Aruba Central Online Help

Configuring VPNCs for Micro Branch Solution

For a successful Instant AP VPNVirtual Private Network. VPN enables secure access to a corporate network when located remotely. It enables a computer to send and receive data across shared or public networks as if it were directly connected to the private network, while benefiting from the functionality, security, and management policies of the private network. This is done by establishing a virtual point-to-point connection through the use of dedicated connections, encryption, or a combination of the two. termination on the SD-WANSoftware-Defined Wide Area Network. SD-WAN is an application for applying SDN technology to WAN connections that connect enterprise networks across disparate geographical locations. Gateway, perform the following configuration tasks on the SD-WANWide Area Network. WAN is a telecommunications network or computer network that extends over a large geographical distance. Gateway:

Configuring Instant AP VPN Pool for Aruba Gateways

The VPN local pool is used to assign an IP Address to the Instant AP after successful Extended Authentication (XAuthExtended Authentication. XAuth provides a mechanism for requesting individual authentication information from the user, and a local user database or an external authentication server. It provides a method for storing the authentication information centrally in the local network.) VPN.

To configure the Instant AP VPN Pool, complete the following steps:

  1. In the Network Operations app, set the filter to a group that contains at least one Branch Gateway.

    The dashboard context for a group is displayed.

  2. Under Manage, click Devices > Gateways.

    A list of gateways is displayed in the List view.

  3. Click the Config icon.

    The gateway group configuration page is displayed.

  4. If you are in the Basic Mode, click Advanced Mode to access the advanced configuration options.
  5. Click VPN > General VPN.
  6. Click + from the Address Pools table to open the Add New Address Pool section.
  7. Enter the following information in the Add New Address Pool section to create a new address pool:
    • Pool name—Name of the pool
    • Start address(ipv4)—The starting IPv4 address of the pool.
    • End address(ipv4)—The ending IPv4 address of the pool
  8. Configure the following additional VPN parameters based on your requirements:
  9. Save the changes.

Authentication Servers

Instant APs identify themselves using the internal TPMTrusted Platform Module. TPM is an international standard for a secure cryptoprocessor, which is a dedicated microcontroller designed to secure hardware by integrating cryptographic keys into devices. certificate, which has the MACMedia Access Control. A MAC address is a unique identifier assigned to network interfaces for communications on a network. address as the CNCommon Name. CN is the primary name used to identify a certificate. . The Micro Branch solution can use the internal server or an external RADIUSRemote Authentication Dial-In User Service. An Industry-standard network access protocol for remote authentication. It allows authentication, authorization, and accounting of remote users who want to access network resources.  server with the database of all the Instant APs, so that the VPNCs accept the incoming connection from the Instant APs.

If you are using the internal server, see Configuring an Internal Server.

If you are using an external RADIUS server, see Configuring and Mapping External RADIUS Server.

Configuring an Internal Server

When you use the internal server for authenticating the Instant AP, the VPNC validates if the Instant AP is in the same user account with valid subscription assigned and automatically allowlists it.

To enable internal server authentication, complete the following steps:

  1. In the Network Operations app, set the filter to a group that contains at least one Branch Gateway.

    The dashboard context for a group is displayed.

  2. Under Manage, click Devices > Gateways.

    A list of gateways is displayed in the List view.

  3. Click the Config icon.

    The gateway group configuration page is displayed.

  4. If you are in the Basic Mode, click Advanced Mode to access the advanced configuration options.
  5. Click Security > L3 Authentication.
  6. Select the default-iap profile under VPN Authentication.
  7. In the default-iap profile, select internal from Server Group.
  8. Save the changes.

Configuring and Mapping External RADIUS Server

To use an external RADIUS server for authentication, you must configure the server on the VPNC. To configure an external RADIUS server for authentication, see Configuring RADIUS Authentication Server on Aruba Gateways

Aruba recommends to use the ClearPass Policy Manager as it can download the list of Instant APs owned by the customer from the Activate server to automate the allowlisting process. For information on configuring the ClearPass Policy Manager, see ClearPass Policy Manager User Guide.

Map the configured RADIUS server to the Instant AP VPN server group using the following steps:

  1. In the Network Operations app, use the filter to select a Group in which VPNCs are provisioned.
  2. Under Manage, click DevicesGateways and then click the Config icon to display the Gateway configuration dashboard.
  3. If you are in the Basic Mode, click Advanced Mode to access the advanced configuration options.
  4. Click Security > L3 Authentication.
  5. Select the default-iap profile under VPN Authentication.
  6. In the default-iap profile, select the configured RADIUS server from RADIUS Accounting Server Group.
  7. Save the changes.

Redistributing Branch Subnets

The Micro Branch solution provides support to learn branch subnets using the dynamic routing protocol. To redistribute the branch networks in L3 mode, complete the following steps:

  1. In the Network Operations app, use the filter to select a Group in which VPNCs are provisioned.
  2. Under Manage, click DevicesGateways and then click the Config icon to display the Gateway configuration dashboard.
  3. If you are in the Basic Mode, click Advanced Mode to access the advanced configuration options.
  4. Click Routing > OSPF.
  5. Enable OSPFOpen Shortest Path First. OSPF is a link-state routing protocol for IP networks. It uses a link-state routing algorithm and falls into the group of interior routing protocols that operates within a single Autonomous System (AS). for routing and configure the area to be used. For more information on configuring OSPF area and other parameters, see Routes Advertisement Using OSPF.
  6. Enable Redistribute overlay routes, and then specify a cost for the overlay routes. The cost set here applies only to the routes that are learnt from the Aruba Gateways.
  7. Save the changes.
  8. Click InterfacesVLANs and select the uplink VLAN interface from the VLAN IDs table.
  9. From the IPv4 tab, select Enable OSPF under Other Options and configure the OSPF area to be used.
  10. Save the changes.