I went straight to R55 from FP3 and the ipassignment.conf that was already present on my box did not have the # sign on the = line but it was on the # Gateway line. It took me awhile to find that command and it complained about the missing # sign.
I didn't know that syntax checker was an R55-specific command, but I think we both now know why they added it. :-)
Ray
From: "RISPAL Yannick - NTR ( [EMAIL PROTECTED] )" <[EMAIL PROTECTED]> Reply-To: Mailing list for discussion of Firewall-1 <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Subject: Re: [FW-1] Office mode, ipassignment.conf and radius authentication. Date: Fri, 23 Apr 2004 11:28:12 +0200
Sorry for the presentation, I will try to make it more readable :
Gateway Type IP Address User Name ======== ===== ======================= ====================================== my_gw range 10.0.0.1-10.0.0.10 grp_1 # console group with my.fw.user1 my_gw, range 10.0.0.11-10.0.0.20/27 grp_2 # console group with my.fw.user2 my_gw range 10.0.0.11-10.0.0.20/27 radius_grp_1 # radius group with user1 my_gw, range 10.0.0.21-10.0.0.30/27 radius_grp_2 # radius group with user2 my_gw addr 10.0.0.11, \\MY.DOMAIN\MY.USER1 # radius user1 my_gw, addr 10.0.0.21, \\MY.DOMAIN\MY.USER2 # radius user2 my_gw addr 10.0.0.2, my.fw.user1 # console database user1 my_gw, addr 10.0.0.12, my.fw.user2 # console database user2
So, you can see that there is no # before the
Gateway ========
It's like that in the original file ipassignment.conf. One more thing, my firewall module is a R54 release and the commands
vpn ipafile_check ipassignment.conf warn or vpn ipafile_check ipassignment.conf detail
are not available on my firewall :
[EMAIL PROTECTED] vpn ipafile_check ipassignment.conf warn Unknown command "ipafile_check"
Usage: vpn debug < on|off|ikeon|ikeoff|trunc > # print debug msgs to VPN log files vpn crl_zap # erase all CRLs from cache vpn drv ... # attach vpn driver to fw driver and more vpn ver [-k] # display VPN version
vpn accel ... # operations on VPN accelerator card and VPNx vpn crlview ... # debugging tool for CRLs vpn diag < on | off > # print VPN diagnostics msgs vpn compstat # display compression/decompression statistics vpn compreset # reset compression/decompression statistics vpn macutil [user_name] # display generated MAC address by username or # DN from arg or stdin (also: vpn mu) vpn tunnelutil # launch TunnelUtil tool to control # VPN Tunnels (also: vpn tu) vpn export_p12 ... # tool to export p12 from gw certificate vpn nssm_topology ... # generate topology in NSSM format for # Nokia clients vpn sw_topology ... # Download topology for SofaWare GWs vpn overlap_encdom ... # Display overlapping encryption domains [EMAIL PROTECTED]
First, I will try with the # before "Gateway" and "========". Second I will upgrade to R55 or newer if available to see if this resolve the problem.
Thanks, Yannick.
------------------------------
Date: Thu, 22 Apr 2004 21:01:37 -0400 From: Ray Pesek <[EMAIL PROTECTED]> Subject: Re: Office mode, ipassignment.conf and radius authentication.
Unfortunately the word wrapping makes it difficult to read. If this is the exact file, the # comment signs are missing from the
# Gateway #=====
lines. Go to the directory where ipassignment.conf is located and run
vpn ipafile_check ipassignment.conf warn
or
vpn ipafile_check ipassignment.conf detail
and it will give you a check of whether your syntax is correct. Make sure the file is on the enforcement module in $FWDIR/conf/ and not on the management server, although you can perform the syntax check on the management server.
