Administrator Guide

Dell Networking W-Series ArubaOS 6.4.x| User Guide Virtual Private Networks | 411
Chapter 16
Virtual Private Networks
Wireless networks can use virtual private network (VPN) connections to further secure wireless data from
attackers. The Dell controller can be used as a VPN concentrator that terminates all VPN connections from
both wired and wireless clients.
This chapter describes the following topics:
l Planning a VPN Configuration on page 411
l Working with VPN Authentication Profiles on page 414
l Configuring a Basic VPN for L2TP/IPsec in the WebUI on page 416
l Configuring a VPN for L2TP/IPsec with IKEv2 in the WebUI on page 421
l Configuring a VPN for Smart Card Clients on page 425
l Configuring a VPN for Clients with User Passwords on page 426
l Configuring Remote Access VPNs for XAuth on page 427
l Working with Remote Access VPNs for PPTP on page 428
l Working with Site-to-Site VPNs on page 429
l Working with VPN Dialer on page 435
Planning a VPN Configuration
You can configure the controller for the following types of VPNs:
l Remote access VPNs: These VPNs allow hosts such as telecommuters or traveling employees to connect
to private networks (e.g. a corporate network) over the Internet. Each host must run VPN client software,
which encapsulates and encrypts traffic, then sends it to a VPN gateway at the destination network. The
controller supports the following remote access VPN protocols:
n Layer-2 Tunneling Protocol over IPsec (L2TP/IPsec)
n Point-to-Point Tunneling Protocol (PPTP)
n XAUTH IKE/IPsec
n IKEv2 with Certificates
n IKEv2 with EAP
l Site-to-site VPNs: Site-to-site VPNs allow networks, like branch office networks, to connect to other
networks like a corporate network. Unlike a remote access VPN, hosts in a site-to-site VPN do not run VPN
client software. All traffic for the other network is sent and received through a VPN gateway, which
encapsulates and encrypts the traffic.
Before enabling VPN authentication, you must configure the following:
l The default user role for authenticated VPN clients. See Roles and Policies on page 438 for information
about configuring user roles.
l The authentication server group used by the controller to validate clients. See Authentication Servers on
page 249 for configuration details.
A server-derived role, if present, takes precedence over the default user role.