Users Guide

5. In the Source Network and Source Subnet Mask fields, enter the IP address and netmask for the
source (the local network connected to the controller). (See controller A in Figure 57)
6. In the Destination Network and Destination Subnet Mask fields, enter the IP address and netmask for
the destination (the remote network to which the local network communicates). (See controller B in Figure
57)
7. If you use IKEv1 to establish a site-to-site VPN for a statically addressed remote peer, enter the IP address of
the interface used by the remote peer to connect to the L3 network in the Peer Gateway field (See
Interface B in Figure 57). If you are configuring an IPsec map for a dynamically addressed remote peer, you
must leave the peer gateway set to its default value of 0.0.0.0.
8. If you use IKEv2 to establish a site-to-site VPN for a statically addressed remote peer, identify the peer
device by entering its certificate subject name in the Peer Certificate Subject Name field.
To identify the subject name of a peer certificate, issue the following command in the CLI:
show crypto-local pki servercert <certname> subject
9. The Security Association Lifetime parameter defines the lifetime of the security association in seconds
and kilobytes. For seconds, the default value is 7200. To change this value, uncheck the default checkbox
and enter a value between 300 and 86400 seconds. Range: 1000–1000000000 kilobytes.
10.Click the Version drop-down list and select V1 to configure the VPN for IKEv1, or V2 for IKEv2.
11.Select the VLAN containing the interface of the local controller that connects to the Layer-3 network. (See
Interface A in Figure 57)
This determines the source IP address used to initiate IKE. If you select 0 or None, the default is the VLAN
of the controller’s IP address (either the VLAN where the loopback IP is configured, or VLAN 1 if no loopback
IP is configured).
12.If you enable Perfect Forward Secrecy (PFS) mode, new session keys are not derived from previously
used session keys. Therefore, if a key is compromised, that compromised key does not affect any previous
session keys. PFS mode is disabled by default. To enable this feature, click the PFS drop-down list and select
one of the following Perfect Forward Secrecy modes:
l group1: 768-bit Diffie–Hellman prime modulus group.
l group2: 1024-bit Diffie–Hellman prime modulus group.
l group 14: 2048-bit Diffie–Hellman prime modulus group.
l group19: 256-bit random Diffie–Hellman ECP modulus group.
l group20: 384-bit random Diffie–Hellman ECP modulus group.
13.Select Pre-Connect to establish the VPN connection, even if there is no traffic being sent from the local
network. If you do not select this, the VPN connection is established only when traffic is sent from the local
network to the remote network.
14.Select Trusted Tunnel if traffic between the networks is trusted. If you do not select this, traffic between
the networks is untrusted.
15.Select the Enforce NATT checkbox to enforce UDP 4500 for IKE and IPSEC. This option is disabled by
default.
16.Add one or more transform sets to be used by the IPsec map. Click the Transform Set drop-down list,
select an existing transform set, then click the arrow button by the drop-down list to add that transform set
to the IPsec map.
17.For site-to-site VPNs with dynamically addressed peers, click the Dynamically Addressed Peers checkbox.
a. Select Initiator if the dynamically addressed switch is the initiator of IKE Aggressive-mode for Site-Site
VPNs, or select Responder if the dynamically addressed switch is the responder for IKE Aggressive-
mode.
Dell Networking W-Series ArubaOS 6.4.x | User Guide Virtual Private Networks |
431