Balanceamento de Link por Uuário

[Thiago_Mourao]

Balanceamento de Link por Usuário

Security Engineering Brazil

Março, 2020

Version 01

Autor:

Thiago Mourao, SE

Conteúdo

Objetivo

Limitações e Requisitos

Topologia

Scripts

Passo-a-Passo

Objetivo

Alterar a rota padrão (default route) dos usuários selecionados.

Limitações e Requisitos

• O recurso de ISP Redundancy da Check Point não pode ser utilizado junto com o recurso de PBR (Policy Based Routing)
• É necessário alterar manualmente o nome do objeto de cada usuário para corresponder à configuração do SCRIPT
• Para usar mais de 2 Links de Internet, o script precisa ser adaptado
• Para este PoC, assumimos que você já possua o recurso de IA (Identity Awareness) integrado ao AD usando WMI
• Para este PoC, estamos usando autenticação da API por chave (API Key) ao vez de Usuário/Senha
• Configuração do IA "Assume that only one user is connected per computer" precisa estar ativada

Topologia

Em nosso laboratório, estamos usando o GloudGuard VE (Virtual Edition) na R80.40 tanto no Security Gateway quanto na Manager e o VMware Workstation 12 como plataforma de virtualização.

Ambiente Virutal:

• 1 x Check Point Gateway R80.40
• 1 x Check Point Manager R80.40
• 1 x Microsoft Windows Server 2012 R2
• 3 x Windows 7 Ultimate

Ambiente Físico do Hospedeiro:

• 1 x Notebook (Windows Professional) com o VMWare Workstation 12

Scripts

FirstTimeSetup.sh

Este script irá preparar o ambiente pela primeira vez (First Time Wizard).

#!/bin/bash -f

source /opt/CPshrd-R80.40/tmp/.CPprofile.sh

#Script Directory

EXECDIR="/home/admin/PBRPerUser"

#User that will Execute the Scripts and Cron Job

EXECUSER="admin"

echo "First time setup"

echo "Creating all files and Gaia configuration"

echo "Creating Exec Directory"

mkdir $EXECDIR

echo "Creating Files"

touch $EXECDIR/PBRPerUser.log

touch $EXECDIR/PBRPerUserLink1.sh

touch $EXECDIR/PBRPerUserLink1_IPs.txt

touch $EXECDIR/PBRPerUserLink1_Table.txt

touch $EXECDIR/PBRPerUserLink1_Table_To_Compare.txt

touch $EXECDIR/PBRPerUserLink1_ToRemove.txt

touch $EXECDIR/PBRPerUserLink1_Users.txt

touch $EXECDIR/PBRPerUserLink1_Watch.sh

touch $EXECDIR/sid_c.txt

echo "Copying Scripts to $EXECDIR"

cp ./PBRPerUserLink1.sh $EXECDIR/PBRPerUserLink1.sh

cp ./PBRPerUserLink1_Watch.sh $EXECDIR/PBRPerUserLink1_Watch.sh

cp ./PBRPerUserLink1_CronJob.sh $EXECDIR/PBRPerUserLink1_CronJob.sh

echo "Change Permission"

chmod 760 $EXECDIR/PBRPerUserLink1.sh

chmod 760 $EXECDIR/PBRPerUserLink1_Watch.sh

chmod 760 $EXECDIR/PBRPerUserLink1_CronJob.sh

echo "Adding System-Startup Recurrence for PBRPerUserLink1_Watch.sh at Cron Job"

clish -c "add cron job PBRPerUserLink1_CronJob command '$EXECDIR/PBRPerUserLink1_CronJob.sh >> $EXECDIR/PBRPerUser.log 2>&1' recurrence system-startup"

if grep -q PBRPerUserLink1_Watch.sh /var/spool/cron/admin; then

    echo "Job already in Cron"

else

    echo "Creating Cron Job"

    echo "##PBRPerUser" >> /var/spool/cron/$EXECUSER

    echo "*       *       *       *       * $EXECDIR/PBRPerUserLink1_Watch.sh >> $EXECDIR/PBRPerUser.log 2>&1" >> /var/spool/cron/$EXECUSER

fi

echo "Lock Database Override"

clish -c "lock database override"

### Creating IP Reachability Detection ###

### CHANGE IP TO REFLET YOUR ON ENVIRONMENT ###

echo "Creating IP Reachability Detection"

clish -c "set ip-reachability-detection ping address 200.150.0.100 enable-ping on"

clish -c "set ip-reachability-detection ping address 200.200.0.100 enable-ping on"

