Dell W-Series 304 Instant 6.5.1.0-4.3.1.0 CLI Reference Guide - Page 316

Parameter set transform-set src-net trusted version v1|v2 vlan Description Name of the transform set for this IPsec map. One transform set name is required, but you can specify up to four transform sets. Configure transform sets with the crypto ipsec transform-set command. IP address and netmask for the source network. Enables or disables a trusted tunnel. Select the IKE version for the IPsec map. l v1: IKEv1 l v2: IKEv2 VLAN ID. Enter 0 for the loopback. Range - - enable/ disable 1-4094 Default defaulttransfor m - disabled v1 - Usage Guidelines You can use controllers instead of VPN concentrators to connect sites at different physical locations. You can configure separate CA and server certificates for each site-to-site VPN. You can also configure the same CA and server certificates for site-to-site VPN and client VPN. Use the show crypto-local ipsec-map command to display the certificates associated with all configured site-to-site VPN maps; use the tag option to display certificates associated with a specific site-to-site VPN map. ArubaOS supports site-to-site VPNs with two statically addressed controllers, or with one static and one dynamically addressed controller. By default, site-to-site VPN uses IKE Main-mode with Pre-Shared-Keys to authenticate the IKE SA. This method uses the IP address of the peer, and therefore will not work for dynamically addressed peers. To support site-site VPN with dynamically addressed devices, you must enable IKE Aggressive-Mode with Authentication based on a Pre-Shared-Key. A controller with a dynamic IP address must be configured to be the initiator of IKE Aggressive-mode for Site-Site VPN, while the controller with a static IP address must be configured as the responder of IKE Aggressive-mode. IKEv2 site-to-site VPNs between master and local W-7000 Series controllers support traffic compression between those devices. When this hardware-based compression feature is enabled, the quality of unencrypted traffic (such as Skype4b or Voice traffic) is not compromised by increased latency or decreased throughput. In a branch controllerenvironment, where an IPsec map defines the connections between the local branch controllers and a master controller, the global ACL master-boc-traffic is applied to all IPsec maps between the master and the branch controllers. If any branch controller requires a different ACL, issue the command routing-policy-map branch access-list on that branch controller to associate a different ACL to the L3 GRE tunnel between that one branch controller and its master. This local setting will override the global settings defined in the master-boc-traffic ACL. Understanding Default IKE policies ArubaOS includes the following default IKE policies. These policies are predefined and cannot be edited. 316| crypto-local ipsec-map Dell Networking W-Series ArubaOS 6.5.x | Reference Guide