Users Guide

Dell PowerConnect ArubaOS 5.0 | User Guide Virtual Private Networks | 351
IKE Policies
crypto isakmp policy <priority>
encryption {3des|aes128|aes192|aes256|des}
authentication {pre-share|rsa-sig}
group {1|2}
hash {md5|sha}
lifetime <seconds>
Example Configurations for Remote Access Clients
This section describes how to configure remote access VPNs for L2TP/IPsec clients.
This section describes how to configure a remote access VPN on the controller for Microsoft L2TP/IPsec clients
with smart cards. (A smart card contains a digital certificate which allows user-level authentication without the
user entering a username and password.) As described previously in this section, L2TP/IPsec requires two levels of
authentication: first, IKE SA authentication, and then user-level authentication with a PPP-based authentication
protocol. Microsoft clients do not support smart card authentication for the IKE SA. Therefore, the IKE SA is
authenticated with a preshared key, which you must configure as an IKE shared secret on the controller.
User-level authentication is performed by an external RADIUS server using PPP EAP-TLS. In this scenario, client
and server certificates are mutually authenticated during the EAP-TLS exchange. During the authentication, the
controller encapsulates EAP-TLS messages from the client into RADIUS messages and forwards them to the
server.
On the controller, you need to configure the following:
z User role for authenticated clients
z RADIUS server and the authentication server group to which the server belongs
z VPN authentication profile which defines the authentication server group and the default role assigned to
authenticated clients
z L2TP/IPsec VPN with EAP as the PPP authentication
z IKE policy for preshared key authentication of the SA
Configuring a VPN for Smart Card Clients via the WebUI
Use the following procedure to configure a L2TP/IPsec VPN for Microsoft smart card clients via the WebUI:
1. Navigate to the Configuration > Security > Access Control > Policies page.
2. Click Add to add a new policy.
a. Enter the name of the policy (for example, authenticated). Default settings for a policy rule permit all
traffic from any source to any destination, but you can make a rule more restrictive. You can also configure
multiple rules; the first rule in a policy that matches the traffic is applied.
b. Click Add to add a rule.
c. When you are done adding rules, click Apply.
d. Click the User Roles tab. Click Add to add a new user role.
e. Enter the name of the role (for example, employee).
f. Under Firewall Policies, click Add. In the Choose from Configured Policies drop-down list, select the
policy you previously created. Click Done.
g. Click Apply.
Note: On the RADIUS server, you must configure a remote access policy to allow EAP authentication for smart card users and
select a server certificate. The user entry in Microsoft Active Directory must be configured for smart cards.