User manual ALCATEL-LUCENT AOS 3.1

[. . . ] AOS-W User Guide AOS-W Version 3. 1 Copyright Copyright © 2007 Alcatel Internetworking, Inc. Originated in the USA. Trademarks AOS-W, Alcatel 4308, Alcatel 4324, Alcatel 6000, Alcatel 41, Alcatel 60/61/65, Alcatel 70, and Alcatel 80 are trademarks of Alcatel Internetworking, Inc. Any other trademarks appearing in this manual are the property of their respective companies. Legal Notice The use of Alcatel Internetworking Inc. switching platforms and software, by all individuals or corporations, to terminate Cisco or Nortel VPN client devices constitutes complete acceptance of liability by that individual or corporation for this action and indemnifies, in full, Alcatel Internetworking Inc. [. . . ] The authentication server group the WLAN Switch will use to validate the clients. See Chapter 8, "Configuring Authentication Servers" for configuration details. NOTE: A server-derived role, if present, takes precedence over the default user role. You then specify the default user role and authentication server group in the VPN authentication profile. Using the WebUI to configure VPN authentication: 1. Navigate to the Configuration > Security > Authentication > L3 Authentication page. (Optional) Set Max Authentication failures to an integer value (the default value is 0, which disables this feature). This number indicates the number of contiguous authentication failures before the station is blacklisted. From the drop-down menu, select the server group to be used for VPN authentication. 8. Using the CLI to configure VPN authentication: aaa authentication vpn default-role <role> max-authentication-failure <number> server-group <name> 262 AOS-W 3. 1 User Guide 032063-00 Rev A February 2007 Configuring Virtual Private Networks Chapter 11 Configuring VPN with L2TP IPSec The combination of Layer-2 Tunneling Protocol and Internet Protocol Security (L2TP/IPSec) is a highly-secure technology that enables VPN connections across public networks such as the Internet. L2TP/IPSec provides a logical transport mechanism to send PPP frames as well as tunneling or encapsulation so that the PPP frames can be sent across an IP network. L2TP/IPSec relies on the PPP connection process to perform user authentication and protocol configuration. L2TP/IPSec connections use the Data Encryption Standard (DES) algorithm or Triple DES (3DES). Computer-level authentication with a certificate or a preshared key to create the IPSec security associations (SAs) to protect the L2TP-encapsulated data. User-level authentication through a PPP-based authentication protocol after the SAs are successfully created. Complete the steps in "VPN Configuration" on page 262. Using the WebUI to configure VPN with L2TP IPSec: 1. Navigate to the Configuration > Advanced Services > VPN Services > IPSEC page. Authentication Method and Server Addresses 2. Currently supported methods are Password Authentication Protocol (PAP), Challenge Handshake Authentication Protocol (CHAP), Microsoft Challenge Handshake Authentication Protocol (MSCHAP) and MSCHAP version 2 (MSCHAPv2). Configure the IP addresses of the primary and secondary Domain Name System (DNS) servers and primary and secondary Windows Internet Naming Service (WINS) Server that will be pushed to the VPN client. 4. Address Pools This is the pool from which the clients are assigned addresses. Click Done to apply the configuration. AOS-W 3. 1 User Guide 263 Configuring Virtual Private Networks Chapter 11 Source NAT Use this option if the IP addresses of clients need to be translated to access the network. To use this option, you must have created a NAT pool by navigating to the Configuration > IP > NAT Pools page. IKE Shared Secrets You can configure a global IKE key or configure an IKE key for each subnet. To make the IKE key global, specify 0. 0. 0. 0 and 0. 0. 0. 0 for both values. Under IKE Policies, click Add to open the IPSEC Add Policy configuration page. Set the Priority to 1 for this configuration to take priority over the Default setting. The configurations from 1 through 5 along with the pre-share key need to be reflected in the VPN client configuration. [. . . ] The default welcome page will depend slightly on your configuration, but will look similar to this: You can customize this welcome page by building your own HTML page and uploading it to the WLAN Switch. You upload it to the WLAN Switch using the GUI under Maintenance > Captive Portal > Upload custom pages and choose "content as the page type. This file is stored in a directory called "/upload/" in the WLAN Switch in the file's original name. In order to actually use this file, you will need to configure the welcome page on the WLAN Switch. [. . . ]