Devices running Windows 2008 server can use Suite-B cryptographic algorithms and IKEv1 to support
authentication using RSA or ECDSA. Strongswan 4.3 devices can use I KEv2 to support authentication using RSA
or ECDSA certificates, Suite-B cryptographic algorithms, and pre-shared keys.
Working with Site-to-S iteV PNs with Dynamic IP Addresses
ArubaOSsupports sit e-to-site VPNs with two statically addressed Dell controllers,or with one st atic and one
dynamicallyaddressed controller. By default, site-to-site VPN uses I KE Main-mode with Pre-Shared-Keys to
authenticate the IKE SA. This method uses the IP address of the peer, andt hereforedoes not work for dynamically
addressedpeers.
To support site-site VPN w ith dynamically addresseddevices, you must enableIKE Aggressive-Modew ith
Authentication based on a Pre-Shared-Key.The Dell controller with a dynamic IP address must be configuredto be
the

initiator

of IKE Aggressive-mode for Site-Site VPN, w hilet he controllerwith a static IP address must be
configuredas the

responder

of IKE Aggressive-mode.
Understanding VPN Topologies
You must configureVP N settings on the Dell controllersat both the local and remote sites. In the following figure, a
VPN tunnel connects Network A to Network B across the I nternet.
Figure 78: Site-to-SiteVPN ConfigurationComponents
To configuret heV PN tunnelon controller A, you need to configure the following:
lThe source network(Net workA )
lThe destination network (Network B)
lThe VLAN on which the controllerA ’s interfaceto the Layer-3 networki s located (InterfaceA in the Figure7 8)
lThe peergateway, which is the IP address of controllerB’s interface to the Layer-3 network (Interface B in the
Figure7 8)
NOTE:Configure V PN settingson the Dell controll ersat both the local and remote sites.
Configuring S ite-to-Site VPNs
Use the followingprocedures to create a site-to-si te VPN via the WebUI or command-line interfaces.
In the WebUI
1. Navigate to the Configuration > Advanced Services > VPN Services > Site-to-Site page.
2. In the IPsec Maps section, click Add to open the Add IPsec Map window.
3. Enter a name for this VPN connection in the Name field.
4. Enter a prio rity level for the IPsec map. Negotiation requests for security asso ciations try to match the highest-
priority map first. If that map does not match, the negotiation request continues down the list to the next-
highest priority map until a match is made.
DellPowerConnect W- Series ArubaOS 6.2 | UserGuide VirtualPrivate Networks |28 9