init
This commit is contained in:
conetadm
375
conetadm/vpn-config/vpn-config.pl
Normal file
375
conetadm/vpn-config/vpn-config.pl
Normal file
@@ -0,0 +1,375 @@
|
||||
#!/bin/perl
|
||||
|
||||
$outside{'asa-frankfurt'} = "outside";
|
||||
$outside{'asa-hosting'} = "outside";
|
||||
$outside{'asa-vwd-1'} = "TG-TRANS";
|
||||
$outside{'asa-admin-1'} = "outside";
|
||||
$outside{'asa-voeb-1'} = "outside_Versatel";
|
||||
|
||||
$cryptomap{'asa-frankfurt'} = "CONET-Solutions_vpnmap";
|
||||
$cryptomap{'asa-hosting'} = "outside_map3";
|
||||
$cryptomap{'asa-vwd-1'} = "TG-TRANS_map0";
|
||||
$cryptomap{'asa-admin-1'} = "outside_map1";
|
||||
$cryptomap{'asa-voeb-1'} = "outside_Versatel_map2";
|
||||
|
||||
print "\n\nSite 2 Site Konfig erstellen\n\n";
|
||||
|
||||
uber ("Allgemeine Angaben");
|
||||
$kunde = eingabe ("Kundenname");
|
||||
$nr = eingabe ("Nummer (meist 1, da nur 1 Tunnel je Kunde)");
|
||||
$peers = eingabe ("Anzahl Peers (1,2)");
|
||||
if ($peers == 1 || $peers == 2) {
|
||||
$peer1 = eingabe("Peer 1");
|
||||
$psk1 = eingabe("PSK 1");
|
||||
if ($peers == 2) {
|
||||
$peer2 = eingabe("Peer 2");
|
||||
$psk2 = eingabe("PSK 2");
|
||||
}
|
||||
} else {
|
||||
ende("Nur 1 oder 2 erlaubt.", 1);
|
||||
}
|
||||
$asa = eingabe ("ASA Hostname");
|
||||
if ($outside{$asa} eq "") {
|
||||
ende ("Kein externes Interface gefunden.", 1);
|
||||
}
|
||||
ausgabe ("outside", $outside{$asa});
|
||||
if ($outside{$asa} eq "") {
|
||||
ende ("Keine crypto map gefunden.", 1);
|
||||
}
|
||||
ausgabe ("crypto map", $cryptomap{$asa});
|
||||
|
||||
$cmd = "/home/rancid/bin/clogin -f /home/rancid/.cloginrc -u \$SSHUSER -p \$SSHPASS -c 'sh run | i crypto map $cryptomap{$asa}' $asa | grep -v 'sh run' | grep -v ' interface ' | grep -o 'crypto map .* [0-9]*' | awk '{print \$4}' | sort -n | uniq | tr -d '\r' | tr '\n' ' '";
|
||||
$str = `$cmd`;
|
||||
ausgabe("Verwendete crypto map Nummern", $str);
|
||||
@used=split " ", $str;
|
||||
for ($i = 1 ; $i++ ; $i <= 2000) {
|
||||
$match=0;
|
||||
foreach (@used) {
|
||||
if ($_ == $i) {
|
||||
$match=1;
|
||||
}
|
||||
}
|
||||
$cmnr = $i;
|
||||
last if not $match;
|
||||
}
|
||||
ausgabe ("Verwende crypto map Nummer", $cmnr);
|
||||
|
||||
|
||||
$inside = eingabe ("LAN Interface");
|
||||
|
||||
|
||||
|
||||
uber ("Phase 1");
|
||||
$ike = eingabe ("IKE Version (1,2)");
|
||||
if ($ike == 1 || $ike == 2) {
|
||||
$ike = "ikev" . $ike;
|
||||
} else {
|
||||
ende("Nur 1 oder 2 erlaubt.", 1);
|
||||
}
|
||||
|
||||
$newpol = eingabe ("Neue Policy anlegen (1) oder bestehende verwenden (2)");
|
||||
if ($newpol == 1) {
|
||||
$cmd = "/home/rancid/bin/clogin -f /home/rancid/.cloginrc -u \$SSHUSER -p \$SSHPASS -c 'sh run | i $ike policy' $asa | grep -v 'sh run' | grep -o 'crypto .* policy [0-9]*' | awk '{print \$4}' | sort -n | uniq | tr '\n' ' '";
|
||||
$str = `$cmd`;
|
||||
ausgabe ("Diese Policynummern existieren", $str);
|
||||
|
||||
@used=split " ", $str;
|
||||
for ($i = 1 ; $i++ ; $i <= 2000) {
|
||||
