PacketFence - BTS - PacketFence
View Issue Details
0001070PacketFencerefactoringpublic2010-09-16 13:402015-02-13 15:24
obilodeau 
obilodeau 
normalmajorN/A
closedopen 
 
 
0001070: Fake MACs (02:00:00...), authorizeMAC(..) and SNMP interface evolution
On Cisco, port-security implies a limit of 1 MAC per port dynamically learned. For packetfence to work reliably, we configure a fake MAC so that new activity triggers a security violation.

But, the above limitation is not found on all hardware anymore... which means that we register 02:00:00... and ask them to configure them in the admin guide for no valid reason.

So, we need to refactor our code so that this decision is pushed out of pfsetvlan and into specific switch modules.

Modules that don't require a 02:00... MAC:

- Extreme
- at least one of the HPs
- all Nortel
- ThreeCom::SS4500

Maybe?
- Enterasys
- Foundry
- SMCs

Need to think about and test VoIP aspect also.

Tasks:
- no more generateFakeMac() in pfsetvlan
- switch that requires a fake mac generate it when they deauth a MAC (if they don't auth)
- remove isFakeMac() in switches that didn't require a fakeMac
- change admin guide so we no longer put a fake MAC in switches which no longer requires a fake MAC
No tags attached.
Issue History
2010-09-16 13:40obilodeauNew Issue
2010-09-16 13:40obilodeauStatusnew => assigned
2010-09-16 13:40obilodeauAssigned To => obilodeau
2010-09-21 11:34obilodeauNote Added: 0001679
2010-11-19 14:25obilodeauTarget Version1.10.0 => 2.0.0
2011-01-18 09:47obilodeauTarget Version2.0.0 => 2.1.0
2011-03-03 15:15obilodeauTarget Version2.1.0 => +1
2011-03-03 15:18obilodeauTarget Version+1 => +2
2015-02-13 15:24lmunroNote Added: 0003668
2015-02-13 15:24lmunroStatusassigned => closed

Notes
(0001679)
obilodeau   
2010-09-21 11:34   
SMC doesn't need a fake MAC entry, it's confirmed.
(0003668)
lmunro   
2015-02-13 15:24   
These issues are too old to still be relevant.

Let's start anew.