Users Guide

relies on the PPP connection process to perform user authentication and protocol configuration.
With PPTP, data encryption begins after PPP authentication and connection process is completed. PPTP
connections are encrypted through Microsoft Point-to-Point Encryption (MPPE), which uses the Rivest-Shamir-
Aldeman (RSA) RC-4 encryption algorithm. PPTP connections require user-level authentication through a PPP-
based authentication protocol (MSCHAPv2 is the currently-supported method).
In the WebUI
1. Navigate to the Configuration > Advanced Services > VPN Services > PPTP page.
2. To enable PPTP, select Enable PPTP.
3. Select either MSCHAP or MSCHAPv2 as the authentication protocol.
4. Configure IP addresses of the primary and secondary DNS servers.
5. Configure the primary and secondary WINS Server IP addresses that are pushed to the VPN Dialer.
6. Configure the VPN Address Pool.
a. Click Add. The Add Address Pool window displays.
b. Specify the pool name, start address, and end address.
c. Click Done.
7. Click Apply to apply the changes before navigating to other pages.
In the CLI
(host)(config) #vpdn group pptp
enable
client configuration {dns|wins} <ipaddr1> [<ipaddr2>]
ppp authentication {mschapv2}
(host)(config) #pptp ip local pool <pool> <start-ipaddr> <end-ipaddr>
Working with Site-to-Site VPNs
Site-to-site VPNs allow sites in different locations to securely communicate with each other over a Layer-3
network such as the Internet. You can use Dell controllers instead of VPN concentrators to connect the sites.
You can also use a VPN concentrator at one site and a controller at the other site.
The Dell controller supports the following IKE SA authentication methods for site-to-site VPNs:
l Preshared key: Note that the same IKE shared secret must be configured on both the local and remote
sites.
l Suite-B cryptographic algorithms
l Digital certificates: You can configure an RSA or ECDSA server certificate and a CA certificate for each site-
to-site VPN IPsec map configuration. If you use certificate-based authentication, the peer must be identified
by its certificate subject name, distinguished name (for deployments using IKEv2), or by the peer’s IP
address (for IKEv1). For more information about importing server and CA certificates into the controller, see
Management Access on page 860.
Certificate-based authentication is only supported for site-to-site VPN between two controllers with static IP
addresses. IKEv1 site-to-site tunnels cannot be created between master and local controllers.
Working with Third-Party Devices
Dell controllers can use IKEv1 or IKEv2 to establish a site-to-site VPN with another Dell controller or third-party
remote client devices. Devices running Microsoft® Windows 2008 can use Suite-B cryptographic algorithms
and IKEv1 to support authentication using RSA or ECDSA. StrongSwan® 4.3 devices can use IKEv2 to support
Dell Networking W-Series ArubaOS 6.4.x | User Guide Virtual Private Networks |
429