Controller Based WLANs

Introduction  :  

Virtual Intranet Access (VIA) is part of the Aruba remote networks solution targeted for teleworkers and mobile users. VIA detects the users network environment (trusted and un-trusted) and automatically connects the user to their enterprise network. Trusted networks typically refers to a protected office network that allows users to directly access corporate intranet. Un-trusted networks are public Wi-Fi hotspots like airports, cafes, or home network.

The VIA solution comes in two parts—VIA connection manager and the controller configuration.

Prerequisites

Prior to moving forward with the controller configuration, the following prerequisites must first be accomplished:
 

• Elliptic Curve Certificates will need to be generated using Windows Server 2008 R2. This version of Windows Server supports the creation of a PKI that will allow for a Certificate Authority to be implemented that supports Suite-B algorithms. The CA root, server, and user certificates will need to be generated prior to configuring the controller. Once created, the CA root and server EC certificates will be uploaded to the controller and used as part of the authentication process.

• Verify that the controller to be configured supports Suite-B algorithms. While all Aruba 600 series controllers support Suite-B, not all 3000 or M3 series controllers do. Check the serial number on your controller and verify it against Table 3 on page 4 to determine if your controller supports Suite B.

• If necessary, the controller will need to be upgraded to ArubaOS version 6.1.2.3 (or later). This version of ArubaOS is required to support Suite B.

• The Advanced Cryptography License (ACR) will need to be installed onto the controller to support Suite- B algorithms

• The Policy Enforcement Firewall for VIA (PEFV) license will need to be installed onto the controller to provide for policy enforcement when using the VIA client for secure communication with the controller.

• If the controller will be installed behind a firewall device, the following ports must be allowed for traffic going to the IP address of the controller:
       -  TCP 443 – During the initializing phase, VIA uses HTTPS connections to perform trusted network & captive portal checks  
                              against the controller. It is mandatory that you enable port 443 on your network to allow VIA to perform these    
                              checks.
       -  UDP 4500 – Required for IPSec transport

Configuration Steps

Many of the configuration steps are similar to normal VIA configuration steps except VIA Authentication Profile and VIA Connection Profile will be configured to provide Suite-B capabilities. Authentication will be certificate based using IKEv2. In order to provide for policy enforcement with VIA, the Aruba PEFV license is required to be installed onto the controller.

Step 1 :  Configure Suite-B Client Address Pool & Select the IKE Server & CA Root Certs

Select the IKE server cert (must be capable of ECDSA)
(hostname)(config)# crypto-local isakmp server-certificate “cert name”

Add and select the CA cert assigned for VPN-clients (must be capable of EDCSA)
(hostname)(config)# crypto-local isakmp ca-certificate <cacert-name>


Step 2 : Modify the default-ikev2-dynamicmap to add Suite B transforms

(hostname)(config)# crypto dynamic-map default-ikev2-dynamicmap 10000
(hostname)(config-dynamic-map)# set transform-set “default-gcm128” “default-gcm256”     “default-1st-ikev2-transform” “default 3rd-ikev2-transfrom”

The two transforms related to Suite B are (IKE Policies)

“default-gcm128” = Default Suite-B 10008:  this policy defines the use of AES-128-GCM for data encryption with a SHA-256 hash for data integrity and elliptic curve 256 bit digital signatures (ECDSA) used for authentication

“default-gcm256” = Default Suite-B 10009: this policy defines the use of AES-256-GCM for data encryption with a SHA-384 hash for data integrity and elliptic curve 384 bit digital signatures (ECDSA) used for authentication


Step 3 : Create user role to be mapped to the VIA authentication profile

Step 4 : Create VIA Authentication profile
 

• Select the user role created above as Default Role

• Ensure that “Check certificate common name against AAA server” is unchecked (if checked if using internal DB it must have an entry corresponding to the CN)

• Add the correct server group for VIA authentication (in the field this will most likely be internal)

Currently the most popular Radius servers do not support EAP-TLS over IKEV2 with EC certificates (currently all Suite B deployments use VIA and IKEV2 native certificate authentication on the controller, however another option is strongSwan but it’s not FIPS validated)

Step 5 : Create VIA Connection profile
 

• Populate VIA Servers section with necessary configurations

• Select the VIA authentication profile created in the “VIA Authentication Profiles” to provision section

• Populate VIA tunneled networks

Federal customers will likely tunnel all networks as Suite B encryption is normally used to connect to classified networks
Enable IKEv2

(hostname)(config)# aaa authentication via connection-profile “Suite-B-VIA”
(hostname)(VIA Connection Profile “Suite-B-VIA”)# ikev2-proto

• Select Default Suite-B 10008 (AES-GCM128) or Default Suite-B 10009 (AES-GCM256) for VIA IKE V2 Policy

•  Enable “Use Suite B Cryptography”

   (hostname)(config)# aaa authentication via connection-profile “Suite-B-VIA”

   (hostname)(VIA Connection Profile “Suite-B-VIA”)# suiteb-crypto
 

• Select “user-cert” for IKEv2 Authentication method (use eap-tls only if authenticating to an external server, which is currently not used in the filed)

    (hostname)(config)# aaa authentication via connection-profile “Suite-B-VIA”
  
    (hostname)(VIA Connection Profile “Suite-B-VIA”)# ikev2auth user-cert

• Select “default-ikev2-dynamicmap/10000” for VIA IPSec V2 Crypto Map

    (hostname)(VIA Connection Profile “Suite-B-VIA”)# ipsecv2-cryptomap “default-ikev2-    dynamic map” number 10000

• Select “Enable Supplicant”

    (hostname)(VIA Connection Profile “Suite-B-VIA”)# enable-supplicant

 

• Use default /32 for “VIA Client Network Mask”
   

• Enable “Validate Server Certificate”

Client Configuration

There are three main items that will be executed to establish Suite-B communications with the controller:

• Import elliptic curve certificates thru the use of the Microsoft Management Console (mmc.exe) program
• Install the VIA client
• Launch the VIA client, authenticate and load the VIA connection profile to support Suite-B connectivity

Troubleshooting