////

    This file is part of the PacketFence project.

    See PacketFence_Developers_Guide.asciidoc
    for authors, copyright and license information.

////

==== Virtual machines

===== Active Directory Server

Virtual machine called `ad` will be auto-provisioned with:

* a DNS domain
* an Active Directory domain
* Active Directory Certificate Services (AD CS) with auto-enrollment using a GPO
* a `administrator` account, member of Domain admins group, with `VagrantPass1` as password
* a `packetfence` account, member of Domain users group, with `P@ck3tF3nc3pass` as password

Several reboots are necessary before machine can be provisioned by
Ansible. During initial Ansible provisioning, several reboots will
occur too. It takes like few minutes to have a machine up and running.

You can find credentials of AD accounts (domain administrator and PacketFence user) in following files:
* [filename]`$PF_ROOT/addons/vagrant/inventory/group_vars/linux_servers/samba4ad.yml`

===== Switch01

`switch01` is a virtual switch that uses link:https://docs.cumulusnetworks.com/version/cumulus-linux-37/[Cumulus Linux 3.7] system.

This switch is configured using a
link:https://docs.cumulusnetworks.com/cumulus-linux-37/Layer-2/Ethernet-Bridging-VLANs/[VLAN
aware-bridge] to manage VLAN on interfaces (recommended approach)

`hostapd` is the daemon responsible to send 802.1X and MAC Authentication
requests to RADIUS server (as described in
link:https://docs.cumulusnetworks.com/version/cumulus-linux-37/Layer-1-and-Switch-Ports/802.1X-Interfaces/[802.1X
Cumulus Linux documentation]). We configured this daemon using Ansible with RADIUS server informations.
However, daemon will be started during integration tests when switch interfaces are involved.

===== Node01 and Node02

`node01` is a Debian Buster virtual machine used as node to test wired PacketFence
features like 802.1X, MAC authentification, registration, isolation and inline
scenarios.

`node02` is identical to `node01` but is only used to test inline L3 features of PacketFence.

These machines have an Internet access only during its first boot to emulate a
node connected to a switch controlled by PacketFence. After the reboot, machines are only
reachable using management network: `vagrant ssh node01` will not work.

All interfaces of `node01` and `node02` are up after initial provisionning. We rely on
`switch01` configuration to trigger specific scenario.

Because `node01` and `node02` have no IP on management network during first boot, Ansible
provisioning through Vagrant is specific and made in two steps:

- pre-provisioning using *dynamic* inventory generated by Vagrant and a specific playbook
- post-provisioning identical to other Vagrant VMs (but without any Internet access)

Pre-provisioning playbooks should be used to install everything that require
an Internet access.

Pre-provisioning step will not use variables defined in common Ansible inventory:
variables need to be defined directly in playbooks that run during this
step. Variables defined in common Ansible inventory and in playbooks need to
be consistent to avoid an override during post-provisioning.

===== Wireless01

`wireless01` is a Debian Buster virtual machine used as a virtual switch and node.
It is used to test Wireless PacketFence features like 802.1X, MAC authentification.

`hostapd` is the daemon responsible to send 802.1X and MAC Authentication
requests to RADIUS server. It is using the kernel module mac80211_hwsim, a
software simulator of 802.11 radio(s) for mac80211 (as described in
link:https://wireless.wiki.kernel.org/en/users/drivers/mac80211_hwsim[Linux
Wireless mac80211_hwsim]).
We configured this daemon using Ansible with RADIUS server informations.

Two deamons are available. One for an Open SSID and the other for a Secure SSID. Both
 are set to not run at the same time.

`wpa_supplicant` utility is an implementation of the WPA Supplicant
component with support for WPA and WPA2 (IEEE 802.11i / RSN).  Supplicant is the
IEEE 802.1X/WPA Supplicant for wireless network devices. It implements key negotiation
with a WPA Authenticator which controls the roaming and IEEE 802.11
authentication/association of the wlan driver.

===== Linux servers

Linux servers are used to:

* provide infrastructure services to PacketFence server(s)
* host services to test integration with PacketFence

They are provisioned using Ansible.
