Users Guide

364 | Virtual Private Networks Dell PowerConnect ArubaOS 5.0 | [User Guide
5. Enter the IP address and netmask for the destination (the remote network to which the local network will
communicate) in the Destination Network and Destination Subnet Mask fields, respectively. (See controller
B in Figure 65.)
6. In the Peer Gateway field, enter the IP address of the interface on the remote controller that connects to the
Layer-3 network. (See Interface B in Figure 65.) If you are configuring an IPsec map for a dynamically
addressed remote peer, you must leave the peer gateway set to its default value of 0.0.0.0.
7. The Security Association Lifetime parameter defines the lifetime of the security association, in seconds. The
default value is 7200 seconds. To change this value, uncheck the default checkbox and enter a value from 300
to 86400 seconds.
8. Select the VLAN that contains the interface of the local controller which connects to the Layer-3 network.
(See Interface A in Figure 65.)
This determines the source IP address used to initiate IKE. If you select 0 or None, the default is the VLAN of
the controller’s IP address (either the VLAN where the loopback IP is configured or VLAN 1 if no loopback IP
is configured).
9. If you enable Perfect Forward Secrecy (PFS) mode, new session keys are not derived from previously used
session keys. Therefore, if a key is compromised, that compromised key will not affect any previous session
keys. PFS mode is disabled by default. To enable this feature, click the PFS drop-down list and select one of
the following Perfect Forward Secrecy modes:
z group1:Use the 768-bit Diffie Hellman prime modulus group.
z group2: Use the 1024-bit Diffie Hellman prime modulus group.
10. Select Pre-Connect to have the VPN connection established even if there is no traffic being sent from the
local network. If this is not selected, the VPN connection is only established when traffic is sent from the local
network to the remote network.
11. Select Trusted Tunnel if traffic between the networks is trusted. If this is not selected, traffic between the
networks is untrusted.
12. Select the Enforce NATT checkbox to always enforce UDP 4500 for IKE and IPSEC. This option is disabled
by default.
13. For VPNs with dynamically addressed peers, click the Dynamically Addressed Peers checkbox.
a. Select Initiator if the dynamically addressed switch is the initiator of IKE Aggressive-mode for Site-Site
VPN, or select Responder if the dynamically addressed switch is the responder for IKE Aggressive-mode.
b. In the FQDN field, enter a fully qualified domain name (FQDN) for the controller. If the controller is
defined as a dynamically addressed responder, you can select all peers to make the controller a responder
for all VPN peers, or select Per Peer ID and specify the FQDN to make the controller a responder for one a
specific initiator only.
14. Select an authentication type. For pre-shared key authentication, select Pre-Shared Key, then enter a shared
secret in the IKE Shared Secret and Verify IKE Shared Secret fields. This authentication type is required in
IPsec maps for a VPN with a dynamically addressed peer.
-or-
For certificate authentication, select Certificate, then click the Server Certificate and CA certificate drop-
down lists to select certificates previously imported into the controller. See Chapter 26, “Management
Access” on page503 for more information.
15. Click Done to apply the site-to-site VPN configuration.
16. Click Apply.
17. Click the IPsec tab to configure an IKE policy that uses RSA authentication.
a. Under IKE Policies, click Add to open the IPSEC Add Policy configuration page.
b. Set the Priority to 1 for this configuration to take priority over the Default setting.
c. Set the Encryption type from the drop-down menu.