思科与F5对接Radius

1、简介本文描述如何配置在F5本地流量管理器(LTM)的iRules思科身份服务引擎的(ISE)Radius和HTTP负载均衡先决条件要求Cisco建议您了解以下主题：思科ISE部署、验证和授权在F5LTM的基础知识在Radius和HTTP协议的知识使用的组件本文档中的信息基于以下软件和硬件版本：CiscoCatalyst交换机F5BIG-IP版本11.6CiscoISE软件版本1.3及以后配置网络图F5LTM配置作为Radius的一loadbalancer。确保是重要的，所有验证和核算数据包同一会话的重定向对同一个ISE节点。IETF属性呼叫站点Id使用持续时间配置文件。没有使用NAT。LTM路

2、由虚拟服务器的数据包给包括两个成员的正确池。确保回来从ISE节点的流量通过LTM去是重要的。如果不是纳季将看到在答复的实际IP地址而不是虚拟。在这样方案中SNAT在LTM将必须使用-，但是那将中断大多ISE流-,因此不支持。配置ISE为了简化条款ISE配置被跳过。请参考的其他资源。在ISE的特别配置没有需要除了网络设备()的新增内容。F5LTMLTM已经预先配置与正确VLAN/接口。两ISE节点被添加作为节点:11sBF5LTMISE-P5N1|17.1fi3a|17.1fi3a1D011D01External:WPRoHiug172.16J3103inter同:17lf

3、i-.J4.10JISE-PSN2172,134101DNSDNS- -：/!LocalTraffic/!LocalTrafficMxMx则”叫VirrjwServersPdciifePdciifeFaeriesiRdffiFaeriesiRdffiPooteMndwMndw池为两节点创建(监听是基于的icmp,可能是udp/radius)LoadLoad岫晒出MLoadBalancingMethodLoadBalancingMethodf f箫同.巨c c新j jPriortyGroupActivaticn(Disabled三jUpdateCurreMMambersiRule创建。它寻找每属

4、性值对查找IETF呼叫站点Id的(31)每Access-Request并且创建根据它的持续时间规则是值:ADCUtLocalTrarric”Pools:PealLtst-Jcnse-fliiTDpedesMembersStadsbcsIpl工wppsDNS前LgalTstfiLgalTstfi匚FlcvoritMapFlcvoritMapvinuaiserver阳匕胸ProfilesIRUliIRUliPoolsdStstdStst闺MerntjerMerntjer- -Adrlrif?ssAdrlrif?ss+QAMHSarvw-ISE1i:0172.163i.100L_-FleaIServ

5、er-ISE2.JDIT2,ia4.10iAbulAbulLocalTfaUlKLocalTfaUlK：HQiJeK:NHQiJeK:N小兵LiwtLiwtSlAHAtk；*疗,欣电4LIS14LIS1lApplApp FfirJPiq足h睁RrfPfflp*1*StatisticStatisticMainMainEnEn blbl白Di?ablARxc&OflinfiDi?ablARxc&OflinfiiRule的内容:whenCLIENT_ACCEPTEDbinaryscanUDP:payloadccSH32cccodeidentlenauthattr_code1attr_

6、len1setindex22while$index$lensethsizeexpr($attr_len1-2)*2binaryscanUDP:payload$indexH$hsizeccattr_valuenext_attr_code2next_attr_len2#IfitisCalling-Station-Id(31)attribute.if$attr_code1=31LocalTrafflcn(Rules:iRuleListRadijs-CallkngStatlonldPropertie&StatisticsNetworkMapPropertiesNamePartition；Pat

7、hVirtualServersPoliciesProfilesRulesDefinitionPoolsNodesMonitorsTraficClsssAddressTranslaborIgrwrsSignahjr&Cfi&cKSLinRadinstallingstationkistationkiCommonh晅口CLIACCEPTED(binaryscanUDPiipayloadccSH32ccCDdeidentlenauthattrccxlel3ttrlenl与工fsethsizeexprtrlenl-2)*21-binaryscnUDP;payload5in-dxIR？fh

