Users Guide

363| Virtual Private Networks Dell Networking W-Series ArubaOS 6.5.x| User Guide
Configure VPN settings on the controllers at both the local and remote sites.
Configuring Site-to-Site VPNs
Use the following procedures to create a site-to-site VPN through the WebUI or CLI.
In the WebUI
1. Navigate to the Configuration > Advanced Services > VPN Services > Site-to-Site page.
2. In the IPsec Maps section, click Add to open the Add IPsec Map window.
3. Enter a name for this VPN connection in the Name field.
4. In the Priority field, enter a priority level for the IPsec map. Negotiation requests for security associations
try to match the highest-priority map first. If that map does not match, the negotiation request continues
down the list to the next-highest priority map until a match is made.
5. Select a Source Network Type to specify whether the VPN source, the local network connected to the
controller, is defined by an IP address or a VLAN ID.
l If you selected IP, enter the IP address and netmask for the source network. (See controller A in Figure
49)
l If you selected VLAN, click the Source Network VLAN drop-down list and select the VLANID for the
source network.
6. In the Destination Network and Destination Subnet Mask fields, enter the IP address and netmask for
the destination, the remote network to which the local network communicates. (See controller B in Figure
49)
7. Select one of the supported peer gateway types:
l IP Address: Select this option to identify the remote end point of the VPN tunnel using an IP address.
l FQDN:This option allows you to use same FQDN across different branches. The FQDN resolves to
different IP addresses for each branch, based on its local DNS setting.
8. Define the Peer Gateway using an IPaddress or FQDN.
l If you use IKEv1 to establish a site-to-site VPN for a statically addressed remote peer and selected
IPAddress in the previous step, enter the IP address of the interface used by the remote peer to
connect to the L3 network in the Peer Gateway field (See Interface B in Figure 49).
l If you are configuring an IPsec map for a dynamically addressed remote peer, and selected IPAddress in
the previous step, leave the peer gateway set to its default value of 0.0.0.0.
l If you selected FQDN as the peer gateway type in the previous step, enter the fully qualified domain
name for the remote peer.
9. If you use IKEv2 to establish a site-to-site VPN for a statically addressed remote peer, identify the peer
device by entering its certificate subject name in the Peer Certificate Subject Name field.
To identify the subject name of a peer certificate, issue the following command in the CLI:
show crypto-local pki servercert <certname> subject
10.The Security Association Lifetime parameter defines the lifetime of the security association in seconds
and kilobytes. The default value is 7200 seconds. To change this value, uncheck the default checkbox and
enter a value between 300 and 86400 seconds or 1000 and 1000000000 kilobytes.
11.Click the Version drop-down list and select V1 to configure the VPN for IKEv1, or V2 for IKEv2.
12.(Optional) Click the IKEv Policies drop-down list and select a predefined or custom IKE policy to apply to
the IPsec map. For more information on default IKE policies, see
Table 78.