Dell 6.2 Setting the IPsec Dynam ic Map, Finalizing WebUI changes

282| Virtual Private Net works DellPowerConnect W- Series ArubaOS 6.2 | User Guide
lPRF-HMAC-SHA384
9. Set t heSecurity Association Lifetime to define the lifetime of the security associatio n,in seco nds.The default
valuei s 7200 seconds. To change this value,uncheck the default checkbox and entera value from 300 to 8 6400
seconds.
10. Click Done to act ivate the changes,and return to the previous window
Setting the IPsec Dynam ic Map
Dynamic maps enableIP sec SA negotiations from dynamicallyaddressed IPsec peers. ArubaOShas a predefined
IPsec dynamic maps for IKEv2. If you do not want to use of these predefined maps, you can use the procedures
below to edit an existing map or create your own custom IPsec dynamic map instead.
1. Scroll down to the IPs ec Dynamic Map section of the IPSEC tab, then click Edit by a map name to edit an
existing map or click Add to create a new map.
2. I n the Name field,enter a name for the dynamic map
3. I n the Priority field, enter a priority number for the map. Negotiation requests for security associati ons try to
match the highest-priority map first.I f that map does not match, the negotiation request continues down the
list to the next-highest priority map until a match i s made.
4. Click t he Version drop-downlist and select v2 to create a map for remote peers using IKEv2.
5. (Optio nal)Configure Perfect Forward Secrecy (PFS) settings for the dynamic peer by assigning a Diffie-Hellman
prime modulusgroup. PFS provides an additio nallevel of security by ensuringt hat the IPsec SA key was not
derivedfrom any o therkey, and therefore can not be co mpromisedi f another key is broken. Click the Set PFS
drop-downlist and select one of the following groups:
lGroup1 : 768-bit Diffie Hellman prime modulusgroup.
lGroup2 : 1024-bit Diffie Hellman prime modulus group.
lGroup1 9: 256-bit random Diffie Hellman ECP modulus group.
lGroup2 0: 384-bit random Diffie Hellman ECP modulus group.
6. Select the transform set for the map to define a specific encryption and authentication type used by the dynamic
peer.Click the Tr ansform Set drop-down list, and select the transformset for the dynamic peer.
NOTE:To view currentconfiguration settings for an IPsec transform-set,access the command-line i nterfaceand issue the command
cryptoipsec transform-set tag <transform-set-name>.
7. Set t heSecurity Association Lifetime to define the lifetime of the security associatio nfor the dynamic peer, in
seconds. The defaultvalue is 720 0 seconds. To change this value, uncheckthe default checkbox and enter a value
from3 00 to 86400 seconds.
8. Click D one to returnto t heprevious window.
Finalizing WebUI changes
Whenyou have finished co nfiguringyour IPsec VPN settings, click Apply to apply the new settings before
navigating to other pages.
In the CLI
Use the followingprocedures to use the command-line interface to configure a remote access VPN for L2TP IPsec
using IKEv2.
1. D efine the server addresses:
(host)(config) #vpdn group l2tp
enable
client configuration {dns|wins} <ipaddr1> [<ipaddr2>]