Sorry for the presentation, I will try to make it more readable :
Gateway Type IP Address User Name
======== ===== =======================
======================================
my_gw range 10.0.0.1-10.0.0.10 grp_1 # console group with
my.fw.user1
my_gw, range 10.0.0.11-10.0.0.20/27 grp_2 # console group with
my.fw.user2
my_gw range 10.0.0.11-10.0.0.20/27 radius_grp_1 # radius group
with user1
my_gw, range 10.0.0.21-10.0.0.30/27 radius_grp_2 # radius group
with user2
my_gw addr 10.0.0.11, \\MY.DOMAIN\MY.USER1 # radius
user1
my_gw, addr 10.0.0.21, \\MY.DOMAIN\MY.USER2 # radius
user2
my_gw addr 10.0.0.2, my.fw.user1 # console database
user1
my_gw, addr 10.0.0.12, my.fw.user2 # console database
user2
So, you can see that there is no # before the
Gateway
========
It's like that in the original file ipassignment.conf. One more thing,
my firewall module is a R54 release and the commands
vpn ipafile_check ipassignment.conf warn
or
vpn ipafile_check ipassignment.conf detail
are not available on my firewall :
[EMAIL PROTECTED] vpn ipafile_check ipassignment.conf warn
Unknown command "ipafile_check"
Usage:
vpn debug < on|off|ikeon|ikeoff|trunc > # print debug msgs to VPN log
files
vpn crl_zap # erase all CRLs from
cache
vpn drv ... # attach vpn driver
to fw driver and more
vpn ver [-k] # display VPN version
vpn accel ... # operations on VPN
accelerator card and VPNx
vpn crlview ... # debugging tool for
CRLs
vpn diag < on | off > # print VPN diagnostics
msgs
vpn compstat # display
compression/decompression statistics
vpn compreset # reset
compression/decompression statistics
vpn macutil [user_name] # display generated MAC address
by username or
# DN from arg or
stdin (also: vpn mu)
vpn tunnelutil # launch TunnelUtil tool
to control
# VPN Tunnels
(also: vpn tu)
vpn export_p12 ... # tool to export p12 from
gw certificate
vpn nssm_topology ... # generate topology in NSSM
format for
# Nokia clients
vpn sw_topology ... # Download topology for
SofaWare GWs
vpn overlap_encdom ... # Display overlapping
encryption domains
[EMAIL PROTECTED]
First, I will try with the # before "Gateway" and "========". Second I
will upgrade to R55 or newer if available to see if this resolve the
problem.
Thanks,
Yannick.
------------------------------
Date: Thu, 22 Apr 2004 21:01:37 -0400
From: Ray Pesek <[EMAIL PROTECTED]>
Subject: Re: Office mode, ipassignment.conf and radius authentication.
Unfortunately the word wrapping makes it difficult to read. If this is
the
exact file, the # comment signs are missing from the
# Gateway
#=====
lines. Go to the directory where ipassignment.conf is located and run
vpn ipafile_check ipassignment.conf warn
or
vpn ipafile_check ipassignment.conf detail
and it will give you a check of whether your syntax is correct. Make
sure
the file is on the enforcement module in $FWDIR/conf/ and not on the
management server, although you can perform the syntax check on the
management server.
Ray
>From: "RISPAL Yannick - NTR ( [EMAIL PROTECTED] )"
><[EMAIL PROTECTED]>
>Reply-To: Mailing list for discussion of Firewall-1
><[EMAIL PROTECTED]>
>To: [EMAIL PROTECTED]
>Subject: [FW-1] Office mode, ipassignment.conf and radius
authentication.
>Date: Thu, 22 Apr 2004 11:47:41 +0200
>
>Dear all,
>
>
>
>I've put in place a firewall module with VPN-1 and Policy server NGAI
>(R54). My SmartConsole is also with version R54. There is also a radius
>server with steel-belted radius v4.0. My secureclient is a R54 release.
