updated ikev2/rw-eap-tnc-radius scenario

2010-10-05 07:56:57 +02:00
parent 0cfdbaff2c
commit e7104a6ec9
9 changed files with 38 additions and 8 deletions
@@ -15,6 +15,19 @@ session {
 }

 post-auth {
+	if (control:TNC-Status == "Access") {
+		update reply {
+			Tunnel-Type := ESP 
+			Filter-Id := "rw-access"
+		}
+	}
+	elsif (control:TNC-Status == "Isolate") {
+		update reply {
+			Tunnel-Type := ESP 
+			Filter-Id := "rw-isolate"	
+		}
+	}
+
 	Post-Auth-Type REJECT {
 		attr_filter.access_reject
 	}
@@ -1,3 +1,3 @@
 # /etc/ipsec.secrets - strongSwan IPsec secrets file

-[email protected] : EAP "UgaM65Va"
+[email protected] : EAP "W7R0g3do"
@@ -1,6 +1,6 @@
 # /etc/strongswan.conf - strongSwan configuration file

 charon {
-  load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random x509 revocation hmac xcbc stroke kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc updown
+  load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random x509 revocation hmac xcbc stroke kernel-netlink socket-default eap-identity eap-md5 eap-ttls eap-tnc tnccs-11 updown
  multiple_authentication=no
 }
@@ -0,0 +1,3 @@
+#IMC configuration file for strongSwan client 
+
+IMC "Dummy" /usr/local/lib/libdummyimc.so
@@ -11,9 +11,18 @@ conn %default
 	keyingtries=1
 	keyexchange=ikev2

+conn rw-allow
+	leftsubnet=10.1.0.0/28
+	also=rw-eap
+	auto=add
+
+conn rw-isolate
+	leftsubnet=10.1.0.16/28
+	also=rw-eap
+	auto=add
+
 conn rw-eap
 	left=PH_IP_MOON
-	leftsubnet=10.1.0.0/16
 	leftcert=moonCert.pem
 	[email protected]
 	leftauth=pubkey
@@ -22,4 +31,3 @@ conn rw-eap
 	rightid=*@strongswan.org
 	rightsendcert=never
 	right=%any
-	auto=add
@@ -7,6 +7,7 @@ charon {
    eap-radius {
      secret = gv6URkSs 
      server = PH_IP_ALICE
+      filter_id = yes
    }
  }
 }