IKEv1 site-to-site tunnels cannot be created between master and local controllers.
Enable IPcompression in an IPsec map to reduce the size of data frames transmitted over a site-to-site VPN
between W-7200 Series or W-7000 Series controllers using IKEv2 authentication. IPcompression can reduce
the time required to transmit the frame across the network. When this hardware-based compression feature is
enabled, the quality of unencrypted traffic (such as Lync or Voice traffic) is not compromised by increased
latency or decreased throughput. IP compression is disabled by default.
This feature is only supported in an IPv4 network using IKEv2. This feature cannot be enabled on a W-7205 controller
or on a site-to-site VPN established using IKEv1.
Working with Third-Party Devices
Dell controllers can use IKEv1 or IKEv2 to establish a site-to-site VPN with another Dell controller or third-party
remote client devices. Devices running Microsoft
®
Windows 2008 can use Suite-B cryptographic algorithms
and IKEv1 to support authentication using RSA or ECDSA. StrongSwan
®
4.3 devices can use IKEv2 to support
authentication using RSA or ECDSA certificates, Suite-B cryptographic algorithms, and pre-shared keys. These
two remote clients are tested to work with Dell controllers using Suite-B cryptographic algorithm.
Working with Site-to-Site VPNs with Dynamic IP Addresses
ArubaOS supports site-to-site VPNs with two statically addressed controllers, or with one static and one
dynamically addressed controller. Two methods are supported to enable dynamically addressed peers:
l Pre-shared Key Authentication with IKE Aggressive Mode: The Dell controller with a dynamic IP
address must be configured as the initiator of IKE Aggressive-mode for Site-Site VPNs, while the controller
with a static IP address must be configured as the responder of IKE Aggressive mode. Note that when the
controller is operating in FIPS mode, IKE aggressive mode must be disabled.
l X.509 certificates: IPsec peers will identify each other using the subject name of X.509 certificates. IKE
operates in main mode when this option is selected. This method is preferred from a security standpoint.
Understanding VPN Topologies
You must configure VPN settings on the controllers at both the local and remote sites. In the following figure, a
VPN tunnel connects Network A to Network B across the Internet.
Figure 49 Site-to-Site VPN Configuration Components
To configure the VPN tunnel on controller A, you must configure the following:
l The source network (Network A)
l The destination network (Network B)
l The VLAN on which controller A’s interface to the Layer-3 network is located (Interface A in Figure 49)
l The peer gateway, which is the IP address of controller B’s interface to the Layer-3 network (Interface B in
Figure 49)
Dell Networking W-Series ArubaOS 6.5.x | User Guide Virtual Private Networks | 362