Administrator Guide

The IKE pre-shared key value must be between 6-64 characters. To configure a pre-shared IKE key that contains non-
alphanumeric characters, surround the key with quotation marks.
For example: crypto-local isakmp key "key with spaces" fqdn-any.
6. Define IKEv2 Policies:
(host)(config) #crypto isakmp policy <priority>
encryption {3des|aes128|aes192|aes256|des}
version v2
authentication {pre-share|rsa-sig|ecdsa-256ecdsa-384}
group {1|2|19|20}
hash {md5|sha|sha1-96|sha2-256-128|sha2-384-192}
prf PRF-HMAC-MD5|PRF-HMAC-SHA1|PRF-HMAC-SHA256|PRF-HMAC-SHA384
lifetime <seconds>
7. Define IPsec Tunnel parameters:
(host)(config) #crypto ipsec
mtu <max-mtu>
transform-set <transform-set-name> esp-3des|esp-aes128|esp-aes128-gcm|esp-aes192|esp-
aes256|esp-aes256-gcm|esp-des esp-md5-hmac|esp-null-mac|esp-sha-hmac
Configuring a VPN for Smart Card Clients
This section describes how to configure a remote access VPN on the controller for Microsoft L2TP/IPsec clients
with smart cards, which contain a digital certificate allowing user-level authentication without the user entering
a username and password. As described earlier in this chapter, L2TP/IPsec requires two levels of
authentication: IKE SA (machine) authentication and user-level authentication with an IKEv2 or PPP-based
authentication protocol.
Microsoft clients running Windows 7 (and later versions) support both IKEv1 and IKEv2. Microsoft clients using
IKEv2 support machine authentication using RSA certificates (but not ECDSA certificates or pre-shared keys)
and smart card user-level authentication with EAP-TLS over IKEv2.
Windows 7 (and later version) clients without smart cards also support user password authentication using EAP-
MSCHAPv2 or PEAP-MSCHAPv2.
Working with Smart Card clients using IKEv2
To configure a VPN for Windows 7 (and later version) clients using smart cards and IKEv2, follow the procedure
described in Configuring a VPN for L2TP/IPsec with IKEv2 in the WebUI on page 421, and ensure that the
following settings are configured:
l L2TP is enabled
l User Authentication is set to EAP-TLS
l IKE version is set to V2
l The IKE policy is configured for ECDSA or RSA certificate authentication
Working with Smart Card Clients using IKEv1
Microsoft clients using IKEv1, including clients running Windows Vista or earlier versions of Windows, only
support machine authentication using a pre-shared key. In this scenario, user-level authentication is performed
by an external RADIUS server using PPP EAP-TLS, and client and server certificates are mutually authenticated
during the EAP-TLS exchange. During the authentication, the controller encapsulates EAP-TLS messages from
the client into RADIUS messages and forwards them to the server.
Dell Networking W-Series ArubaOS 6.4.x | User Guide Virtual Private Networks | 425