$match=0;
|
||||
foreach (@used) {
|
||||
if ($_ == $i) {
|
||||
$match=1;
|
||||
}
|
||||
}
|
||||
$pnr = $i;
|
||||
last if not $match;
|
||||
}
|
||||
ausgabe ("Verwende Policy Nummer", $pnr);
|
||||
|
||||
#$pnr = eingabe ("Neue Policy Nummer eingeben");
|
||||
|
||||
$p1dh = eingabe ("DH Group (bspw 5, 14, 19, 20, 21)");
|
||||
$p1life = eingabe ("Lifetime in Sekunden 3600(1h), 28800(8h), 86400(24h)");
|
||||
$p1enc = eingabe ("Encryption (aes, aes-192, aes-256)");
|
||||
$p1hash = eingabe ("Hash (sha, sha256, sha384, sha512)");
|
||||
} elsif ($newpol == 2) {
|
||||
; # nicht zu tun hier
|
||||
} else {
|
||||
ende ("Nur 1 oder 2 erlaubt", 1);
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
uber ("Phase 2");
|
||||
$p2lifekb = eingabe ("Lifetime in Kilobytes (default 4608000, unlimited)");
|
||||
$p2life = eingabe ("Lifetim in Sekunden (default 28800)");
|
||||
$pfs = eingabe ("PFS verwenden (1) oder nicht (2)");
|
||||
if ($pfs == 1) {
|
||||
$pfsdh = eingabe ("DH Group (bspw 5, 14, 19, 20, 21)");
|
||||
} elsif ($pfs == 2) {
|
||||
; # nicht zu tun hier
|
||||
} else {
|
||||
ende ("Nur 1 oder 2 erlaubt", 1);
|
||||
}
|
||||
|
||||
$tsprop = "IPSec Proposal"; # ikev2
|
||||
if ($ike eq "ikev1") { $tsprop = "Transform-Set"}
|
||||
|
||||
$cmd = "/home/rancid/bin/clogin -f /home/rancid/.cloginrc -u \$SSHUSER -p \$SSHPASS -c 'sh run | i crypto ipsec $ike ipsec-proposal' $asa | grep -v 'sh run' | grep 'ipsec-proposal' | awk '{print \$5}' | sort -n | uniq | tr -d '\\r' | tr '\\n' ' '"; # ikev2
|
||||
if ($ike eq "ikev1") {
|
||||
$cmd = "/home/rancid/bin/clogin -f /home/rancid/.cloginrc -u \$SSHUSER -p \$SSHPASS -c 'sh run | i crypto ipsec $ike transform-set' $asa | grep -v 'sh run' | grep 'transform-set' | awk '{print \$5}' | sort -n | uniq | tr -d '\\r' | tr '\\n' ' '";
|
||||
} #ikev1
|
||||
$str = `$cmd`;
|
||||
ausgabe ("Diese $tsprop existieren", $str);
|
||||
|
||||
$newprop = eingabe ("Neues $tsprop (1) oder bestehendes (2)");
|
||||
if ($newprop == 1) {
|
||||
$tspropname = eingabe ("Name für neues $tsprop");
|
||||
if ($ike eq "ikev2") {
|
||||
$p2enc = eingabe ("Encryption (aes-192, aes-256, aes-gcm-192, aes-gcm-256, aes-gmac-192, aes-gmac-256)");
|
||||
$p2hash = eingabe ("Hash (sha-256, sha-384, sha-512)");
|
||||
} else {
|
||||
$p2enc = eingabe ("Encryption (esp-aes-192, esp-aes-256)");
|
||||
$p2hash = eingabe ("Hash (esp-sha-hmac)");
|
||||
}
|
||||
} elsif ($newprop == 2) {
|
||||
$tspropname = eingabe ("Welches $tsprop verwenden");
|
||||
} else {
|
||||
ende ("Nur 1 oder 2 erlaubt", 1);
|
||||
}
|
||||
|
||||
|
||||
|
||||
uber ("Keepalive");
|
||||
$keepalive = eingabe ("Keepalive verwenden (1) oder nicht (2)");
|
||||
if ($keepalive == 1) {
|
||||
$retry = eingabe ("Retry Intervall");
|
||||
$threshold = eingabe ("Threshold");
|
||||
} elsif ($keepalive == 2) {
|
||||
; # nicht zu tun hier
|
||||
} else {
|
||||
ende ("Nur 1 oder 2 erlaubt", 1);
|
||||
}
|
||||
|
||||
printf "
|
||||
! Konfiguration Start
|
||||
|
