Packetfence - alkalmas erre? Ha nem, akkor mi?

Itt akadok el:

Port-security and SNMP

Relies on the port-security SNMP Traps. A fake static MAC address is assigned to all the ports this way any MAC address will generate a security violation and a trap will be sent to PacketFence. The system will authorize the MAC and set the port in the right VLAN. VoIP support is possible but tricky. It varies a lot depending on the switch vendor. Cisco is well supported but isolation of a PC behind an IP Phone leads to an interesting dilemma: either you shut the port (and the phone at the same time) or you change the data VLAN but the PC doesn’t do DHCP (didn’t detect link was down) so it cannot reach the captive portal.

Aside from the VoIP isolation dilemma, it is the technique that has proven to be reliable and that has the most switch vendor support.

Ez megvan (snmp trap beallitva a Packetfence serverre, az Aruba switchen) illetve be van allitva az adott porta a fake MAC is. a gond, hogy rohadtul nem kuld a servernek semmit, ha rakotok egy eszkozt... es sajnos nem jovok ra, miert.

Switch config:

A RADIUS meg nincs beallitva, de ha jol ertem, az ehhez a funkciohoz meg nem kell.

Running configuration:

; JL357A Configuration Editor; Created on release #YC.16.02.0012
; Ver #0e:01.b0.ef.74.47.fc.68.f3.8c.fc.e3.ff.37.2f:70

hostname "Aruba-2540-48G-PoEP-4SFPP"
module 1 type jl357a
port-security 10 learn-mode static
port-security 10 mac-address 020000-000010
port-security 10 action send-alarm
ip default-gateway 10.51.0.100
snmp-server community "public"
snmp-server community "private" unrestricted
snmp-server host 10.51.39.3 community "public" trap-level not-info
no snmp-server enable traps link-change 1-52
vlan 1
   name "DEFAULT_VLAN"
   untagged 1-52
   ip address 10.51.1.18 255.255.252.0
   exit

Egy lepessel kozelebb :)

Packetfence oldalon definialni kell az uplink portot a switchen, mert ha dinamikusra teszem, azt nem ismeri...

Most mar eljutok oda, hogy felismeri a klienset, fel is veszi a node-ok koze, viszont mikor atirna a fake MAC-et, akkor dob egy ilyet a logba

Aug 28 16:48:30 hun400-33v pfqueue: pfqueue(9004) ERROR: [mac:80:ee:73:d9:8e:15] SNMP error tyring to perform auth of 80:ee:73:d9:8e:15 Error message: Received badValue(3) error-status at error-index 2 (pf::Switch::HP::Procurve_2500::authorizeMAC)

Viszont nemi eredmeny!!

Linkupdown-al mukodik! eleg "basic" megoldas, de ha a switch nem tud tobbet, akkor ez van... majd jovo heten kiprobalom elesben.

Elso radugas:

Aug 30 13:49:14 hun400-33v pfqueue: pfqueue(7192) INFO: [mac:] up trap received on 10.51.1.18 ifIndex 10 (pf::task::pfsnmp::handleUpTrap)
Aug 30 13:49:14 hun400-33v pfqueue: pfqueue(7192) INFO: [mac:] setting 10.51.1.18 port 10 to Registration VLAN (pf::task::pfsnmp::handleUpTrap)
Aug 30 13:49:14 hun400-33v pfqueue: pfqueue(7192) WARN: [mac:] couldn't get MAC at ifIndex 10. This is a problem. (pf::Switch::_getMacAtIfIndex)
Aug 30 13:49:14 hun400-33v pfqueue: pfqueue(7192) INFO: [mac:] Should set 10.51.1.18 ifIndex 10 to VLAN 199 but it is already in this VLAN -> Do nothing (pf::Switch::setVlan)
Aug 30 13:49:14 hun400-33v pfqueue: pfqueue(7192) WARN: [mac:] couldn't get MAC at ifIndex 10. This is a problem. (pf::Switch::_getMacAtIfIndex)
Aug 30 13:49:17 hun400-33v pfqueue: pfqueue(7192) INFO: [mac:] node 80:ee:73:d9:8e:15 does not yet exist in PF database. Adding it now (pf::task::pfsnmp::node_update_PF)
Aug 30 13:49:17 hun400-33v pfqueue: pfqueue(7192) INFO: [mac:] Instantiate profile default (pf::Connection::ProfileFactory::_from_profile)
Aug 30 13:49:17 hun400-33v pfqueue: pfqueue(7192) INFO: [mac:] Instantiate profile default (pf::Connection::ProfileFactory::_from_profile)
Aug 30 13:49:17 hun400-33v pfqueue: pfqueue(7192) INFO: [mac:] is of status unreg; belongs into registration VLAN (pf::role::getRegistrationRole)
Aug 30 13:49:17 hun400-33v pfqueue: pfqueue(7192) INFO: [mac:] Should set 10.51.1.18 ifIndex 10 to VLAN 199 but it is already in this VLAN -> Do nothing (pf::Switch::setVlan)
Aug 30 13:49:27 hun400-33v pfqueue: pfqueue(10257) WARN: [mac:80:ee:73:d9:8e:15] Unable to pull accounting history for device 80:ee:73:d9:8e:15. The history set doesn't exist yet. (pf::accounting_events_history::latest_mac_history)

Node athelyezese a megfelelo rule-ba:

Aug 30 13:54:41 hun400-33v pfqueue: pfqueue(7192) INFO: [mac:] Instantiate profile default (pf::Connection::ProfileFactory::_from_profile)
Aug 30 13:54:41 hun400-33v pfqueue: pfqueue(7192) INFO: [mac:] Username was NOT defined or unable to match a role - returning node based role 'default' (pf::role::getRegisteredRole)
Aug 30 13:54:41 hun400-33v pfqueue: pfqueue(7192) INFO: [mac:] PID: "default", Status: reg Returned VLAN: (undefined), Role: default (pf::role::fetchRoleForNode)
Aug 30 13:54:41 hun400-33v pfqueue: pfqueue(7192) INFO: [mac:] setting VLAN at 10.51.1.18 ifIndex 10 from 199 to 1 (pf::Switch::setVlan)

Szerk:

Ip helper belove switchen, igy mar alakul a dolog!

https://i.imgur.com/d9EUIHb.png

Koszonom a segitseget!

Vegere szuperul osszeallt.

Lett egy "registering" vlan, amibe minden beesik alapol (csak a packetfence servert erik el innen a node-ok semmi mast) ha ide bekerul egy gep, akkor vagy kezzel adom hozza a megfelelo rulehoz packetfence alatt (PLC-k, nyomtatok, stb...), vagy ha PC, akkor be tud az AD userevel loggolni (Rule alapjan  (AD folder-re mutatva) a megfelelo vlan-ba is teszi egybol a login utan, pl "net" "no_net" "production" stb...)

Barmelyik switch barmelyik portjara dugom, "viszi magaval" a configot. A nem hasznalt portok kihuzas utan a registering vlan ba allnak vissza.