Users Guide

721 | Remote Access Points Dell Networking W-Series ArubaOS 6.4.x| User Guide
Figure 91 Remote AP with a Private Network
l Deployment Scenario 2: The remote AP is on the public network or behind a NAT device and the controller is
on the public network. The remote AP must be configured with the tunnel termination point, which must be
a publicly-routable IP address. In this scenario, a routable interface is configured on the controller in the
DMZ. The remote AP uses the controller’s IP address on the public network to establish the IPSec VPN
tunnel.
Figure 92 Remote AP with Controller on Public Network
l Deployment Scenario 3: The remote AP is on the public network or behind a NAT device and the controller is
also behind a NAT device. (This deployment is recommended for remote access.) The remote AP must be
configured with the tunnel termination point, which must be a publicly-routable IP address. In this scenario,
the remote AP uses the public IP address of the corporate firewall. The firewall forwards traffic to an
existing interface on the controller. (The firewall must be configured to pass NAT-T traffic (UDP port 4500)
to the controller.)
Figure 93 Remote AP with Controller Behind Firewall
In any of the described deployment scenarios, the IPSec VPN tunnel can be terminated on a local controller,
with a master controller located elsewhere in the corporate network (
Figure 94). The remote AP must be able to
communicate with the master controller after the IPSec tunnel is established. Make sure that the L2TP IP pool
configured on the local controller (from which the remote AP obtains its address) is reachable in the controller
network by the master controller.