8、3izelccattr_valunextattrnextattrlen2#Tfit上寻Stteattribute,ifif31)131)1persistuiw?attrvalue30returnpersistuiw?attrvalue30returnindssc&xpr$indx*$attrl-nlattrIsnlattrlen2attrcod&lSmextattrcoda2EKtendTextAreaWrapTextpersistuie$attr_value30return)setindexexpr$index+$attr_len1setattr_len1$next_attr

9、_len2setattr_code1$next_attr_code2)持续时间哈希基于配置文彳创建。该配置文件在iRule上使用:AQOUtLocalTrafficnprofiles:Persistervce*CallingStatloni(4ash/Pf，rPC尊LocalTrafficNetworkMapVirtualServersPoliciesProtlesIFtliesPoolsModesMonitorQTrafiicCla&sAddressTranslationNameCallIngtatlorikl-HashPartitior/PathConrnonPersisteriC

10、ieTypeHastiFarertProfile两说,ntimIMIIMIIMIIIMIIMIMIanma：iGeneralPropertiesAeeelerallonDeviceManagenententNetworPiTfSystemConfigurettonMatchAcrosSrServiceaWatchAcrossVirtualServersMatchAccostFoolsHashAlgorithmHashOffsetHashLengtnHashStartPatternHashEndPatternHashBufferLimitFlashMoreiRuleTimeoutOj-errld

11、eConnectioriLimit标准的虚拟服务器创建。UDP配置文件选择:yEnabledDefaull二CommonRadius-CaHingStationldSpecify.jJ|180secondsMainStatistics国LAppsDNE1v-jLocalTrafficNetworkMapVirtualServersPolitiesProfiles(RulesPodsNodesMonitorsTraffi-GCl已鼓Address-TranslationNameVlP-ISE-RadiusPsrtitier/PathCammariDescrlplionIIType|Standar

12、d/SajceAddress|0.0080DestinationAddre&s1721633.103ServicePort10pAllPortsgNotllyStatustoVirtualAddressAvailAbllkt/QAvailable(EhablMli-TMvirtualserverIsSynctxjkleStatusOff1ateEnabled二JGeneralPropertiesGeneralPropertiesi|i|AccelerallonAccelerallonDevkeManagementDevkeManagementConfflguratton:IAdvanc

13、edProto5UDP3ProtOMlProfilG(Client)|udp，Proto(x)lProfile(Server)(UseClientPrnief.该虚拟服务器使用配置池和持续时间配置文件:MainHelp1jStatistics3 31A1APP8PP8空DKSDKSILwaITrafficNetwcrkMapVirtualServersAooutLocalTrafficVirtualServers:VirtualServerList”VlP-ISE-RadiusLaadBalafttirigLaadBalafttirigDefaultPodPod-ISE-AIIjJjJDefa

14、ultPersisieiiceProfilercaHingSLaboriW-HasniW-Hasn1 1. .ntntr*mr*mFallbacKPersistenceProfileNoneUpdate验证可能使用要检查流量是否正确地被平衡radius模拟程序。发送4访问请求到与特定呼叫站点Id属性的虚拟服务器(03)地址：rootarrakis:#./radiustest.py-d03-ucisco-pKrakow123-sKrakow123-ai21:11:11:11:11:21-n4./radiustest.py-d03-

15、ucisco-pKrakow123-sKrakow123-ai21:11:11:11:11:21-n4StartingsniffingdaemonChoosenvmnet3interfaceforsniffingSniffingtrafficfromudpandsrc03andport1812SendingRadiusAccess-RequestsSendingRadiusPacketRadiuspacketdetails::27483-03:1812RadiusCode:1(Access-Request)RadiusId:17

16、9AVP0Type:1(User-Name)Value:ciscoAVP1Type:2(User-Password)Value:*AVP2Type:4(NAS-IP-Address)Value:AVP3Type:31(Calling-Station-Id)Value:21:11:11:11:11:21AVP3Type:31(Calling-Station-Id)Value:21:11:11:11:11:21SendingRadiusPacketRadiuspacketdetails:172,16.33,1:27483-172,16.33.103:1812ReceivedR

