denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

changed filter attribute from access to allow

Browse Source
This commit is contained in:
Andreas Steffen
2010-10-09 01:01:19 +02:00
parent a1afa8d810
commit db24b600fb
4 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/ikev2/rw-eap-tnc-radius/description.txt
+1 -1
View File
@@ -7,4 +7,4 @@ The strong EAP-TTLS tunnel protects the ensuing weak client authentication based
In a next step the EAP-TNC protocol is used within the EAP-TTLS tunnel to determine the In a next step the EAP-TNC protocol is used within the EAP-TTLS tunnel to determine the
health of <b>carol</b> and <b>dave</b> via the <b>IF-TNCCS 1.1</b> client-server interface. health of <b>carol</b> and <b>dave</b> via the <b>IF-TNCCS 1.1</b> client-server interface.
<b>carol</b> passes the health test and <b>dave</b> fails. Based on these measurements the <b>carol</b> passes the health test and <b>dave</b> fails. Based on these measurements the
clients are connected by gateway <b>moon</b> to the "rw-access" and "rw-isolate" subnets, respectively. clients are connected by gateway <b>moon</b> to the "rw-allow" and "rw-isolate" subnets, respectively.
testing/tests/ikev2/rw-eap-tnc-radius/evaltest.dat
+2 -2
View File
@@ -6,11 +6,11 @@ dave::cat /var/log/daemon.log::authentication of 'moon.strongswan.org' with RSA
dave::cat /var/log/daemon.log::TNCCS-Recommendation.*isolate::YES dave::cat /var/log/daemon.log::TNCCS-Recommendation.*isolate::YES
dave::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES dave::cat /var/log/daemon.log::EAP method EAP_TTLS succeeded, MSK established ::YES
dave::cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/32 === 10.1.0.16/28::YES dave::cat /var/log/daemon.log::CHILD_SA home{1} established.*TS 192.168.0.200/32 === 10.1.0.16/28::YES
moon::cat /var/log/daemon.log::received RADIUS attribute Filter-Id: 'access'::YES moon::cat /var/log/daemon.log::received RADIUS attribute Filter-Id: 'allow'::YES
moon::cat /var/log/daemon.log::authentication of '[email protected]' with EAP successful::YES moon::cat /var/log/daemon.log::authentication of '[email protected]' with EAP successful::YES
moon::cat /var/log/daemon.log::received RADIUS attribute Filter-Id: 'isolate'::YES moon::cat /var/log/daemon.log::received RADIUS attribute Filter-Id: 'isolate'::YES
moon::cat /var/log/daemon.log::authentication of '[email protected]' with EAP successful::YES moon::cat /var/log/daemon.log::authentication of '[email protected]' with EAP successful::YES
moon::ipsec statusall::rw-access.*10.1.0.0/28 === 192.168.0.100/32::YES moon::ipsec statusall::rw-allow.*10.1.0.0/28 === 192.168.0.100/32::YES
moon::ipsec statusall::rw-isolate.*10.1.0.16/28 === 192.168.0.200/32::YES moon::ipsec statusall::rw-isolate.*10.1.0.16/28 === 192.168.0.200/32::YES
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_seq=1::YES
carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_seq=1::NO carol::ping -c 1 PH_IP_VENUS::64 bytes from PH_IP_ALICE: icmp_seq=1::NO
testing/tests/ikev2/rw-eap-tnc-radius/hosts/alice/etc/raddb/sites-available/inner-tunnel-second
+1 -1
View File
@@ -18,7 +18,7 @@ post-auth {
if (control:TNC-Status == "Access") { if (control:TNC-Status == "Access") {
update reply { update reply {
Tunnel-Type := ESP Tunnel-Type := ESP
Filter-Id := "access" Filter-Id := "allow"
} }
} }
elsif (control:TNC-Status == "Isolate") { elsif (control:TNC-Status == "Isolate") {
testing/tests/ikev2/rw-eap-tnc-radius/hosts/moon/etc/ipsec.conf
+2 -2
View File
@@ -11,8 +11,8 @@ conn %default
keyingtries=1 keyingtries=1
keyexchange=ikev2 keyexchange=ikev2
conn rw-access conn rw-allow
rightgroups=access rightgroups=allow
leftsubnet=10.1.0.0/28 leftsubnet=10.1.0.0/28
also=rw-eap also=rw-eap
auto=add auto=add