Users Guide

345| Virtual Private Networks Dell Networking W-Series ArubaOS 6.5.x| User Guide
Enabling Support for VIA-Published Subnets
In the WebUI
To enable this feature in the controller, perform the following steps in the WebUI:
1. Navigate to Configuration > Advanced Services > VPN Services > IPSEC.
2. Select the Allow VIA to push subnets check box under L2TP and XAUTH Parameters.
3. Click Apply.
In the CLI
To enable this feature in the controller, execute the following command:
(host) (config) #crypto-local isakmp allow-via-subnet-routes
To disable the feature in the controller, execute the following command:
(host) (config)#no crypto-local isakmp allow-via-subnet-routes
Verifying Support for VIA-Published Subnets
To verify if the controller is configured to accept subnet routes from VIA clients, execute the following
command:
(host) #show crypto-local isakmp allow-via-subnet-routes
Controller will accept subnet routes from via client
Limitations
The following limitations are applicable to the CFG_SET support feature for controllers:
l This feature supports only IPv4
l This feature is only applicable with IKEv2
For details about how to configure and run VIA on Linux platform, refer to the VIA 2.3.1 Linux Edition Release
Notes.
Understanding Supported VPN AAA Deployments
If you want to simultaneously deploy various combinations of a VPN client, RAP-psk, RAP-certs, and CAP on the
same controller, see Table 76.
Each row in this table specifies the allowed combinations of AAA servers for simultaneous deployment.
Configuration rules include the following:
l RAP-certs can only use LocalDB-AP.
l An RAP-psk and RAP-cert can only terminate on the same controller if the RAP VPN profile’s AAA server uses
Local-db.
l If an RAP-psk is using an external AAA server, the RAP-cert cannot be terminated on the same controller.
l Clients can use any type of AAA server, regardless of the RAP/CAP authentication configuration server.