### Creating Default Route HA without ISP Redundancy With ICMP Health Checking ###

### CHANGE IP TO REFLET YOUR ON ENVIRONMENT ###

echo "Creating Default Route HA without ISP Redundancy With ICMP Health Checking"

clish -c "set static-route default nexthop gateway address 200.150.0.100 priority 1 on"

clish -c "set static-route default nexthop gateway address 200.150.0.100 monitored-ip 200.150.0.100 on"

clish -c "set static-route default nexthop gateway address 200.150.0.100 monitored-ip-option fail-any"

clish -c "set static-route default nexthop gateway address 200.200.0.100 priority 2 on"

clish -c "set static-route default nexthop gateway address 200.200.0.100 monitored-ip 200.200.0.100 on"

clish -c "set static-route default nexthop gateway address 200.200.0.100 monitored-ip-option fail-any"

### Creating PBR Table ###

### CHANGE IP TO REFLET YOUR ON ENVIRONMENT ###

echo "Creating PBR Table"

clish -c "set pbr table PBRPerUserLink1 static-route default nexthop gateway address 200.200.0.100 on"

echo "Saving Config"

clish -c "save config"

 PBRPerUserLink1_Watch.sh

Esse script verificará se há alterações entre a última vez que o script foi executado e, se sim, executar o script para alterar a PBR

#!/bin/bash -f

source /opt/CPshrd-R80.40/tmp/.CPprofile.sh

#Script Directory

EXECDIR="/home/admin/PBRPerUser"

#User that will Execute the Scripts and Cron Job

EXECUSER="admin"

APIKEY="4JjIKMtzRCLx8MEs4rcRTg=="

MGMTIP="10.0.50.10"

cd $EXECDIR

echo "#### Executing PBRPerUserScript_Watch.sh at $(date -u) ####"

echo "MGMT Login"

mgmt_cli login --management $MGMTIP api-key $APIKEY > sid_c.txt

echo "Erasing PBRPerUserLink1_Users.txt file"

> PBRPerUserLink1_Users.txt

echo "Getting information from AR_PBRPerUserLink1 Object and saving on file PBRPerUserLink1_Users.txt"

mgmt_cli --management $MGMTIP -s sid_c.txt show access-role name "AR_PBRPerUserLink1" --format json | jq '.users[].name' | awk -F'_' '{gsub(/"/, "", $2); print $2}' > PBRPerUserLink1_Users.txt

echo "MGMT Logout"

mgmt_cli --management $MGMTIP -s sid_c.txt logout

echo "Erasing PBRPerUserLink1_Table.txt file"

> PBRPerUserLink1_Table.txt

echo "Creating Matrix with User and IP Information"

sort PBRPerUserLink1_Users.txt | while read a; do NAME=$a; IP=$(pdp monitor user $a | grep "Ip: " | awk -F ' ' '{print $2}'); echo "$NAME;$IP" >> PBRPerUserLink1_Table.txt; done

echo "Comparing PBRPerUserLink1_Table.txt file with previous version"

diff -q PBRPerUserLink1_Table_To_Compare.txt PBRPerUserLink1_Table.txt 1>/dev/null

if [[ $? == "0" ]]

then

  echo "No changes on PBRPerUserLink1_Table.txt file"

else

  echo "Running script $EXECDIR/PBRPerUserLink1.sh"

  sh PBRPerUserLink1.sh     

fi

echo "#### End of Execution of PBRPerUserScript_Watch.sh at $(date -u) ####"

PBRPerUserLink1.sh

Este script irá alterar a configuração da PBR no Gaia.

#!/bin/bash -f

source /opt/CPshrd-R80.40/tmp/.CPprofile.sh

#Script Directory

EXECDIR="/home/admin/PBRPerUser"

#User that will Execute the Scripts and Cron Job

EXECUSER="admin"

cd $EXECDIR

echo "#### Executing PBRPerUserScript.sh at $(date -u) ####"

echo "Lock Database Override"

clish -c "lock database override"

echo "Erasing current PBR per User"

cat PBRPerUserLink1_ToRemove.txt | while read a; do clish -c "$a"; done

echo "Erasing old PBRPerUserLink1_IPs.txt file"

> PBRPerUserLink1_IPs.txt

echo "Creating new PBRPerUserLink1_IPs.txt file"

sort PBRPerUserLink1_Users.txt | while read a; do pdp monitor user $a | grep "Ip: " | awk -F ' ' '{print $2}' >> PBRPerUserLink1_IPs.txt; done

echo "Creating PBR Match condition Based on Extracted IP Information form User"

pn=100 && cat PBRPerUserLink1_IPs.txt | while read a; do clish -c "set pbr rule priority $pn match from $a/32"; clish -c "set pbr rule priority $pn action table PBRPerUserLink1"; pn=$((pn+1)); done

echo "Erasing PBRPerUserLink1_ToRemove.txt file"

