Unfortunately the word wrapping makes it difficult to read. If this is the exact file, the # comment signs are missing from the
# Gateway #=====
lines. Go to the directory where ipassignment.conf is located and run
vpn ipafile_check ipassignment.conf warn
or
vpn ipafile_check ipassignment.conf detail
and it will give you a check of whether your syntax is correct. Make sure the file is on the enforcement module in $FWDIR/conf/ and not on the management server, although you can perform the syntax check on the management server.
Ray
From: "RISPAL Yannick - NTR ( [EMAIL PROTECTED] )" <[EMAIL PROTECTED]> Reply-To: Mailing list for discussion of Firewall-1 <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Subject: [FW-1] Office mode, ipassignment.conf and radius authentication. Date: Thu, 22 Apr 2004 11:47:41 +0200
Dear all,
I've put in place a firewall module with VPN-1 and Policy server NGAI (R54). My SmartConsole is also with version R54. There is also a radius server with steel-belted radius v4.0. My secureclient is a R54 release.
I use some users created in the smartconsole database with radius authentication. I've also created a "generic*" user with radius authentication. I use office mode with ip pool. Everything is OK, each user have acces to the internal lan with an address from this ip pool.
Now I want to implement some additionnals features :
* "ip per user" or "ip per group" :
How can I do that ? I've tried an ip address allocation per user with the ipassignment.conf file, it didn't work. I don't know if it's a syntax problem or something else. Here is my ipassignment.conf file :
Gateway Type IP Address User Name
============= ===== ================================== =========================================
my_gw range 10.0.0.1-10.0.0.10 grp_1 # console database group with my.fw.user1
my_gw, range 10.0.0.11-10.0.0.20/27 grp_2 # console database group with my.fw.user2
my_gw range 10.0.0.11-10.0.0.20/27 radius_grp_1 # radius group with radius user1
my_gw, range 10.0.0.21-10.0.0.30/27 radius_grp_2 # radius group with radius user2
my_gw addr 10.0.0.11, <file:///\\MY.DOMAIN\MY.USER1> \\MY.DOMAIN\MY.USER1 # radius user1
my_gw, addr 10.0.0.21, <file:///\\MY.DOMAIN\MY.USER2> \\MY.DOMAIN\MY.USER2 # radius user2
my_gw addr 10.0.0.2, my.fw.user1 # console database user1
my_gw, addr 10.0.0.12, my.fw.user2 # console database user2
Each line has a different syntax. I've tried all those examples without any success. If you know why ?
* "ip per group" with radius group :
I have seen in the following document that it's possible to configure a fp4 gw to assign ip addresses based on radius groups :
<http://support.checkpoint.com/kb/docs/public/firewall1/ng/pdf/om_ip_ass ignment.pdf> http://support.checkpoint.com/kb/docs/public/firewall1/ng/pdf/om_ip_assi gnment.pdf
I'm going to test this configuration but I don't know how to configure my rule base to provide a different level of acces according to these radius groups, something like this :
SRC DST VPN SERVICE ACTION
------------------------------ ------------------------------ ------------------------------ ------------------------------ ------------------------------
[EMAIL PROTECTED] vpn_domain remote_access service_vpn_grp_radius 1 accept
[EMAIL PROTECTED] vpn_domain remote_access service_vpn_grp_radius_2 accept
More exactly, I don't know how this rule base can interact with my definition of the users which used the "generic*" user.
If you know this please give me the trick...
Regards,
Yannick Rispal
Network Engineer
Atos Origin
64 rue du 8 mai 1945
92025 Nanterre Cedex
France
Mail : mailto:[EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]>
================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
_________________________________________________________________ Watch LIVE baseball games on your computer with MLB.TV, included with MSN Premium! http://join.msn.com/?page=features/mlb&pgmarket=en-us/go/onm00200439ave/direct/01/
================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