>
>
>
>I use some users created in the smartconsole database with radius
>authentication. I've also created a "generic*" user with radius
>authentication. I use office mode with ip pool. Everything is OK, each
>user have acces to the internal lan with an address from this ip pool.
>
>
>
>Now I want to implement some additionnals features :
>
>
>
>* "ip per user" or "ip per group" :
>
>
>
>How can I do that ? I've tried an ip address allocation per user with
>the ipassignment.conf file, it didn't work. I don't know if it's a
>syntax problem or something else. Here is my ipassignment.conf file :
>
>
>
>Gateway Type IP Address
>User Name
>
>============= ===== ==================================
>=========================================
>
>my_gw range 10.0.0.1-10.0.0.10
>grp_1 # console database group with
>my.fw.user1
>
>my_gw, range 10.0.0.11-10.0.0.20/27
>grp_2 # console database group with
>my.fw.user2
>
>my_gw range 10.0.0.11-10.0.0.20/27
>radius_grp_1 # radius group with radius user1
>
>my_gw, range 10.0.0.21-10.0.0.30/27
>radius_grp_2 # radius group with radius user2
>
>my_gw addr 10.0.0.11,
>< <file:///\\MY.DOMAIN\MY.USER1> file:///\\MY.DOMAIN\MY.USER1>
\\MY.DOMAIN\MY.USER1 # radius user1
>
>my_gw, addr 10.0.0.21,
>< <file:///\\MY.DOMAIN\MY.USER2> file:///\\MY.DOMAIN\MY.USER2>
\\MY.DOMAIN\MY.USER2 # radius
>user2
>
>my_gw addr 10.0.0.2,
>my.fw.user1 # console database user1
>
>my_gw, addr 10.0.0.12,
>my.fw.user2 # console database user2
>
>
>
>Each line has a different syntax. I've tried all those examples without
>any success. If you know why ?
>
>
>
>* "ip per group" with radius group :
>
>
>
>I have seen in the following document that it's possible to configure a
>fp4 gw to assign ip addresses based on radius groups :
>
>
>
>
><
<http://support.checkpoint.com/kb/docs/public/firewall1/ng/pdf/om_ip_ass
>
http://support.checkpoint.com/kb/docs/public/firewall1/ng/pdf/om_ip_ass
>ignment.pdf>
>
<http://support.checkpoint.com/kb/docs/public/firewall1/ng/pdf/om_ip_ass
i>
http://support.checkpoint.com/kb/docs/public/firewall1/ng/pdf/om_ip_assi
>gnment.pdf
>
>
>
>I'm going to test this configuration but I don't know how to configure
>my rule base to provide a different level of acces according to these
>radius groups, something like this :
>
>
>
>SRC DST VPN
>SERVICE ACTION
>
>------------------------------ ------------------------------
>------------------------------ ------------------------------
>------------------------------
>
>[EMAIL PROTECTED] vpn_domain remote_access
>service_vpn_grp_radius 1 accept
>
>[EMAIL PROTECTED] vpn_domain remote_access
>service_vpn_grp_radius_2 accept
>
>
>
>More exactly, I don't know how this rule base can interact with my
>definition of the users which used the "generic*" user.
>
>
>
>
>
>If you know this please give me the trick...
>
>
>
>
>
>Regards,
>
>
>
>
>
>Yannick Rispal
>
>Network Engineer
>
>Atos Origin
>
>64 rue du 8 mai 1945
>
>92025 Nanterre Cedex
>
>France
>
>Mail : <mailto:[EMAIL PROTECTED]>
mailto:[EMAIL PROTECTED]
>< <mailto:[EMAIL PROTECTED]>
mailto:[EMAIL PROTECTED]>
>
>
>
>
>
>
>=================================================
=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to [EMAIL PROTECTED]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[EMAIL PROTECTED]
=================================================