17、adiusPacketRadiuspacketdetails:172,16.33.103:1812-172,16.33,1:27483RadiusCode:2(Access-Accept)RadiusId:236AVP0Type:18Value:Hello,cisco.ThisisserveriThisisserveri.Waiting5secondsfortheresponsesFinishingsniffingthreadResults:Radius-Requestsent:4Radius-Requestsent:4Radius-Acceptreceived:4Radius-Acceptr

18、eceived:4Radius-Rejectreceived:0OtherRadiusmessagesreceived:0Finishingmainthread两个ISE服务器配置返回到达根据服务器的另外的AV对。ISE-PSN1一将返回server1的Hello消息，ISE-PSN2将返回server2的Hello消息(在ISE网络访问：ISE主机名使用等于条件)。确认另外服务器响应基于另外呼叫站点Id属性：rootarrakis:#,/radiustest,py-d03-ucisco-pKrakow123-sKrakow123-ai21:11:11:11:11:212

19、1:11:11:11:11:21-n4|grepHelloAVP0Type:18Value:Hello,cisco.Thisisserver1.AVP0Type:18Value:Hello,cisco.Thisisserver1.AVP0Type:18Value:Hello,cisco.Thisisserver1.AVP0Type:18Value:Hello,cisco.Thisisserver1.rootarrakis:#,/radiustest,py-d03-ucisco-pKrakow123-sKrakow123-ai21:11:11:11:11:2221:11:1

20、1:11:11:22-n4|grepHelloAVP0Type:18Value:Hello,cisco,Thisisserver2AVP0Type:18Value:Hello,cisco,Thisisserver2AVP0Type:18Value:Hello,cisco.Thisisserver2AVP0Type:18Value:Hello,cisco.Thisisserver2rootarrakis:#./radiustest.py-d03-ucisco-pKrakow123-sKrakow123-aiAVP0Type:18Value:Hello,cisco.Thisi

21、sserver1.AVP0Type:18Value:Hello,cisco.Thisisserver1.AVP0Type:18Value:Hello,cisco.Thisisserver1.AVP0Type:18Value:Hello,cisco.Thisisserver1.rootarrakis:#./radiustest.py-d03-ucisco-pKrakow123-sKrakow123-aiAVP0Type:18Value:Hello,cisco.Thisisserver2AVP0Type:18Value:Hello,cisco.Thisisserver2AVP

22、0Type:18Value:Hello,cisco.Thisisserver2AVP0Type:18Value:Hello,cisco.Thisisserver2在LTM池的统计信息能验证:LK*TrifkL幽A AM一K KE EIEHIEH断K K1%1%Sss/chSss/chBtfesBtfesPAZkOtKPAZkOtK仁anrMcBomfianrMcBomfiRaquax;sAaq|LiE-EtRaquax;sAaq|LiE-EtLMUQLMUQIfWIPOTInIfWIPOTInCMm m6464Cifenl1Cifenl11 1M Ml lInhMiInhMiT*T*Tdilg

23、pTdilgp出 Pcd-Ef-MPcd-Ef-M口一ximxim汩田. . .HanlMwHanlMw旧EgEg用CcmmcnCcmmcn迪SKSKComHIon24ComHIon247JK7JKcentalBiMcentalBiMI54.BI54.BK K丽R R374374374374270270270270M4M4IMIM04040 029 9? ?3M3M27Q27Q如4 40B0BQPQPC CD DLTM的持续时间缓存:root(f5)(cfg-syncStandalone)(Active)(/Common)(tmos)#Sys:PersistentConnectionsTota

24、lrecordsreturned:121:11:11:11:11:2421:11:11:11:11:24-n4|grepHelloshow/ltmpersistencepersist-recordsshow/ltmpersistencepersist-recordsuniversal32313a31313a31313a31313a31313a323432313a31313a31313a31313a31313a323403:any01:any01:any(tmm:1)值“32313a31313a31313a31313a31313a

