// to display images directly on GitHub
ifdef::env-github[]
:encoding: UTF-8
:lang: en
:doctype: book
:toc: left
:imagesdir: ../images
endif::[]

////

    This file is part of the PacketFence project.

    See PacketFence_Installation_Guide.asciidoc
    for authors, copyright and license information.

////

//== Installation

This section will guide you through the installation of PacketFence from the Zero Effort NAC (ZEN) appliance and from the standard repository of packages we provide - which can be used to install PacketFence on top of a vanilla GNU/Linux installation.

=== Installing PacketFence from the ZEN

The ZEN (Zero Effort NAC) edition of PacketFence allows you to rapidly get PacketFence running in your network environment. It consists of a fully installed and preconfigured version of PacketFence distributed as a virtual appliance. It can be deployed on VMware ESX/ESXi, Microsoft Hyper-V and other products. This section covers the deployment of the virtual appliance on VMware-based products. We are not supporting any Xen-based hypervisors yet.

You can download the ZEN here: https://www.packetfence.org/download.html#/zen

==== Virtual Machine

This setup has been tested using VMware ESXi, Fusion and Workstation products
with 16 GB of RAM dedicated to the virtual machine. It might work using other
VMware products.  To properly run the PacketFence virtual appliance, you need
a CPU that supports long mode. In other words, you need to have a 64-bit
capable CPU on your host. PacketFence ZEN comes in a pre-built virtual disk
(OVF). If you are using an ESX type hypervisor, you need to import the OVF
using vSphere Client (or vCenter).

First network card of virtual machine is configured to receive an IP through DHCP.

The virtual appliance passwords are:

.Management (Console/SSH) user
* Login: root
* Password: p@ck3tf3nc3

WARNING: Be sure to change default passwords if you plan to use this image in production.

==== Import to ESX

Make sure that there is only one virtual network card created, and also make sure that your vEthernet is connected to a virtual switch (vSwitch). That virtual network card will be used as the PacketFence management interface.

==== Import to VMware Player/Workstation for Linux

Newer versions of VMware Player handle VLAN trunking a lot better. With that in mind,  we can use a single interface on the VM.  So, you need to ensure that your VM host is plugged into a physical trunk port with VLAN 1,2,3,5,10 and 200 as the allowed VLAN. These VLANs will be used later in configuration examples.

=== Installing PacketFence from the ISO

The ISO edition of PacketFence allows you to install PacketFence on Debian 11 with minimal effort. Instead of manually installing Debian 11 and installing PacketFence after, this will perform both tasks and select the optimal parameters and best practices for installing the operating system.

You can download the ISO here: https://www.packetfence.org/download.html#/releases

==== Machine specifications

This setup has been tested using VMware ESXi, Proxmox VE and VirtualBox but will also work with any hypervisor PacketFence supports as well as bare-metal servers.

You will need a virtual machine or server with 16 GB of RAM dedicated to machine as well as 4 CPUs. Make sure you allocate at least 200GB of disk space for PacketFence.

==== Installing the ISO to a virtual machine

Provision a virtual machine with the specifications above, mount the ISO in the CD/DVD drive of the machine and start it.
The installer will open and you will simply have to follow the instructions on screen to complete the installation.

==== Installing the ISO to a bare-metal server

First, make sure your server follows the specifications above and then burn the ISO onto a DVD or USB key and boot it on the server.
The installer will open and you will simply have to follow the instructions on screen to complete the installation.

=== Installing PacketFence on existing Linux

PacketFence provides packages repository for RHEL 8 as well as packages repository fo Debian.

These repositories contain all required dependencies to install PacketFence. This provides numerous advantages. Among them, there are:

[options="compact"]
* easy installation
* everything is packaged as RPM and Debian packages
* easy upgrade

First install your supported distribution with minimal installation and no additional packages. Then:

On Red Hat-based systems
[options="compact"]
* Disable firewall
* Disable SELinux

On Debian
[options="compact"]
* Disable AppArmor
* Disable resolvconf

*NOTE*: If running *UEFI mode*, make sure *secureboot* is *disabled*.

Make sure your system is up to date and your yum or apt-get database is updated. On a RHEL-based system, do:

[source,bash]
----
yum update
----

On a Debian system, do:

[source,bash]
----
apt-get update
apt-get upgrade
----

Regarding SELinux or AppArmor, even if they may be wanted by some
organizations, PacketFence will not work properly if SELinux or AppArmor are
enabled. You will need to explicitly disable SELinux from the
`/etc/selinux/config` file and reboot the machine. For AppArmor, you need to
follow instructions on
link:https://wiki.debian.org/AppArmor/HowToUse#Disable_AppArmor[Debian wiki].

Regarding resolvconf, you can remove the symlink to that file and simply create the `/etc/resolv.conf` file with the content you want.

==== RHEL-based systems

Install kernel development package:

[source,bash]
----
yum install kernel-devel-$(uname -r)
----

Ensure `runc` and `podman` are uninstalled (PacketFence uses docker+containerd.io)

[source,bash]
----
yum remove runc podman
----


NOTE: Make sure you are actually running the latest kernel prior to installing the kernel development package. Reboot prior to installing this package if unsure.

===== RHEL 8.x

You need to have a valid subscription to be able to install PacketFence dependencies.

==== Debian-based systems

Install kernel development package:

[source,bash]
----
apt install linux-headers-$(uname -r)
----

NOTE: Make sure you are actually running the latest kernel prior to installing the kernel development package. Reboot prior to installing this package if unsure.

==== Software Installation

===== RHEL-based systems

NOTE: On RHEL 8.x systems, as a preliminary step, you need to run: `rpm --import http://inverse.ca/downloads/GPG_PUBLIC_KEY` before installing `packetfence-release` package.

In order to use the PacketFence repository:

// subs=attributes allow to substitute {release_minor} in code block
[source,bash,subs="attributes"]
----
yum localinstall http://packetfence.org/downloads/PacketFence/RHEL8/packetfence-release-{release_minor}.el8.noarch.rpm
----

Once the repository is defined, you can install PacketFence with all its dependencies, and the required external services (database server, DHCP server, RADIUS server) using:

[source,bash]
----
yum install --enablerepo=packetfence packetfence
----

===== Debian-based systems

In order to use the repository, create a file named [filename]`/etc/apt/sources.list.d/packetfence.list`:

// subs=attributes allow to substitute {release_minor} in code block
[source,bash,subs="attributes"]
----
echo 'deb http://inverse.ca/downloads/PacketFence/debian/{release_minor} bullseye bullseye' > \
/etc/apt/sources.list.d/packetfence.list
----

Once the repository is defined, you can install PacketFence with all its
dependencies, and the required external services (Database
server, DHCP server, RADIUS server) using:

[source,bash]
----
apt install gnupg sudo
wget -q -O - https://inverse.ca/downloads/GPG_PUBLIC_KEY | sudo apt-key add -
apt-get update
apt-get install packetfence
----

=== Installing PacketFence on Linode

PacketFence v12 includes instructions on deploying PacketFence on Linode IaaS. See the <<PacketFence_Installation_Guide.asciidoc#_how_to_deploy_packetfence_on_linode,Appendix>> below for details.