Ray
>From: "RISPAL Yannick - NTR ( [EMAIL PROTECTED] )" ><[EMAIL PROTECTED]> >Reply-To: Mailing list for discussion of Firewall-1 ><[EMAIL PROTECTED]> >To: [EMAIL PROTECTED] >Subject: [FW-1] Office mode, ipassignment.conf and radius authentication. >Date: Thu, 22 Apr 2004 11:47:41 +0200 > >Dear all, > > > >I've put in place a firewall module with VPN-1 and Policy server NGAI >(R54). My SmartConsole is also with version R54. There is also a radius
>server with steel-belted radius v4.0. My secureclient is a R54 release.
> > > >I use some users created in the smartconsole database with radius >authentication. I've also created a "generic*" user with radius >authentication. I use office mode with ip pool. Everything is OK, each >user have acces to the internal lan with an address from this ip pool. > > > >Now I want to implement some additionnals features : > > > >* "ip per user" or "ip per group" : > > > >How can I do that ? I've tried an ip address allocation per user with >the ipassignment.conf file, it didn't work. I don't know if it's a >syntax problem or something else. Here is my ipassignment.conf file : > > > >Gateway Type IP Address >User Name > >============= ===== ================================== >========================================= > >my_gw range 10.0.0.1-10.0.0.10 >grp_1 # console database group with
>my.fw.user1 > >my_gw, range 10.0.0.11-10.0.0.20/27 >grp_2 # console database group with
>my.fw.user2 > >my_gw range 10.0.0.11-10.0.0.20/27 >radius_grp_1 # radius group with radius user1
> >my_gw, range 10.0.0.21-10.0.0.30/27 >radius_grp_2 # radius group with radius user2
> >my_gw addr 10.0.0.11, >< <file:///\\MY.DOMAIN\MY.USER1> file:///\\MY.DOMAIN\MY.USER1> \\MY.DOMAIN\MY.USER1 # radius user1 > >my_gw, addr 10.0.0.21, >< <file:///\\MY.DOMAIN\MY.USER2> file:///\\MY.DOMAIN\MY.USER2> \\MY.DOMAIN\MY.USER2 # radius >user2 > >my_gw addr 10.0.0.2, >my.fw.user1 # console database user1 > >my_gw, addr 10.0.0.12, >my.fw.user2 # console database user2 > > > >Each line has a different syntax. I've tried all those examples without
>any success. If you know why ? > > > >* "ip per group" with radius group : > > > >I have seen in the following document that it's possible to configure a
>fp4 gw to assign ip addresses based on radius groups : > > > > >< <http://support.checkpoint.com/kb/docs/public/firewall1/ng/pdf/om_ip_ass > http://support.checkpoint.com/kb/docs/public/firewall1/ng/pdf/om_ip_ass >ignment.pdf> > <http://support.checkpoint.com/kb/docs/public/firewall1/ng/pdf/om_ip_ass i> http://support.checkpoint.com/kb/docs/public/firewall1/ng/pdf/om_ip_assi
>gnment.pdf > > > >I'm going to test this configuration but I don't know how to configure >my rule base to provide a different level of acces according to these >radius groups, something like this : > > > >SRC DST VPN >SERVICE ACTION > >------------------------------ ------------------------------ >------------------------------ ------------------------------ >------------------------------ > >[EMAIL PROTECTED] vpn_domain remote_access >service_vpn_grp_radius 1 accept > >[EMAIL PROTECTED] vpn_domain remote_access >service_vpn_grp_radius_2 accept > > > >More exactly, I don't know how this rule base can interact with my >definition of the users which used the "generic*" user. > > > > > >If you know this please give me the trick... > > > > > >Regards, > > > > > >Yannick Rispal > >Network Engineer > >Atos Origin > >64 rue du 8 mai 1945 > >92025 Nanterre Cedex > >France > >Mail : <mailto:[EMAIL PROTECTED]> mailto:[EMAIL PROTECTED] >< <mailto:[EMAIL PROTECTED]> mailto:[EMAIL PROTECTED]> > > > > > > >=================================================
================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
_________________________________________________________________ Test your �Travel Quotient� and get the chance to win your dream trip! http://travel.msn.com
================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