25、3234”是ascii表示21:11:11:11:11:24持续时间条目创建与超时30秒(根据仍然存在in命令iRule)。在条目以后超时：root(f5)(cfg-syncStandalone)(Active)(/Common)(tmos)#show/ltmpersistencepersist-recordsshow/ltmpersistencepersist-recordsSys:PersistentConnectionsTotalrecordsreturned:0同样呼叫站点Id的流量也许重定向到ISE-PSN1(00)，新建的条目将创建：root(f5)(cfg-

26、syncStandalone)(Active)(/Common)(tmos)#show/ltmpersistencepersist-recordsSys:PersistentConnectionsuniversal32313a31313a31313a31313a31313a323432313a31313a31313a31313a31313a323403:any00:any00:any(tmm:1)Totalrecordsreturned:1然而对于以后30秒匹配此模式的所有流量将重定向对ISE-PSN1。RadiusCiscoA

27、V 对审计会话 idIETF呼叫站点Id属性持续时间的是最常用的。但是能也使用其他属性。与审计会话idiRule示例的CiscoAV对:whenCLIENT_ACCEPTEDbinaryscanUDP:payloadccSH32cccodeidentlenauthattr_code1attr_len1setindex22while$index$lensethsizeexpr($attr_len1-2)*2binaryscanUDP:payload$indexH$hsizeccattr_valuenext_attr_code2next_attr_len2#IfitisVendorspecific

28、atribute.if$attr_code1=26#searchforstringaudit-session-idif$attr_valuecontains61756469742d73657373696f6e2d6964”persistuie$attr_value30return)setindexexpr$index+$attr_len1setattr_len1$next_attr_len2setattr_code1$next_attr_code2匹配此的所有后续的流量将发送对ISE-PSN2(01)radius模拟程序使用再要测试：rootarrakis:#./radi

29、ustest.py-d03-ucisco-pKrakow123-sKrakow123-avi9-avt1-avvaudit-session-id=0A30276F00001225751086B9audit-session-id=0A30276F00001225751086B9-avxstring-ai21:11:11:11:11:20-n4|grepHelloAVP0Type:18Value:Hello,cisco.Thisisserver1AVP0Type:18Value:Hello,cisco.Thisisserver1AVP0Type:18Value:Hello,c

30、isco.Thisisserver1AVP0Type:18Value:Hello,cisco.Thisisserver1rootarrakis:#./radiustest.py-d03-ucisco-pKrakow123-sKrakow123-avi9-avt1-avvaudit-session-id=0A30276F00001225751086B9audit-session-id=0A30276F00001225751086B9”-avxstring-ai21:11:11:11:11:20-n4|grepHelloAVP0Type:18Value:Hello,cisco

31、.Thisisserver2AVP0Type:18Value:Hello,cisco.Thisisserver2AVP0Type:18Value:Hello,cisco.Thisisserver2AVP0Type:18Value:Hello,cisco.Thisisserver2结果两个持续时间条目创建：root(f5)(cfg-syncStandalone)(Active)(/Common)(tmos)#show/ltmpersistencepersist-recordsshow/ltmpersistencepersist-recordsSys:PersistentConnectionsun

32、iversal00000009012b61756469742d73657373696f6e2d69643d30413330323736463030303031323235373531303836423803:any00:any(tmm:1)universal00000009012b61756469742d73657373696f6e2d69643d30413330323736463030303031323235373531303836423903:any01:any(tmm:1)Totalrecordsre

33、turned:2(只要那些条目存在)，并且与同一个模式的所有后续的流量重定向到同一个ISE服务器。LTM 版本更改请注意没有建议再使用CLIENT_DATA添加持续时间规则。从版本9.4开始应该使用CLIENT_ACCEPTED:UDP虚拟服务器的事件并且RADIUS属性的更加简单的访问允许。示例：whenCLIENT_ACCEPTEDsetframed_ipRADIUS:avp8ip4setcallingRADIUS:avp31string|persistadduie$framed_ip1800persistadduie$calling1800文档陈述使用RADIUS配置文件是必要的，但是在

