machines:grifon:bgp-adsl
Différences
Ci-dessous, les différences entre deux révisions de la page.
| machines:grifon:bgp-adsl [2019/06/20 07:52] – créée - modification externe 127.0.0.1 | machines:grifon:bgp-adsl [2026/07/28 14:34] (Version actuelle) – supprimée - modification externe (Date inconnue) 127.0.0.1 | ||
|---|---|---|---|
| Ligne 1: | Ligne 1: | ||
| - | ====== bgp-adsl A METTRE A JOUR ====== | ||
| - | FreeBSD bgp-adsl.grifon.fr 11.2-RELEASE amd64 GENERIC | ||
| - | |||
| - | |||
| - | Machine virtuelle \\ | ||
| - | Routeur de collecte ADSL | ||
| - | |||
| - | ===== Administrateurs ===== | ||
| - | |||
| - | * alarig | ||
| - | * dotux | ||
| - | * gizmo | ||
| - | * nemo | ||
| - | |||
| - | ===== Services ===== | ||
| - | |||
| - | * RADIUS, freeradius | ||
| - | * BGP, bird | ||
| - | |||
| - | ==== RADIUS ==== | ||
| - | |||
| - | Ce service sert à authentifier les clients PPP (est-ce que le couple user/passwd est le bon ?) et à donner les IPs que ce client est autorisé à utiliser. | ||
| - | |||
| - | On commence par installer les paquets qui vont bien : | ||
| - | |||
| - | < | ||
| - | |||
| - | Ensuite, on détermine les machines qui pourront se connecter : | ||
| - | |||
| - | <file | / | ||
| - | client localhost { | ||
| - | ipaddr = 127.0.0.1 | ||
| - | proto = * | ||
| - | secret = passwd | ||
| - | require_message_authenticator = no | ||
| - | nas_type = other # localhost isn't usually a NAS... | ||
| - | limit { | ||
| - | max_connections = 16 | ||
| - | lifetime = 0 | ||
| - | idle_timeout = 30 | ||
| - | } | ||
| - | } | ||
| - | client localhost_ipv6 { | ||
| - | ipv6addr = ::1 | ||
| - | secret = passwd | ||
| - | } | ||
| - | client phibee_auth-srv2 { | ||
| - | ipv4addr = 78.41.160.24 | ||
| - | secret = passwd | ||
| - | } | ||
| - | client phibee_auth-srv1 { | ||
| - | ipv4addr = 78.41.185.40 | ||
| - | secret = passwd | ||
| - | } | ||
| - | </ | ||
| - | |||
| - | Les clients se renseignent ainsi : | ||
| - | |||
| - | <file | / | ||
| - | gfa@grifon.ptel.ipadsl Cleartext-Password := " | ||
| - | Service-Type = Framed-User, | ||
| - | Framed-Protocol = PPP, | ||
| - | Framed-Routing = None, | ||
| - | Framed-IP-Address = 89.234.186.22, | ||
| - | Framed-IP-Netmask = 255.255.255.255, | ||
| - | Framed-MTU = 1492, | ||
| - | Tunnel-Medium-Type = IP, | ||
| - | Tunnel-Server-Endpoint = 89.234.186.11, | ||
| - | Tunnel-Type = L2TP, | ||
| - | Framed-IPv6-Prefix = 2a00: | ||
| - | Framed-IPv6-Address = 2a00: | ||
| - | Framed-Interface-Id = 0:0:0:2, | ||
| - | Delegated-IPv6-Prefix = 2a00: | ||
| - | </ | ||
| - | |||
| - | Framed-IP-Address correspond à l’IPv4 du client, Framed-IPv6-Prefix le range d’interco et Delegated-IPv6-Prefix le préfixe que nous lui déléguons. | ||
| - | |||
| - | Le realm change en fonction de la collecte, voici ceux que nous devons utiliser : | ||
| - | * grifon.ptel pour Orange | ||
| - | * grifon.ptel.ipadsl pour SFR | ||
| - | * grifon.phibee.adsl pour Axione | ||
| - | * grifon.xdsl-kosc.ptel pour KOSC | ||
| - | |||
| - | |||
| - | ==== BGP ==== | ||
| - | |||
| - | On utilise BGP pour annoncer nos IPs RADIUS et L2TP afin qu’elles soient routées sur l’interco plutôt que par le net. Ça permet de ne payer le transit qu’une fois. \\ | ||
| - | Phibee nous annonce également leurs IPs associées à chaque service, afin que les réponses passent également par le bon tunnel. | ||
| - | |||
