[PacketFence-users] VLAN isolation and routed networks

[Erik <er...@va...>]

Hi,

I have recently begun to investigate PacketFence to see if it can be 
used under the circumstances I am faced with.
What I have found in the documentation sofar is rather little and tells 
me that routed networks are possible, but the example does not match my 
circumstances. I am guessing it is just an example and other options are 
available. I will be building a test site as soon as the necessary 
equipment arrives.

Hope I can pick your brains in the mean time.


So the circumstances are these.

There are several separate locations that are connected to one central 
location via VPN (OpenVPN).
Every location has their own local network and none of the address 
ranges overlap. Locations can talk to each other because the central 
location, where the VPN server is, routes traffic between locations.

Every location is going to be split up into a trusted and untrusted LAN. 
There is a local firewall on each location that can manage this, but I 
am looking for a solution that can be managed at the central location.

So I thought of PacketFence and wondered if it might fit. The general 
idea is that the switches on each location access the PacketFence at the 
central location for authentication and that PacketFence tells them if 
the client can be authenticated, into which VLAN they must be put.

The switches can communicate with PacketFence at the central location 
via the VPN. The clients cannot, because by default they are blocked by 
the firewall.

I do not need or want PacketFence to provide DNS or DHCP. Once the local 
switch has put the client on the correct VLAN and has allowed the port 
the client is on to forward traffic, the clients will get DHCP and DNS 
from the local servers.

So basically, PacketFence will not needed to know about the local 
networks. It will only have to authenticate credentials and let the 
switch know what VLAN to use. The switches will use 802.1x for those 
clients that support it and MAC authentication for those devices that don't.

I have used FreeRADIUS in the past with 802.1x and MAC authentication to 
simply enable and disable switch ports. Back then the VLANs had been 
fixed and defined on the switch. You either got access or you did not. 
The current situation is similar with the notable exeption that now the 
switch does not know the VLAN id beforehand and has to be told not just 
whether to enable the port, but also in which VLAN to put it.


What do you think am I barking up the wrong tree here?

thanks for your time,
Erik van Linstee