34、版本11.6工作，即使虚拟服务器的（VS）RADIUS配置文件设置对无。HTTP 负载均衡典型地没有需要装载CWA和其他访客流的平衡HTTP数据流。访客的重定向直接地对特定节点，不用需要使用loadbalancer。在手工访问的相反赞助商和设备门户能容易地被平衡。请读更多在被参考的非常好文档：HowToHowTo:思科和F5F5部署指南ISEISE负载均衡使用BIG-IPBIG-IP当CWA+其他访客流也许要求HTTP负载均衡，但是有方案。第三方集成是这样方案。原因是会配置与静态重定向指向同样VS（FQDN）的每纳季。访客流负载均衡是有唯一的解决方案在这样方案的高可用性。与那的挑战亲切重定向是

35、匹配与核算的RADIUS验证与HTTP会话和确保他们同样PSN的所有地产。达到两VS创建。一HTTP的，一个Radius的（验证和核算）。而不是古典持续时间会话使用概念。请注意它是需要被平衡的HTTPS流量（卸载的SSL）并且它是HTTPS流量需要到达PSN（节点）。卸载配置的SSL在下一部分被提交。一旦RADIUS验证（Access-Request）开始RadiusVS的iRule是检查执行的会话的查找是否有该呼叫站点Id属性的持续时间。如果不新条目创建。如果旧有条目使用是。对于所有随后的RADIUS信息包重新使用现有项-结果我们重定向对同一个节点。在终端是指定的IP地址Radius后有fr

36、amed-ip-address的临时核算数据包发送，条目的这次另外的会话（基于framed-ip-address）是创建的重定向对同一个节点为RADIUS流量已经选择一旦HTTP数据流接收HTTPVS的iRule是根据来源ip的执行的会话查找。上次会话（framed-ip-address）匹配和同一个节点选择RadiusVS的iRule代码:#addingpersistencebasedonCalling-Station-IDwhenLB_SELECTEDloglocal0.sessiontableentryadded:sessionadduiepersist:RADIUS:avp31”LB:

37、serveraddr#lookupandaddingpersistencebasedonFramed-IP-AddrwhenCLIENT_ACCEPTEDloglocalO.sessiontablelookupresultforcallingstationIDofRADIUS:avp31:sessionlookupuiepersist:RADIUS:avp31ifsessionlookupuiepersist:RADIUS:avp31neloglocalO.lookupmatch:sessionlookupuiepersist:RADIUS:avp31nodesessionlookupuiep

38、ersist:RADIUS:avp31loglocalO.sessiontableentryadded:sessionadduiepersist:RADIUS:avp8sessionlookupuiepersist:RADIUS:avp31HTTPVS的iRule代码：#lookupbasedonclient_addrexpectingtomatchentrycreatedbasedonFramed-IP-AddrwhenHTTP_REQUESTloglocalO.sessiontablelookupresultforwebclientofIP:client_addr:sessionlooku

39、puiepersist:IP:client_addrifsessionlookupuiepersist:IP:client_addrnenodesessionlookupuiepersist:IP:client_addr验证流发送与呼叫站点Id11:11:11:11:11:17的一测验Access-Request至1JRadiusVS#./radiustest.py-d03-ucisco-pKrakow123-scisco-ai11:11:11:11:11:17-n1结果在LTM的/var/log/ltm将记录那里是该呼叫站点Id的没有条目，并且，一旦负载均衡决策做重定向

40、对节点Rule/Common/radius:sessiontablelookupresultforcallingstationIDof11:11:11:11:11:17:Rule/Common/radius:sessiontableentryadded:persist:11:11:11:11:11:17node01所有随后的RADIUS信息包重定向对该节点。在该阶段(在客户端通过DHCP得到地址)后，framed-ip-address传送：#./radiustest.py-d03-ucisco-pKrakow123-scisco-fi172.16.3

