Dear all,
I've put in place a firewall module with VPN-1 and Policy server NGAI (R54). My SmartConsole is also with version R54. There is also a radius server with steel-belted radius v4.0. My secureclient is a R54 release. I use some users created in the smartconsole database with radius authentication. I've also created a "generic*" user with radius authentication. I use office mode with ip pool. Everything is OK, each user have acces to the internal lan with an address from this ip pool. Now I want to implement some additionnals features : * "ip per user" or "ip per group" : How can I do that ? I've tried an ip address allocation per user with the ipassignment.conf file, it didn't work. I don't know if it's a syntax problem or something else. Here is my ipassignment.conf file : Gateway Type IP Address User Name ============= ===== ================================== ========================================= my_gw range 10.0.0.1-10.0.0.10 grp_1 # console database group with my.fw.user1 my_gw, range 10.0.0.11-10.0.0.20/27 grp_2 # console database group with my.fw.user2 my_gw range 10.0.0.11-10.0.0.20/27 radius_grp_1 # radius group with radius user1 my_gw, range 10.0.0.21-10.0.0.30/27 radius_grp_2 # radius group with radius user2 my_gw addr 10.0.0.11, <file:///\\MY.DOMAIN\MY.USER1> \\MY.DOMAIN\MY.USER1 # radius user1 my_gw, addr 10.0.0.21, <file:///\\MY.DOMAIN\MY.USER2> \\MY.DOMAIN\MY.USER2 # radius user2 my_gw addr 10.0.0.2, my.fw.user1 # console database user1 my_gw, addr 10.0.0.12, my.fw.user2 # console database user2 Each line has a different syntax. I've tried all those examples without any success. If you know why ? * "ip per group" with radius group : I have seen in the following document that it's possible to configure a fp4 gw to assign ip addresses based on radius groups : <http://support.checkpoint.com/kb/docs/public/firewall1/ng/pdf/om_ip_ass ignment.pdf> http://support.checkpoint.com/kb/docs/public/firewall1/ng/pdf/om_ip_assi gnment.pdf I'm going to test this configuration but I don't know how to configure my rule base to provide a different level of acces according to these radius groups, something like this : SRC DST VPN SERVICE ACTION ------------------------------ ------------------------------ ------------------------------ ------------------------------ ------------------------------ [EMAIL PROTECTED] vpn_domain remote_access service_vpn_grp_radius 1 accept [EMAIL PROTECTED] vpn_domain remote_access service_vpn_grp_radius_2 accept More exactly, I don't know how this rule base can interact with my definition of the users which used the "generic*" user. If you know this please give me the trick... Regards, Yannick Rispal Network Engineer Atos Origin 64 rue du 8 mai 1945 92025 Nanterre Cedex France Mail : mailto:[EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]> ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
