Red Hat NETWORK 4.1.0 - Guide de l'utilisateur télécharger pdf (Page 26)

Chapter 5

Configuration 22

Inline enforcement uses ipset to mark nodes as registered, unregistered and isolated. It is also

now possible to use multiple inline interfaces, a node registered on the first inline interface

is mark with is couple ip:mac, so when the node try to register on an other inline interface

PacketFence detect that the node is already registered on the first VLAN. It is also possible to enable

inline.should_reauth_on_vlan_change to force user to reauthenticate when they change VLAN. ipset also

provides a better reponse time under inline enforcement and now we just have to wait 10s after the

registration to access to internet.

The outgoing interface should be specified by adding in pf.conf the option interfaceSNAT in inline section.

It is a comma delimited list of network interfaces like eth0,eth0.100. It’s also possible to specify a network

that will be routed instead of using NAT by adding in conf/networks.conf an option nat=no under one

or more network section.

Another important setting is the gateway statement. Since it this the only way to get the PacketFence

server inline interface ip address, it is mandatory to set it to this ip (which is supposed to be the same

as in the ip statement of the inline interface in conf/pf.conf) .

Hybrid mode

This section applies for hybrid support for the manageable devices that support 802.1x or mac-auth.

Hybrid enforcement is a mixed method that offers the use of inline enforcement mode with VLAN

enforcement mode on the same device. This technique is covered in details in the "Technical introduction

to Hybrid enforcement" section

DHCP and DNS Server Configuration

(networks.conf)

PacketFence automatically generates the DHCP configuration files for Registration, Isolation and Inline

VLANs. This is done by editing the network interfaces from the configuration module of the administration

Web interface (see the First Step section).

network Network subnet

netmask Network mask

gateway PacketFence IP address in this network

next_hop Used only with routed networks; IP address

of the router in this network (This is used

to locally create static routes to the routed

networks). See the Routed Networks section)

domain-name DNS name

1 2 ... 21 22 23 24 25 26 27 28 29 30 31 ... 100 101

Pas de commentaire

Red Hat NETWORK 4.1.0 - Guide de l'utilisateur Page 26