||||
";
|
||||
|
||||
|
||||
# objekte
|
||||
printf "
|
||||
! Netzwerkobjekte
|
||||
object network _CS_NO_%s_Lokal_net1
|
||||
subnet 192.168.1.0 255.255.255.0
|
||||
|
||||
object-group network _CS_NG_%s_Lokal
|
||||
network-object object _CS_NO_%s_Lokal_net1
|
||||
|
||||
object network _CS_NO_%s_Remote_net1
|
||||
subnet 192.168.2.0 255.255.255.0
|
||||
|
||||
object-group network _CS_NG_%s_Remote
|
||||
network-object object _CS_NO_%s_Remote_net1
|
||||
|
||||
", $kunde, $kunde, $kunde, $kunde, $kunde, $kunde;
|
||||
|
||||
|
||||
printf "
|
||||
! nat excemption
|
||||
nat (%s,%s) source static _CS_NG_%s_Lokal _CS_NG_%s_Lokal destination static _CS_NG_%s_Remote _CS_NG_%s_Remote no-proxy-arp route-lookup
|
||||
|
||||
", $inside, $outside{$asa}, $kunde, $kunde, $kunde, $kunde;
|
||||
|
||||
# ike policy
|
||||
if ($newpol == 1) {
|
||||
print "
|
||||
! Neue Policy";
|
||||
if ($ike eq "ikev1") {
|
||||
printf "
|
||||
crypto ikev1 policy $pnr
|
||||
authentication pre-share
|
||||
encryption $p1enc
|
||||
hash $p1hash
|
||||
group $p1dh
|
||||
lifetime $p1life
|
||||
|
||||
";
|
||||
}
|
||||
if ($ike eq "ikev2") {
|
||||
printf "
|
||||
crypto ikev2 policy $pnr
|
||||
encryption $p1enc
|
||||
integrity $p1hash
|
||||
group $p1dh
|
||||
prf $p1hash
|
||||
lifetime $p1life
|
||||
|
||||
";
|
||||
}
|
||||
} else {
|
||||
printf "
|
||||
! Bestehende %s Policies verwenden
|
||||
|
||||
", ($ike eq 'ikev1')? 'IKEv1':'IKEv2';
|
||||
}
|
||||
|
||||
# group policy 1 und 2
|
||||
printf "
|
||||
! Group %s
|
||||
group-policy %s_GroupPolicy_Tunnel-%s_Peer-1 internal
|
||||
group-policy %s_GroupPolicy_Tunnel-%s_Peer-1 attributes
|
||||
vpn-tunnel-protocol %s
|
||||
|
||||
", ($peers == 1)? 'Policy':'Policies', $kunde, $nr, $kunde, $nr, $ike;
|
||||
|
||||
printf "group-policy %s_GroupPolicy_Tunnel-%s_Peer-2 internal
|
||||
group-policy %s_GroupPolicy_Tunnel-%s_Peer-2 attributes
|
||||
vpn-tunnel-protocol %s
|
||||
|
||||
", $kunde, $nr, $kunde, $nr, $ike if ($peers == 2");
|
||||
|
||||
|
||||
# tunnel group
|
||||
if ($ike eq "ikev1") { # ikev1
|
||||
printf "
|
||||
! Tunnel %s
|
||||
tunnel-group %s type ipsec-l2l
|
||||
tunnel-group %s general-attributes
|
||||
default-group-policy %s_GroupPolicy_Tunnel-%s_Peer-1
|
||||
tunnel-group %s ipsec-attributes
|
||||
ikev1 pre-shared-key %s
|
||||
", ($peers == 1)? 'Group':'Groups', $peer1, $peer1, $kunde, $nr, $peer1, $psk1;
|
||||
|
||||
printf "isakmp keepalive threshold %s retry %s
|
||||
", $threshold, $retry if ($pfs == 1); # pfs an 1. tunnel?
|
||||
|
||||
printf "
|
||||
tunnel-group %s type ipsec-l2l
|
||||
tunnel-group %s general-attributes
|
||||
default-group-policy %s_GroupPolicy_Tunnel-%s_Peer-2
|
||||
tunnel-group %s ipsec-attributes
|
||||
ikev1 pre-shared-key %s
|
||||
", $peer2, $peer2, $kunde, $nr, $peer2, $psk2 if ($peers == 2); # 2. tunnel?
|
||||
|
||||
printf "isakmp keepalive threshold %s retry %s
|
||||
", $threshold, $retry if ($peers ==2 and $pfs == 1); # pfs an 2. tunnel?
