testing: Converted tnc scenarios to swanctl
This commit is contained in:
Andreas Steffen
+13
@@ -15,6 +15,19 @@ session {
|
||||
}
|
||||
|
||||
post-auth {
|
||||
if (control:TNC-Status == "Access") {
|
||||
update reply {
|
||||
Tunnel-Type := ESP
|
||||
Filter-Id := "allow"
|
||||
}
|
||||
}
|
||||
elsif (control:TNC-Status == "Isolate") {
|
||||
update reply {
|
||||
Tunnel-Type := ESP
|
||||
Filter-Id := "isolate"
|
||||
}
|
||||
}
|
||||
|
||||
Post-Auth-Type REJECT {
|
||||
attr_filter.access_reject
|
||||
}
|
||||
|
||||
@@ -1,12 +1,12 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
libimcv {
|
||||
debug_level = 3
|
||||
load = random nonce sha1 sha2 md5 gmp pubkey x509
|
||||
debug_level = 3
|
||||
assessment_result = no
|
||||
plugins {
|
||||
imv-scanner {
|
||||
closed_port_policy = no
|
||||
tcp_ports = 80 443
|
||||
}
|
||||
imv-test {
|
||||
rounds = 1
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,23 +0,0 @@
|
||||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
charondebug="tnc 3, imc 3"
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
|
||||
conn home
|
||||
left=PH_IP_CAROL
|
||||
[email protected]
|
||||
leftauth=eap
|
||||
leftfirewall=yes
|
||||
right=PH_IP_MOON
|
||||
[email protected]
|
||||
rightsubnet=10.1.0.0/16
|
||||
rightauth=pubkey
|
||||
aaa_identity="C=CH, O=Linux strongSwan, CN=aaa.strongswan.org"
|
||||
auto=add
|
||||
@@ -1,3 +0,0 @@
|
||||
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
||||
|
||||
[email protected] : EAP "Ar3etTnp"
|
||||
@@ -1,10 +1,23 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac stroke kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
|
||||
|
||||
multiple_authentication=no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
}
|
||||
daemon {
|
||||
tnc = 3
|
||||
imc = 3
|
||||
}
|
||||
}
|
||||
plugins {
|
||||
eap-tnc {
|
||||
protocol = tnccs-1.1
|
||||
|
||||
@@ -0,0 +1,35 @@
|
||||
connections {
|
||||
|
||||
home {
|
||||
local_addrs = 192.168.0.100
|
||||
remote_addrs = 192.168.0.1
|
||||
|
||||
local {
|
||||
auth = eap
|
||||
aaa_id = aaa.strongswan.org
|
||||
id = [email protected]
|
||||
}
|
||||
remote {
|
||||
auth = pubkey
|
||||
id = moon.strongswan.org
|
||||
}
|
||||
children {
|
||||
home {
|
||||
remote_ts = 10.1.0.0/16
|
||||
|
||||
updown = /usr/local/libexec/ipsec/_updown iptables
|
||||
esp_proposals = aes128gcm16-modp3072
|
||||
}
|
||||
}
|
||||
version = 2
|
||||
proposals = aes128-sha256-modp3072
|
||||
}
|
||||
}
|
||||
|
||||
secrets {
|
||||
|
||||
eap {
|
||||
id = [email protected]
|
||||
secret = "Ar3etTnp"
|
||||
}
|
||||
}
|
||||
@@ -1,23 +0,0 @@
|
||||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
charondebug="tnc 3, imc 3"
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
|
||||
conn home
|
||||
left=PH_IP_DAVE
|
||||
[email protected]
|
||||
leftauth=eap
|
||||
leftfirewall=yes
|
||||
right=PH_IP_MOON
|
||||
[email protected]
|
||||
rightsubnet=10.1.0.0/16
|
||||
rightauth=pubkey
|
||||
aaa_identity="C=CH, O=Linux strongSwan, CN=aaa.strongswan.org"
|
||||
auto=add
|
||||
@@ -1,3 +0,0 @@
|
||||
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
||||
|
||||
[email protected] : EAP "W7R0g3do"
|
||||