| - | On en profite pour annoncer les IPv4 à nos routeurs de bordures. Comme nous n’avons pas encore de bloc dédié (le plan d’adressage est complet sur le premier /24, on est en attente de nouvelles de gitoyen pour en avoir un deuxième), on ne peut pas router tout un bloc à la main. | ||
| - | |||
| - | Phibee nous livre sur une interco /31 publique pour chaque service, chacune dans son VLAN. | ||
| - | |||
| - | <file | / | ||
| - | # Configure logging | ||
| - | log syslog { warning, error, fatal, bug }; | ||
| - | |||
| - | # Turn on global debugging of all protocols | ||
| - | # debug protocols all; | ||
| - | |||
| - | # Override router ID and store ASN | ||
| - | router id 89.234.186.206; | ||
| - | |||
| - | ##################### | ||
| - | # GENERAL PROTOCOLS # | ||
| - | ##################### | ||
| - | # This pseudo-protocol watches all interface up/down events. | ||
| - | protocol device { | ||
| - | # Scan interfaces every 5 seconds | ||
| - | scan time 5; | ||
| - | } | ||
| - | |||
| - | protocol direct {} | ||
| - | |||
| - | protocol kernel { | ||
| - | persist; | ||
| - | import none; | ||
| - | export all; | ||
| - | } | ||
| - | |||
| - | protocol bgp bgp_phibee_radius { | ||
| - | local as 204092; | ||
| - | neighbor 78.41.191.124 as 8487; | ||
| - | export where proto = " | ||
| - | export filter { if net ~ [ 89.234.186.10/ | ||
| - | } | ||
| - | |||
| - | protocol bgp bgp_phibee_lns { | ||
| - | local as 204092; | ||
| - | neighbor 78.41.191.126 as 8487; | ||
| - | export where proto = " | ||
| - | export filter { if net ~ [ 89.234.186.11/ | ||
| - | } | ||
| - | |||
| - | protocol bgp ibgp_nominoe { | ||
| - | local as 204092; | ||
| - | neighbor 89.234.186.203 as 204092; | ||
| - | export where proto = " | ||
| - | |||
| - | next hop self; | ||
| - | } | ||
| - | |||
| - | protocol bgp ibgp_budic { | ||
| - | local as 204092; | ||
| - | neighbor 89.234.186.202 as 204092; | ||
| - | export where proto = " | ||
| - | |||
| - | next hop self; | ||
| - | } | ||
| - | </ | ||
| - | ===== Conf réseau ===== | ||
| - | |||
| - | La VM ne comporte qu’un port réseau public ('' | ||
| - | |||
| - | Le trafic rentre par l’interco avec phibee sur '' | ||
| - | |||
| - | Les échanges RADIUS se font sur '' | ||
| - | |||
| - | L’interface '' | ||
| - | |||
| - | La passerelle de la machine est '' | ||
| - | |||
| - | < | ||
| - | 1: lo: < | ||
| - | link/ | ||
| - | inet 127.0.0.1/8 brd 127.255.255.255 scope host lo | ||
| - | | ||
| - | inet6 ::1/128 scope host | ||
| - | | ||
| - | 2: eth0: < | ||
| - | link/ether 7a: | ||
| - | inet 89.234.186.206/ | ||
| - | | ||
| - | inet6 2a00: | ||
| - | | ||
| - | inet6 fe80:: | ||
| - | | ||
| - | 3: eth1: < | ||
| - | link/ether be: | ||
| - | inet 172.17.0.22/ | ||
| - | | ||
| - | inet6 fe80:: | ||
| - | | ||
| - | 4: dummy0: < | ||
| - | link/ether 02: | ||
| - | inet 89.234.186.10/ | ||
| - | | ||
| - | inet 89.234.186.11/ | ||
| - | | ||
| - | inet6 fe80:: | ||
| - | | ||
| - | 5: eth0.2000@eth0: | ||
| - | link/ether 7a: | ||
| - | inet 78.41.191.125/ | ||
| - | | ||
| - | inet6 fe80:: | ||
| - | | ||
| - | 6: eth0.2001@eth0: | ||
| - | link/ether 7a: | ||
| - | inet 78.41.191.127/ | ||
| - | | ||
| - | inet6 fe80:: | ||
| - | | ||
| - | 13: ppp0: < | ||
| - | link/ppp | ||
| - | inet 89.234.186.11 peer 89.234.186.21/ | ||
| - | | ||
| - | inet6 2a00: | ||
| - | | ||
| - | inet6 fe80:: | ||
| - | | ||
| - | </ | ||