41、3.1-ai11:11:11:11:11:17-n1LTM将记录根据正确节点选择的呼叫站点Id的那(01)-,而且个新会话条目根据framed-ip-address创建()。同一个节点(172.16.34.(101)条目选择。Rule/Common/radius:sessiontablelookupresultforcallingstationIDof11:11:11:11:11:17:01Rule/Common/radius:lookupmatch:01Rule/Common/radius:session

42、tableentryadded:01的新建的条目创建Rule/Common/radius:sessiontableentryadded:在此阶段从IP地址的任何HTTPGET请求：#curl-k03:8443触发在LTM的以下结果(流量重定向对一个匹配的节点：01):Rule/Common/http:sessiontablelookupresultforwebclientof:01同一个终端的这样Radius和HTTP数据流总是重定向对同一个节点。现

43、有项每请求刷新会话条目。默认会话条目计时器是60s。如果在此阶段新建的呼叫站点Id出现一切是由临时开始。若需要并且新建的条目能改写旧有一个。从LTM的示例日志：Rule/Common/radius:sessiontablelookupresultforcallingstationIDof11:11:11:11:11:18:Rule/Common/radius:sessiontableentryadded:Rule/Common/radius:sessiontablelookupresultforcallingstationIDof11:11:11:11:11:18:00R

44、ule/Common/radius:lookupmatch:00Rule/Common/radius:sessiontableentryadded:Rule/Common/radius:sessiontableentryadded:Rule/Common/http:sessiontablelookupresultforwebclientof:00Rule/Common/radius:sessiontablelookupresultforcallingstationIDof11:11:11:11:11:19:Rule/Common

45、/radius:sessiontableentryadded:Rule/Common/radius:sessiontablelookupresultforcallingstationIDof11:11:11:11:11:20:Rule/Common/radius:sessiontableentryadded:Rule/Common/http:sessiontablelookupresultforwebclientof:00请注意最后HTTP数据流仍然去节点00，因为没有framed-ip-address传送与呼叫站点Id值11:

46、11:11:11:11:19亦不11:11:11:11:11:20。SSL 卸载这是为HTTPS流量负载均衡要求的典型配置。以下屏幕画面被提交正参考，为了更多文档请参考正式F5指南。用于的CA证书签署PSN（和VS）导入对委托存储：MainHelpAboutStatisticsSystemSystem】DeviceCertificatesDeviceCertificates: :TrustedDeviceCertificatesTrustedDeviceCertificatesaTrustedDeviceCertificatesaTrustedDeviceCertificates也Duuicu

47、CurTFileManagement:SSLCertificateListSystemFileManagement:SSLCertificateList vipvipAboutMainMainHelpHelp& &DNSDNSCertificateKeyGeneralPropertiesGeneralPropertiesNamePartition/Pathvip.crtCommonLocalTrafficLocalTraffic周AccelerationAccelerationDeviceManagementDeviceManagementNetworkNetwork配Syst

48、emSystemConfigurationDeviceCertificatesFileManagementDiskManagementSoftwareManagementLicenseResourceProvisioningPlatformHighAvailabilityArchivesCertificateSubjeot(s),TAC|CA,CiscoCACertificatePropertiesCertificatePropertiesPublicKeyTypePublicKeySizeExpiresVersionSerialNumberSubjectIssuerEmailRSA2048b

49、itsDec1121:49:562016GMTfe:9c:3d:61:e1:31:cd:f3CommonName:Organization:Division:Locality:StateOrProvince;Country:TACTACKrakowCommonName:CAOrganizationalUnitCiscoCADivision:Locality:CiscoCAStateOrProvince:CiscoCACountry:SSL客户端配置文件创建，VS证书，并且密钥被参考。此配置文件对从客户端的SSL终端将负责MainHelpAboutAboutLocalTrafficLocalTraffic Profiles:SSL:ClientProfiles:SSL:Clienthttps-isehttps-ise睾iAppsiApps6 6DNSDNSLocalTrafficLocalTrafficNetworkMapVirtualServersPoliciesProfilesiRulesPoolsNodesMonitorsTraffcClassAddressTranslationGeneralPropertiesGeneralPropertiesNameNamePartitiontPathParentPro