|
||||
} else { #ikev2
|
||||
|
||||
printf "
|
||||
! Tunnel %s
|
||||
tunnel-group %s type ipsec-l2l
|
||||
tunnel-group %s general-attributes
|
||||
default-group-policy %s_GroupPolicy_Tunnel-%s_Peer-1
|
||||
tunnel-group %s ipsec-attributes
|
||||
ikev2 remote-authentication pre-shared-key %s
|
||||
ikev2 local-authentication pre-shared-key %s
|
||||
", ($peers == 1)? 'Group':'Groups', $peer1, $peer1, $kunde, $nr, $peer1, $psk1, $psk1;
|
||||
|
||||
printf "isakmp keepalive threshold %s retry %s
|
||||
", $threshold, $retry if ($pfs == 1); # pfs an 1. tunnel?
|
||||
|
||||
printf "
|
||||
tunnel-group %s type ipsec-l2l
|
||||
tunnel-group %s general-attributes
|
||||
default-group-policy %s_GroupPolicy_Tunnel-%s_Peer-2
|
||||
tunnel-group %s ipsec-attributes
|
||||
ikev2 remote-authentication pre-shared-key %s
|
||||
ikev2 local-authentication pre-shared-key %s
|
||||
", $peer2, $peer2, $kunde, $nr, $peer2, $psk2, $psk2 if ($peers == 2); # 2. tunnel?
|
||||
|
||||
printf "isakmp keepalive threshold %s retry %s
|
||||
", $threshold, $retry if ($peers == 2 and $pfs == 1); # pfs an 2. tunnel?
|
||||
|
||||
}
|
||||
print "\n";
|
||||
|
||||
printf "
|
||||
! Crypto map ACL
|
||||
access-list %s_CryptoMap_Tunnel-%s extended permit ip object-group _CS_NG_%s_Lokal object-group _CS_NG_%s_Remote
|
||||
|
||||
", $kunde, $nr, $kunde, $kunde;
|
||||
|
||||
printf "
|
||||
! Crypto map
|
||||
";
|
||||
|
||||
printf "crypto map %s %s match address %s_CryptoMap_Tunnel-%s
|
||||
", $cryptomap{$asa}, $cmnr, $kunde, $nr;
|
||||
printf "crypto map %s %s set pfs group%s
|
||||
", $cryptomap{$asa}, $cmnr, $pfsdh if ($pfs == 1);
|
||||
printf "crypto map %s %s set peer %s %s
|
||||
", $cryptomap{$asa}, $cmnr, $peer1, $peer2;
|
||||
printf "crypto map %s %s set ikev1 transform-set %s
|
||||
", $cryptomap{$asa}, $cmnr, $tspropname;
|
||||
printf "crypto map %s %s set security-association lifetime seconds %s
|
||||
", $cryptomap{$asa}, $cmnr, $p2life;
|
||||
printf "crypto map %s %s set security-association lifetime kilobytes %s
|
||||
", $cryptomap{$asa}, $cmnr, $p2lifekb;
|
||||
|
||||
|
||||
printf "
|
||||
! Konfiguration Ende
|
||||
|
||||
|
||||
! Rollback Konfiguration Start";
|
||||
|
||||
printf "
|
||||
clear configure crypto map %s %s
|
||||
clear config tunnel-group %s", $cryptomap{$asa}, $cmnr, $peer1;
|
||||
|
||||
printf "
|
||||
clear config tunnel-group %s", $peer2 if ($peers == 2);
|
||||
|
||||
printf "
|
||||
clear config group-policy %s_GroupPolicy_Tunnel-%s_Peer-1", $kunde, $nr;
|
||||
printf "
|
||||
clear config group-policy %s_GroupPolicy_Tunnel-%s_Peer-2", $kunde, $nr if ($peers == 2);
|
||||
|
||||
printf "
|
||||
clear configure access-list %s_CryptoMap_Tunnel-%s
|
||||
|
||||
|
||||
! Rollback Konfiguration Ende
|
||||
|
||||
", $kunde, $nr;
|
||||
|
||||
ende ("", 0);
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
sub eingabe {
|
||||
printf "%-60s : ", $_[0];
|
||||
$_ = <STDIN>; chomp;
|
||||
return $_;
|
||||
}
|
||||
|
||||
sub ausgabe {
|
||||
printf "%-60s : %s\n", $_[0], $_[1];
|
||||
}
|
||||
|
||||
sub uber {
|
||||
printf "\n=== %s === \n", $_[0];
|
||||
}
|
||||
|
||||
sub ende {
|
||||
print "\n$_[0]\nBye\n\n";
|
||||
exit $_[1];
|
||||
}
|
||||
Reference in New Issue
Block a user