Administrator Guide

945 | Adding Local Controllers Dell Networking W-Series ArubaOS 6.4.x| User Guide
Configuring a PSK
Leaving the PSK set to the default value exposes the IPsec channel to serious risk, therefore you should always
configure a unique PSK for each controller pair.
Sharing the same PSK between more than two controllers increases the likelihood of compromise. If one
controller is compromised, all controllers are compromised. Therefore, best security practices include
configuring a unique PSK for each controller pair
Do not use the default global PSK on a master or stand-alone controller. If you have a multi-controller network then
configure the local controllers to match the new IPsec PSK key on the master controller.
Weak keys are susceptible to offline dictionary attacks, meaning that a hostile eavesdropper can capture a few
packets during connection setup and derive the PSK, thus compromising the connection. Therefore the PSK
selection process should be the same process as selecting a strong passphrase:
l the PSK should be at least ten characters in length
l the PSK should not be a dictionary word
l the PSK should combine characters from at least three of the following four groups:
n lowercase characters
n uppercase characters
n numbers
n punctuation or special characters, such as !~‘@#$%^&*()_-+=\|//.[]{}
The following sections describe how to configure a PSK using the WebUI or CLI.
Configuring a Master Controller PSK
Use the procedure below to configures the IP address and preshared key for the master controller.
In the WebUI
To configure a master controller PSK:
1. Navigate to the Configuration > Network > Controller > System Settings page.
2. In the IPSEC Key (IKE PSK) field, enter the IPSec key. Reenter this key in the Retype IPSEC Key (IKE PSK)
field.
3. (Optional) In the FQDN field, enter a fully qualified domain name used in IKE.
4. (Optional) Click the Source IP address field and select the VLAN ID of Vlan interface to initiate IKE. The
controller IP address will be used if the VLAN is not specified.
5. Click Apply.
In the CLI
On the master controller you can configure a specific IPsec PSK for a local controller and use the localip
0.0.0.0 ipsec <secret_key> command:
You need to change the secret key to a non-default PSK value even if you use a per-local controller PSK configuration.
To configure a master controller PSK:
(host)(config) #localip 0.0.0.0 ipsec <secret_key>
(host)(config) #localip <ipaddr> ipsec <secret_key>