Ajout d’un REALM \u00ab\u00a0le-realm\u00a0\u00bb sur un r\u00e9seau \u00ab\u00a0ttt.ttt.ttt.nnn 255.255.255.ZZZ\u00a0\u00bb, vlan XXX<\/p>\n
creation du vlan sur le commutateur CISCO sur le serveur VPN modification de la base de donn\u00e9es realmacl sur le serveur RADIUS (exemple avec le realm ufc-pub sur 194.57.81.0\/24 coup\u00e9 en trois parties) : \tippool ufc_pub_pool { \tippool ufc_pub_pool1 { authorize { accounting { post-auth { cr\u00e9er et attribuer \u00e0 radiusd.radiusd les fichier $ dans le fichier Ne pas oublier le fichier client 194.57.91.251 { client 194.57.89.65 { comme nous avons un identificateur de realm il faut aussi (m\u00eame si ce realm est g\u00e9r\u00e9 en local sur ce radius) configurer le fichier Ajout d’un REALM \u00ab\u00a0le-realm\u00a0\u00bb sur un r\u00e9seau \u00ab\u00a0ttt.ttt.ttt.nnn 255.255.255.ZZZ\u00a0\u00bb, vlan XXX creation du vlan sur le commutateur CISCO conf t vlan XXX name blabla exit int vlanXXX desc blabla ip vrf forwarding FW_YYYYY ip address ttt.ttt.ttt.ttt 255.255.255.ZZZ no shutdown exit interface GigabitEthernet3\/29 switchport trunk allowed vlan add XXX interface GigabitEthernet3\/38 switchport trunk allowed vlan add […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[85,68,14,31],"class_list":["post-62","post","type-post","status-publish","format-standard","hentry","category-informations-techniques","tag-installation","tag-realm","tag-serveur","tag-vpn"],"_links":{"self":[{"href":"https:\/\/vpn.univ-fcomte.fr\/index.php?rest_route=\/wp\/v2\/posts\/62","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vpn.univ-fcomte.fr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vpn.univ-fcomte.fr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vpn.univ-fcomte.fr\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/vpn.univ-fcomte.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=62"}],"version-history":[{"count":0,"href":"https:\/\/vpn.univ-fcomte.fr\/index.php?rest_route=\/wp\/v2\/posts\/62\/revisions"}],"wp:attachment":[{"href":"https:\/\/vpn.univ-fcomte.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=62"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vpn.univ-fcomte.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=62"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vpn.univ-fcomte.fr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=62"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nconf t
\nvlan XXX
\n name blabla
\n exit
\nint vlanXXX
\n desc blabla
\n ip vrf forwarding FW_YYYYY
\n ip address ttt.ttt.ttt.ttt 255.255.255.ZZZ
\n no shutdown
\n exit
\ninterface GigabitEthernet3\/29
\n switchport trunk allowed vlan add XXX
\ninterface GigabitEthernet3\/38
\n switchport trunk allowed vlan add XXX<\/small><\/code><\/p>\n
\nemacs \/etc\/network\/interfaces<\/small><\/code>
\nauto eth0.XXX
\niface eth0.XXX inet static
\n\taddress ttt.ttt.ttt.ttu
\n\tnetmask 255.255.255.ZZZ
\n\tnetwork ttt.ttt.ttt.0
\n\tbroadcast ttt.ttt.ttt.ttv
\n\tup ip route add default via ttt.ttt.ttt.ttt dev eth0.XXX table le.realm
\n\tup ip rule add fwmark MMM table le-realm
\n\tdown ip rule del fwmark MMM
\n\tdown ip route del table le.realm<\/small><\/code><\/p>\nemacs \/etc\/iproute2\/rt_tables
\n10 femto.ext
\n11 lifc.lab
\n12 lifc.edu
\n13 ufc.generic
\nMMM le.realm<\/small><\/code><\/p>\n
\nadd realm<\/small><\/code>
\nadd network
\n=> choix du nas
\n=> tranche ip
\n=> marque iptable<\/small><\/code><\/p>\n
\n\/etc\/raddb\/radiusd.conf
\n\trealm ufc-pub {
\n format = suffix
\n delimiter = \"@\"
\n ignore_default = no
\n ignore_null = no
\n }<\/p>\n
\n\t\tname = ufc_pub_pool
\n\t\trange-start = 194.57.81.1
\n\t\trange-stop = 194.57.81.10
\n\t\tnetmask = 255.255.255.0
\n\t\tcache-size = 800
\n\t\tsession-db = ${raddbdir}\/db-ufc_pub_pool.ippool
\n\t\tip-index = ${raddbdir}\/db-ufc_pub_pool.ipindex
\n\t\toverride = no
\n\t\tmaximum-timeout = 0
\n\t}<\/p>\n
\n\t\tname = ufc_pub_pool1
\n\t\trange-start = 194.57.81.11
\n\t\trange-stop = 194.57.81.251
\n\t\tnetmask = 255.255.255.0
\n\t\tcache-size = 800
\n\t\tsession-db = ${raddbdir}\/db-ufc_pub_pool1.ippool
\n\t\tip-index = ${raddbdir}\/db-ufc_pub_pool1.ipindex
\n\t\toverride = no
\n\t\tmaximum-timeout = 0
\n\t}
\n ...
\n}<\/p>\n
\n ufc-pub
\n}<\/p>\n
\n ufc_pub_pool
\n ufc_pub_pool1
\n}<\/p>\n
\n\tufc_pub_pool
\n\tufc_pub_pool1
\n}
\n<\/small><\/code><\/p>\n{raddbdir}\/db-ufc_pub_pool.ippool<\/small><\/code> et ${raddbdir}\/db-ufc_pub_pool.ipindex<\/small><\/code>.<\/p>\n\/etc\/raddb\/users<\/small><\/code> on attribue les m\u00e9thodes d’authentification, d’autorisation et les pool pour le DHCP :
\nDEFAULT Realm == \"ufc-pub\", NAS-IP-Address == 194.57.91.251, Pool-Name := \"ufc_pub_pool\", Auth-Type = \"LDAP_UFC\", Autz-Type = \"LDAP_UFC\"
\n Fall-Through = No
\nDEFAULT Realm == \"ufc-pub\", NAS-IP-Address == 194.57.91.250, Pool-Name := \"ufc_pub_pool1\", Auth-Type = \"LDAP_UFC\", Autz-Type = \"LDAP_UFC\"
\n Fall-Through = No
\nDEFAULT Realm == \"ufc-pub\", NAS-IP-Address == 194.57.89.65, Pool-Name := \"ufc_pub_pool2\", Auth-Type = \"LDAP_UFC\", Autz-Type = \"LDAP_UFC\"
\n Fall-Through = No<\/small><\/code><\/p>\n\/etc\/raddb\/clients.conf<\/small><\/code> :
\nclient 194.57.91.250 {
\n secret = blabla
\n shortname = test-vpn
\n nastype = other
\n}<\/p>\n
\n secret = blabla
\n shortname = vpn1
\n nastype = other
\n}<\/p>\n
\n secret = blabla
\n shortname = vpn2
\n nastype = other
\n}<\/small><\/code><\/p>\n\/etc\/raddb\/proxy.conf<\/small><\/code> :
\nrealm ufc-pub {
\n type = radius
\n authhost = LOCAL
\n accthost = LOCAL
\n# strip
\n}<\/small><\/code><\/p>\n","protected":false},"excerpt":{"rendered":"