Users Guide

406 | Virtual Private Networks Dell PowerConnect W-Series ArubaOS 6.1 | User Guide
2. To enable PPTP, select Enable PPTP.
3. Select either MSCHAP or MSCHAPv2 as the authentication protocol.
4. Configure IP addresses of the primary and secondary DNS servers.
5. Configure primary and secondary WINS Server IP addresses that will be pushed to the VPN Dialer.
6. Configure the VPN Address Pool.
a. Click Add. The Add Address Pool window displays.
b. Specify the pool name, start address, and end address.
c. Click Done on completion to apply the configuration.
7. Click Apply to apply the changes made before navigating to other pages.
In the CLI
vpdn group pptp
enable
client configuration {dns|wins} <ipaddr1> [<ipaddr2>]
ppp authentication {mschapv2}
pptp ip local pool <pool> <start-ipaddr> <end-ipaddr>
Site-to-Site VPNs
Site-to-site VPN allows sites at different physical locations to securely communicate with each other over a Layer-
3 network such as the Internet. You can use Dell controllers instead of VPN concentrators to connect the sites.
Or, you can use a VPN concentrator at one site and a controller at the other site.
The Dell controller supports the following IKE SA authentication methods for site-to-site VPNs:
 Preshared key: Note that the same IKE shared secret must be configured on both the local and remote sites.
 Suite-B cryptographic algorithms
 Digital certificates: You can configure a RSA or ECDSA server certificate and a CA certificate for each site-to-
site VPN IPsec map configuration. If you are using certificate-based authentication, the peer must be
identified by its certificate subject-name distinguished name (for deployments using IKEv2) or by the peer’s
IP address (for IKEv1). For more information about importing server and CA certificates into the controller,
see Chapter 32, “Management Access” on page571.
Third-Party Devices
Dell controllers can use IKEv1 or IKEv2 to establish a site-to-site VPN between another Dell controller or
between that controller and third-party device. Note, however, that only Dell controllers and devices running
Windows 2008 Server or Strongswan 4.3 support IKEv2 authentication.
Devices running Windows 2008 server can use Suite-B cryptographic algorithms and IKEv1 to support
authentication using RSA or ECDSA. Strongswan 4.3 devices can use IKEv2 to support authentication using RSA
or ECDSA certificates, Suite-B cryptographic algorithms, and pre-shared keys.
Site-to-Site VPNs with Dynamic IP Addresses
ArubaOS supports site-to-site VPNs with two statically addressed controllers, or with one static and one
dynamically addressed controller. By default, site-to-site VPN uses IKE Main-mode with Pre-Shared-Keys to
authenticate the IKE SA. This method uses the IP address of the peer, and therefore will not work for dynamically
addressed peers.
NOTE: Certificate-based authentication is only supported for site-to-site VPN between two controllers with static IP addresses.