Dell W-7030 AOS 6.4.x User Guide - Page 418

4. In the Start IP address field, enter the dotted-decimal IP address that defines the beginning of the range of source NAT addresses in the pool. 5. In the End IP address field, enter the dotted-decimal IP address that defines the end of the range of source NAT addresses in the pool. 6. In the Destination NAT IP Address field, enter the destination NAT IP address in dotted-decimal format. If you do not enter an address into this field, the NAT pool will use the destination NAT IP 0.0.0.0. 7. Click Done. 8. Navigate to Configuration > Advanced Services > VPN Services and click the IPSEC tab to return to the IPsec window. 9. Click the NAT Pool drop-down list and select the NAT pool you just created. Selecting Certificates If you are configuring a VPN to support machine authentication using certificates, define the IKE Server certificates for VPN clients using IKE. Note that these certificates must be imported into the controller, as described in Management Access on page 860. 1. Select the server certificate for client machines using IKE by clicking the IKE Server Certificate drop-down list and selecting an available certificate name. 2. If you are configuring a VPN to support clients using certificates, you must also assign one or more trusted CA certificates to VPN clients. a. Under CA Certificate Assigned for VPN-clients, click Add. b. Select a CA certificate from the drop-down list of CA certificates imported in the controller. c. Click Done. d. Repeat the above steps to add additional CA certificates. Defining IKEv1 Shared Keys If you are configuring a VPN to support IKEv1 and clients using pre-shared keys, you can configure a global IKE key or IKE key for each subnet. Make sure that this key matches the key on the client. 1. In the IKE Shared Secrets section of the IPsec tab, click Add to open the Add IKE Secret page. 2. Enter the subnet and subnet mask. To make the IKE key global, specify 0.0.0.0 for both values. 3. Enter the IKE Shared Secret and Verify IKE Shared Secret. 4. Click Done. Configuring IKE Policies ArubaOS contains several predefined default IKE policies, as described in Table 81. If you do not want to use any of these predefined policies, you can use the procedures below to edit an existing policy or create your own custom IKE policy instead. The IKE policy selections, along with any preshared key, must be reflected in the VPN client configuration. When using a third-party VPN client, set the VPN configuration on clients to match the choices made above. In case the Dell dialer is used, these configurations must be made on the dialer prior to downloading the dialer onto the local client. 1. Scroll down to the IKE Policies section of the IPSEC tab, then click Edit to edit an existing policy or click Add to create a new policy. 2. Enter a number into the Priority field to set the priority for this policy. Enter a priority of 1 for the configuration to take priority over the Default setting. 3. Select the IKE version. Click the Version drop-down list and select V1 for IKEv1 or V2 for IKEv2. 418 | Virtual Private Networks Dell Networking W-Series ArubaOS 6.4.x | User Guide