Dell 6.2 Defining Address Pools, Enabling Source NAT, Selecting Certifi cates

280| Virtual Private N etworks DellPowerConnect W- Series ArubaOS 6.2 | User Guide
nPassword Authentication Protocol (P AP)
nExtensible Authentication Protocol (EAP )
nChallengeHandshake Authentication Protocol (CHAP )
nMicrosoft ChallengeHandshake Authentication Proto col (MSCHAP)
5. Co nfigurethe IP addresses of the primary and secondary Domain Name System (DNS) servers and primaryand
secondary Windows Internet Naming Service (WINS) Serverthat is pushed to the VPN client.
Defining Address Pools
Next, definethe pool from which the clients are assigned addresses.
1. I n the Address Pools section of the IPSEC tab, click Add to open the Add Address Pool page.
2. Specify t hepoo lname, the start address, and the end address.
3. Click D one to apply the configuration.
Enabling Source NAT
In the Source NAT section of the IPSEC tab, select Enable Source NAT if the IP addresses of clients need to be
translatedto access the network. If you enabled source NAT, click the NAT pool drop-down list and select an
existing NAT pool. If you have not yet created t heN AT pool you want to use:
1. N avigate to Configuration > IP > NAT Pools.
2. Click A dd.
3. I n the Pool Name field,enter a name for the new NAT poo l,up to 63 alphanumeric characters.
4. I n the Start IP address field, entert hedot ted-decimalIP address that defines the beginningof the range of
source NAT addresses in the pool.
5. I n the End IP address field, entert hedo tted-decimalI P address that defines the end of the rangeof so urceNA T
addressesi n the pool.
6. I n the Destination NAT IP Address field, enter the destination NAT IP address in dotted-decimal format. If you
do not enter an addressinto t his field,the NAT pool uses the destination NAT IP 0.0.0.0.
7. Click D one to close the NAT pools tab
8. Navigate to Configuration > Advanced Services > VPN Services and click the IPSEC tab to return to
the IPSEC window.
9. Click t he NAT Pool drop-downlist and select the NAT pool you just created.
Selecting Certifi cates
To configure the VPN to support machine authentication using certifi cates, define the IKE Server certificates for
VPN clients using IKEv2. Note that these certificate must be imported into t hec ontroller,as described in
ManagementAccess on page 625.
1. Select the IKEv2 server certificate for client machines usingIK Ev2 by clickingthe IKEv2 Server Certificate
drop-downlist and selecting an availablecerti ficate name.
2. I f you are configuringa V PN to support IKEv2 clients using certificates, you must also assign one or more
trusted CA certificates to VPN clients.
a. UnderCA Certificate Assigned for VPN-clients, click Add.
b. Select a CA certificate from the drop-downlist of CA certificates imported in the controller.
c. Click Done.
d. Repeat the above steps to add additio nalCA certificates.