Users Guide

358 | Virtual Private Networks Dell PowerConnect ArubaOS 5.0 | [User Guide
IKE Policies
crypto isakmp policy <priority>
encryption {3des|aes128|aes192|aes256|des}
authentication {pre-share|rsa-sig}
group {1|2}
hash {md5|sha}
lifetime <seconds>
Configurations for XAuth Clients using Smart Cards
This section describes how to configure a remote access VPN on the controller for Cisco VPN XAuth clients using
smart cards. (A smart card contains a digital certificate which allows user-level authentication without the user
entering a username and password.) IKE Phase 1 authentication can be done with either an IKE preshared key or
digital certificates; in this example, digital certificates must be used for IKE authentication. The client is
authenticated with the internal database on the controller.
On the controller, you need to configure the following:
z User role for authenticated clients
z Entries for Cisco VPN XAuth clients in the controller’s internal database
z VPN authentication default profile which defines the internal authentication server group and the default role
assigned to authenticated clients
z Disable XAuth to disable prompting for the username and password (user credentials are extracted from the
smart card)
z Server certificate to authenticate the controller to clients
z CA certificate to authenticate VPN clients
You must install server and CA certificates in the controller, as described in Chapter 26, “Management
Access” on page503.
z IKE policy for RSA (certificate-based) authentication of the SA
Configure a VPN for Cisco XAuth Smart Card Clients
Configure the VPN via the WebUI
The following procedure describes the steps to configure VPN for Cisco Smart Card Clients via the WebUI:
1. Navigate to the Configuration > Security > Access Control > Policies page.
2. Click Add to add a new policy.
a. Enter the name of the policy (for example, authenticated). Default settings for a policy rule permit all
traffic from any source to any destination, but you can make a rule more restrictive. You can also configure
multiple rules; the first rule in a policy that matches the traffic is applied.
b. Click Add to add a rule.
c. When you are done adding rules, click Apply.
d. Click the User Roles tab. Click Add to add a new user role.
e. Enter the name of the role (for example, employee).
f. Under Firewall Policies, click Add. In the Choose from Configured Policies drop-down list, select the
policy you previously created. Click Done.
g. Click Apply.
Note: For each client, you need to create an entry in the internal database with the entire Principal name (SubjectAltname in X.509
certificates) or Common Name as it appears on the certificate.