Users Guide

365| Virtual Private Networks Dell Networking W-Series ArubaOS 6.5.x| User Guide
b. For certificate authentication, select Certificate, then click the Server Certificate and CA certificate
drop-down lists to select certificates previously imported into the controller. See
Management Access on
page 824 for more information.
23.Click Done to apply the site-to-site VPN configuration.
24.Click Apply.
25.Click the IPSEC tab to configure an IKE policy.
a. Under IKE Policies, click Add to open the IPSEC Add Policy configuration page.
b. Set the Priority to 1 for this configuration to take priority over the Default setting.
c. Set the Version type to match the IKE version you selected in Step 10.
d. Set the Encryption type from the drop-down list.
e. Set the HASH Algorithm from the drop-down list.
f. Set the Authentication to PRE-SHARE if you use pre-shared keys. If you use certificate-based IKE, select
RSA or ECDSA.
g. Set the Diffie–Hellman Group from the drop-down list.
h. The IKE policy selections, including any pre-shared key, must be reflected in the VPN client configuration.
When using a third-party VPN client, set the VPN configuration on clients to match the choices made
above. If you use the Dell dialer, you must configure the dialer prior to downloading the dialer onto the
local client.
i. Click Done to activate the changes.
j. Click Apply.
In the CLI
To configure a site-to-site VPN with two static IP controllers using IKEv1, issue the following commands in the
CLI:
(host)(config) #crypto-local ipsec-map <name> <priority>
src-net <ipaddr> <mask>
dst-net <ipaddr> <mask>
peer-ip <ipaddr>
vlan <id>
version v1|v2
peer-cert-dn <peer-dn>
pre-connect enable|disable
trusted enable
For certificate authentication:
set ca-certificate <cacert-name>
set server-certificate <cert-name>
(host)(config) #crypto isakmp policy <priority>
encryption {3des|aes128|aes192|aes256|des}
version v1|v2
authentication {rsa-sig|ecdsa-256ecdsa-384}
group {1|2|19|20}
hash {md5|sha|sha1-96|sha2-256-128|sha2-384-192}
lifetime <seconds>
For pre-shared key authentication:
(host)(config) #crypto-local isakmp key <key> address <ipaddr> netmask <mask>
(host)(config) #crypto isakmp policy <priority>
encryption {3des|aes128|aes192|aes256|des}
version v1|v2
authentication pre-share