Administrator Guide

430 | Virtual Private Networks Dell Networking W-Series ArubaOS 6.4.x| User Guide
authentication using RSA or ECDSA certificates, Suite-B cryptographic algorithms, and pre-shared keys. These
two remote clients are tested to work with Dell controllers using Suite-B cryptographic algorithm.
Working with Site-to-Site VPNs with Dynamic IP Addresses
ArubaOS supports site-to-site VPNs with two statically addressed controllers, or with one static and one
dynamically addressed controller. Two methods are supported to enable dynamically addressed peers:
l Pre-shared Key Authentication with IKE Aggressive Mode: The Dell controller with a dynamic IP
address must be configured as the initiator of IKE Aggressive-mode for Site-Site VPNs, while the controller
with a static IP address must be configured as the responder of IKE Aggressive mode. Note that when the
controller is operating in FIPS mode, IKE aggressive mode must be disabled.
l X.509 certificates: IPsec peers will identify each other using the subject name of X.509 certificates. IKE
operates in main mode when this option is selected. This method is preferred from a security standpoint.
Understanding VPN Topologies
You must configure VPN settings on the controllers at both the local and remote sites. In the following figure, a
VPN tunnel connects Network A to Network B across the Internet.
Figure 57 Site-to-Site VPN Configuration Components
To configure the VPN tunnel on controller A, you must configure the following:
l The source network (Network A)
l The destination network (Network B)
l The VLAN on which controller A’s interface to the Layer-3 network is located (Interface A in Figure 57)
l The peer gateway, which is the IP address of controller B’s interface to the Layer-3 network (Interface B in
Figure 57)
Configure VPN settings on the controllers at both the local and remote sites.
Configuring Site-to-Site VPNs
Use the following procedures to create a site-to-site VPN via the WebUI or CLI.
In the WebUI
1. Navigate to the Configuration > Advanced Services > VPN Services > Site-to-Site page.
2. In the IPsec Maps section, click Add to open the Add IPsec Map window.
3. Enter a name for this VPN connection in the Name field.
4. Enter a priority level for the IPsec map. Negotiation requests for security associations try to match the
highest-priority map first. If that map does not match, the negotiation request continues down the list to
the next-highest priority map until a match is made.