Users Guide

Dell PowerConnect ArubaOS 5.0 | User Guide Virtual Private Networks | 349
Remote Access VPN for L2TP IPsec
The combination of Layer-2 Tunneling Protocol and Internet Protocol Security (L2TP/IPsec) is a highly-secure
technology that enables VPN connections across public networks such as the Internet. L2TP/IPsec provides both
a logical transport mechanism on which to transmit PPP frames as well as tunneling or encapsulation so that the
PPP frames can be sent across an IP network. L2TP/IPsec relies on the PPP connection process to perform user
authentication and protocol configuration. With L2TP/IPsec, the user authentication process is encrypted using
the Data Encryption Standard (DES) or Triple DES (3DES) algorithm.
L2TP/IPsec requires two levels of authentication:
z Computer-level authentication with a preshared key to create the IPsec security associations (SAs) to protect
the L2TP-encapsulated data.
z User-level authentication through a PPP-based authentication protocol using passwords, SecureID, digital
certificates, or smart cards after successful creation of the SAs.
Configure the VPN via the WebUI
Authentication Method and Server Addresses
1. Navigate to Configuration> Advanced Services > VPN Services and click the IPsec tab.
2. To enable L2TP, select Enable L2TP (this is enabled by default).
3. Select the authentication method. Currently supported methods are:
 Password Authentication Protocol (PAP)
 Extensible Authentication Protocol (EAP)
 Challenge Handshake Authentication Protocol (CHAP)
 Microsoft Challenge Handshake Authentication Protocol (MSCHAP)
 MSCHAP version 2 (MSCHAPv2)
4. Configure the IP addresses of the primary and secondary Domain Name System (DNS) servers and primary
and secondary Windows Internet Naming Service (WINS) Server that will be pushed to the VPN client.
Define Address Pools
Next, define the pool from which the clients are assigned addresses.
1. In the Address Pools section of the IPsec tab, click Add to open the Add Address Pool page.
2. Specify the start address, the end address and the pool name.
3. Click Done to apply the configuration.
Source NAT
1. In the Source NAT section of the IPsec tab, select Enable Source NAT if the IP addresses of clients need to be
translated to access the network
2. If you enabled source NAT, click the NAT pool drop-down list and select an existing NAT pool. If you have
not yet created the NAT pool you want to use:
a. Navigate to Configuration > IP > NAT Pools.
b. Click Add.
c. In the Pool Name field, enter a name for the new NAT pool, up to 63 alphanumeric characters.
d. In the Start IP address field, enter the dotted-decimal IP address that defines the beginning of the range of
source NAT addresses in the pool.
e. In the End IP address field, enter the dotted-decimal IP address that defines the end of the range of
source NAT addresses in the pool.