// to display images directly on GitHub
ifdef::env-github[]
:encoding: UTF-8
:lang: en
:doctype: book
:toc: left
:imagesdir: ../images
endif::[]

////

    This file is part of the PacketFence project.

    See PacketFence_Network_Devices_Configuration_Guide.asciidoc
    for authors, copyright and license information.

////

//== VPN Configuration


=== Cisco ASA

==== AnyConnect

PacketFence supports Cisco ASA VPN with AnyConnect.

You can force VPN users to authenticate first on the captive portal and based on the role of the device allow it and/or set dynamic ACL.

In this example we assume that the Cisco ASA have 2 interfaces, one Management (192.168.2.1) where the VPN is activated and another one Registration (192.168.1.6) that is facing the PacketFence server (192.168.1.5).

Before trying to configure PacketFence with the Cisco ASA first be sure that when you connect with AnyConnect and when the VPN is up that your device is able to reach Internet.

 ip local pool VPN_POOL 192.168.255.10-192.168.255.254 mask 255.255.255.0
 !
 interface GigabitEthernet0/0
  nameif MANAGEMENT
  security-level 0
  ip address 192.168.2.1 255.255.255.0 
 !
 interface GigabitEthernet0/1
  nameif Registration
  security-level 0
  ip address 192.168.1.5 255.255.0.0 
 !
 same-security-traffic permit inter-interface
 same-security-traffic permit intra-interface
 !
 object network NETWORK_OBJ_192.168.255.0_24
  subnet 192.168.255.0 255.255.255.0
 access-list redirect extended deny udp any any eq domain 
 access-list redirect extended deny ip any host 192.168.1.5 
 access-list redirect extended deny icmp any any 
 access-list redirect extended permit tcp any any eq www 
 access-list redirect extended permit tcp any any eq https 
 !
 route MANAGEMENT 0.0.0.0 0.0.0.0 192.168.2.254 1
 !
 aaa-server PacketFence protocol radius
  authorize-only
  interim-accounting-update periodic 1
  merge-dacl before-avpair
  dynamic-authorization
 aaa-server PacketFence (Registration) host 192.168.1.5
  timeout 5
  key useStrongerSecret
  authentication-port 1812
  accounting-port 1813
 !
 http server enable
 http 192.168.0.0 255.255.0.0 MANAGEMENT
 !
 webvpn
  enable MANAGEMENT
  anyconnect image disk0:/anyconnect-win-4.0.00051-k9.pkg 8
  anyconnect image disk0:/anyconnect-linux-64-4.0.00051-k9.pkg 9
  anyconnect image disk0:/anyconnect-macosx-i386-4.0.00051-k9.pkg 10
  anyconnect profiles VPN_client_profile disk0:/VPN_client_profile.xml
  anyconnect enable
  tunnel-group-list enable
  cache
   disable
  error-recovery disable
 group-policy GroupPolicy_VPN internal
 group-policy GroupPolicy_VPN attributes
  dns-server value 1.1.1.1
  vpn-tunnel-protocol ikev2 ssl-client 
  split-tunnel-policy tunnelall
  split-tunnel-network-list none
  default-domain value acme.com
  webvpn
   anyconnect profiles value VPN_client_profile type user
 tunnel-group VPN type remote-access
 tunnel-group VPN general-attributes
  address-pool (MANAGEMENT) VPN_POOL
  address-pool VPN_POOL
  authentication-server-group PacketFence
  accounting-server-group PacketFence
  default-group-policy GroupPolicy_VPN
 tunnel-group VPN webvpn-attributes
  group-alias VPN enable



=== OpenVPN

PacketFence support OpenVPN with PAP authentication.

==== OpenVPN server configuration

In this section we will cover the OpenVPN installation on a Debian 11 machine and how to configure it.

 apt install libgcrypt20-dev openvpn easy-rsa

 mkdir -p /etc/openvpn/server/certs
 cd /etc/openvpn/server/certs
 openssl genrsa -out ca.key 2048
 openssl req -new -x509 -days 3650 -key ca.key -out ca.crt
 openssl genrsa -out vpn.key 2048
 openssl req -new -key vpn.key -out vpn.csr
 openssl x509 -req -in vpn.csr -out vpn.crt -CA ca.crt -CAkey ca.key -CAcreateserial -days 365
 openssl dhparam -out dh2048.pem 2048

Edit the server.conf file and paste this following content:

 vim /etc/openvpn/server.conf

 port 443
 proto tcp4
 dev tun
 server 10.11.0.0 255.255.255.0
 ca /etc/openvpn/server/certs/ca.crt
 cert /etc/openvpn/server/certs/vpn.crt
 key /etc/openvpn/server/certs/vpn.key
 dh /etc/openvpn/server/certs/dh2048.pem
 plugin /etc/openvpn/radiusplugin.so /etc/openvpn/radiusplugin.cnf
 persist-key
 persist-tun
 keepalive 10 60
 reneg-sec 0
 comp-lzo
 tun-mtu 1468
 tun-mtu-extra 32
 mssfix 1400
 push "persist-key"
 push "persist-tun"
 push "redirect-gateway def1"
 push "dhcp-option DNS 8.8.8.8"
 push "dhcp-option DNS 8.8.4.4"
 status /etc/openvpn/443.log
 verb 3
 verify-client-cert none

Next you need to compile the radius extention for openvpn:

 wget https://github.com/ValdikSS/openvpn-radiusplugin/archive/refs/heads/master.zip
 unzip master.zip
 cd openvpn-radiusplugin-master

Then apply this patch:

 diff -ruN openvpn-radiusplugin-master.orig/Config.cpp openvpn-radiusplugin-master/Config.cpp
 --- openvpn-radiusplugin-master.orig/Config.cpp 2015-12-23 08:07:19.000000000 -0500
 +++ openvpn-radiusplugin-master/Config.cpp      2021-11-09 11:17:21.759139003 -0500
 @@ -240,6 +240,14 @@
                                                           this->clientcertnotrequired=true;
                                                   }
                                           }
 +                                         if (param == "verify-client-cert")
 +                                         {
 +                                                 this->deletechars(&line);
 +                                                 if (line == "verify-client-certoptional" || line == "verify-client-certnone")
 +                                                 {
 +                                                         this->clientcertnotrequired=true;
 +                                                 }
 +                                         }
                                           if (param == "username-as-common-name")
                                           {
                                                   this->deletechars(&line);


Compile the plugin:

 make
 cp radiusplugin.so /etc/openvpn/

Then edit the radiusplugin.cnf file:

 vim /etc/openvpn/radiusplugin.cnf

 NAS-Identifier=OpenVpn
 Service-Type=5
 Framed-Protocol=1
 NAS-Port-Type=5
 NAS-IP-Address=192.168.0.6
 OpenVPNConfig=/etc/openvpn/server.conf
 overwriteccfiles=true
 useauthcontrolfile=true
 useclientconnectdeferfile=true
 nonfatalaccounting=false
 defacctinteriminterval=0

 server
 {
         acctport=1813
         authport=1815
         name=192.168.0.5
         retry=1
         wait=30
         sharedsecret=secret
 }

==== PacketFence configuration

On the PacketFence side the only thing you need to do is to create a new switch as type OpenVPN with the ip address 192.168.0.6 and with the shared secret 'secret'.
And enable "CLI Access Enabled" in the switch too to enable the radius-cli to start.

