Administrator Guide

723 | Remote Access Points Dell Networking W-Series ArubaOS 6.4.x| User Guide
Configure the NAT Device
Communication between the AP and the secure controller uses the UDP 4500 port. When both the controller
and the AP are behind NAT devices, configure the AP to use the NAT device’s public address as its master
address. On the NAT device, you must enable NAT-T (UDP port 4500 only) and forward all packets to the public
address of the NAT device on UDP port 4500 to the controller to ensure that the remote AP boots successfully.
Configure the VPN Server
This section describes how to configure the IPSec VPN server on the controller. For more details, see Virtual
Private Networks on page 411. The remote AP will be a VPN client that connects to the VPN server on the
controller.
In the WebUI
1. Navigate to the Configuration > Advanced Services > VPN Services > IPSec page.
2. Select Enable L2TP.
3. Make sure that PAP (Password Authentication Protocol) is selected for Authentication Protocols.
4. To configure the L2TP IP pool, click Add in the Address Pools section. Configure the L2TP pool from which
the APs will be assigned addresses, then click Done.
The size of the pool should correspond to the maximum number of APs that the controller is licensed to manage.
5. To configure an Internet Security Association and Key Management Protocol (ISAKMP) encrypted subnet
and preshared key, click Add in the IKE Shared Secrets section and configure the preshared key. Click
Done to return to the IPSec page.
6. Click Apply.
In the CLI
(host) (config) # vpdn group l2tp
ppp authentication PAP
(host) (config) #ip local pool <pool> <start-ipaddr> <end-ipaddr>
(host) (config) #crypto isakmp key <key> address <ipaddr> netmask <mask>
CHAP Authentication Support over PPPoE
RAPs can now establish a PPPoE session with a PPPoE server at the ISP side and get authenticated using the
Challenge Handshake Authentication Protocol (CHAP). The PPPoE client running on a RAP is capable of
handling the CHAP authentication requests from the PPPoE server.
The PPPoE client selects either the PAP or the CHAP credentials for the RAP authentication depending upon the
request from the PPPoE server.
You can use the WebUI or the CLI to configure CHAP.
In the WebUI
1. Navigate to the Configuration > Wireless > AP Installation page. The list of discovered APs are displayed
on this page.
2. Select the AP you want to configure using CHAP and click Provision button.
3. Enter the CHAP Secret in the text box under Authentication Method.