@@ -1,10 +1,23 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac stroke kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
|
||||
load = random nonce aes sha1 sha2 md5 gmp hmac pem pkcs1 x509 revocation curl vici kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnc-imc tnc-tnccs tnccs-11 updown
|
||||
|
||||
multiple_authentication=no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
syslog {
|
||||
auth {
|
||||
default = 0
|
||||
}
|
||||
daemon {
|
||||
tnc = 3
|
||||
imc = 3
|
||||
}
|
||||
}
|
||||
plugins {
|
||||
eap-tnc {
|
||||
protocol = tnccs-1.1
|
||||
@@ -14,6 +27,9 @@ charon {
|
||||
|
||||
libimcv {
|
||||
plugins {
|
||||
imc-test {
|
||||
command = none
|
||||
}
|
||||
imc-scanner {
|
||||
push_info = no
|
||||
}
|
||||
|
||||
@@ -0,0 +1,35 @@
|
||||
connections {
|
||||
|
||||
home {
|
||||
local_addrs = 192.168.0.200
|
||||
remote_addrs = 192.168.0.1
|
||||
|
||||
local {
|
||||
auth = eap
|
||||
aaa_id = aaa.strongswan.org
|
||||
id = [email protected]
|
||||
}
|
||||
remote {
|
||||
auth = pubkey
|
||||
id = moon.strongswan.org
|
||||
}
|
||||
children {
|
||||
home {
|
||||
remote_ts = 10.1.0.0/16
|
||||
|
||||
updown = /usr/local/libexec/ipsec/_updown iptables
|
||||
esp_proposals = aes128gcm16-modp3072
|
||||
}
|
||||
}
|
||||
version = 2
|
||||
proposals = aes128-sha256-modp3072
|
||||
}
|
||||
}
|
||||
|
||||
secrets {
|
||||
|
||||
eap {
|
||||
id = [email protected]
|
||||
secret = "W7R0g3do"
|
||||
}
|
||||
}
|
||||
@@ -1,23 +0,0 @@
|
||||
# /etc/ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
|
||||
conn %default
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
keyexchange=ikev2
|
||||
|
||||
conn rw-eap
|
||||
left=PH_IP_MOON
|
||||
leftsubnet=10.1.0.0/16
|
||||
leftcert=moonCert.pem
|
||||
[email protected]
|
||||
leftauth=pubkey
|
||||
leftfirewall=yes
|
||||
rightauth=eap-radius
|
||||
rightid=*@strongswan.org
|
||||
rightsendcert=never
|
||||
right=%any
|
||||
auto=add
|
||||
@@ -1,3 +0,0 @@
|
||||
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
||||
|
||||
: RSA moonKey.pem
|
||||
@@ -1,12 +1,19 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac stroke kernel-netlink socket-default eap-radius updown
|
||||
load = random nonce aes sha1 sha2 md5 pem pkcs1 gmp hmac x509 revocation curl vici kernel-netlink socket-default eap-radius updown
|
||||
|
||||
multiple_authentication=no
|
||||
|
||||
start-scripts {
|
||||
creds = /usr/local/sbin/swanctl --load-creds
|
||||
conns = /usr/local/sbin/swanctl --load-conns
|
||||
}
|
||||
plugins {
|
||||
eap-radius {
|
||||
secret = gv6URkSs
|
||||
server = PH_IP_ALICE
|
||||
server = 10.1.0.10
|
||||
filter_id = yes
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,27 @@
|
||||
connections {
|
||||
|
||||
rw {
|
||||
local_addrs = 192.168.0.1
|
||||
|
||||
local {
|
||||
auth = pubkey
|
||||
id = moon.strongswan.org
|
||||
certs = moonCert.pem
|
||||
}
|
||||
remote {
|
||||
auth = eap-radius
|
||||
id = *@strongswan.org
|
||||
}
|
||||
children {
|
||||
rw {
|
||||
local_ts = 10.1.0.0/16
|
||||
|
||||
updown = /usr/local/libexec/ipsec/_updown iptables
|
||||
esp_proposals = aes128gcm16-modp3072
|
||||
}
|
||||
}
|
||||
version = 2
|
||||
send_certreq = no
|
||||
proposals = aes128-sha256-modp3072
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user