> PBRPerUserLink1_ToRemove.txt

echo "Create file to remove PBR"

pn=100 && cat PBRPerUserLink1_IPs.txt | while read a; do echo "set pbr rule priority $pn off" >> PBRPerUserLink1_ToRemove.txt; pn=$((pn+1)); done

echo "Creating copy of PBRPerUserLink1_Table.txt"

cp PBRPerUserLink1_Table.txt PBRPerUserLink1_Table_To_Compare.txt

echo "#### End of Execution of PBRPerUserScript.sh at $(date -u) ####"

PBRPerUserLink1_CronJob.sh

Esse script será chamado pelo Cron Job PBRPerUserLink1_CronJob para criar um Cron Job personalizado que será executado a cada minuto para verificar as alterações no PDP MONITOR e / ou no objeto AR_PBRPerUserLink1.

#!/bin/bash -f

source /opt/CPshrd-R80.40/tmp/.CPprofile.sh

#Script Directory

EXECDIR="/home/admin/PBRPerUser"

#User that will Execute the Scripts and Cron Job

EXECUSER="admin"

cd $EXECDIR

echo "#### Executing PBRPerUserScript.sh at $(date -u) ####"

echo "Lock Database Override"

clish -c "lock database override"

echo "Erasing current PBR per User"

cat PBRPerUserLink1_ToRemove.txt | while read a; do clish -c "$a"; done

echo "Erasing old PBRPerUserLink1_IPs.txt file"

> PBRPerUserLink1_IPs.txt

echo "Creating new PBRPerUserLink1_IPs.txt file"

sort PBRPerUserLink1_Users.txt | while read a; do pdp monitor user $a | grep "Ip: " | awk -F ' ' '{print $2}' >> PBRPerUserLink1_IPs.txt; done

echo "Creating PBR Match condition Based on Extracted IP Information form User"

pn=100 && cat PBRPerUserLink1_IPs.txt | while read a; do clish -c "set pbr rule priority $pn match from $a/32"; clish -c "set pbr rule priority $pn action table PBRPerUserLink1"; pn=$((pn+1)); done

echo "Erasing PBRPerUserLink1_ToRemove.txt file"

> PBRPerUserLink1_ToRemove.txt

echo "Create file to remove PBR"

pn=100 && cat PBRPerUserLink1_IPs.txt | while read a; do echo "set pbr rule priority $pn off" >> PBRPerUserLink1_ToRemove.txt; pn=$((pn+1)); done

echo "Creating copy of PBRPerUserLink1_Table.txt"

cp PBRPerUserLink1_Table.txt PBRPerUserLink1_Table_To_Compare.txt

echo "#### End of Execution of PBRPerUserScript.sh at $(date -u) ####"

Passo-a-Passo

• Copie os 3 (três) scripts para o Gateway

• Alterar permissão de execução do script "FirstTimeSetup.sh"

• Executar o script “FirstTimeSetup.sh”

• Verifique se o CRON JOB foi criado

OBS1: As tarefas (Cron Job) personalizadas não sobrevivem após o sistema serem reiniciados; por isso, criamos uma outra tarefa (Cron Job) para configurar novamente o tarefa (Cron Job) personalizado na inicialização.

OBS2: Se você usar o Gaia para editar a lista de tarefas programadas (Cron Job), as tarefas personalizadas serão apagadas.

OBS3: Para maiores informações sobre como alterar o serviço de Cron Job no Gaia, veja: sk77300 - How to create a scheduled job (cron job) in Gaia with frequency of less than a day

• Crie o usuário para autenticação da API

• Crie o "Access Role Object" com o nome “AR_PBRPerUserLink1” e adicione todos os usuários que você deseja rotear para o primeiro link de Internet não padrão

• Clique em cada membro do grupo e altere o nome do objeto para corresponder à seguinte estrutura PBR_ [AD_Login]

OBS: Neste exemplo, o nome original do objeto era ad_user_Anna_Smith e nós mudamos para PBR_asmith.

• Checar o arquivo de log PBRPerUser.log para ver se os scripts estão funcionando corretamente

• Checar o arquivo PBRPerUserLink1_Table.txt para ver os Usuários que realizaram Login que pertecem ao grupo (Access Role Object) AR_PBRPerUserLink1 e seus respectivos IPs.

• Checar se as respectivas regras de PBR (PBR RULES) foram criadas

 

[Thiago_Mourao]

Security Engineering Brazil

Março, 2020

Version 01

Autor:

Thiago Mourao, SE

Conteúdo

Objetivo

Limitações e Requisitos

Topologia

Scripts

Passo-a-Passo

Objetivo

Alterar a rota padrão (default route) dos usuários selecionados.

Limitações e Requisitos

• O recurso de ISP Redundancy da Check Point não pode ser utilizado junto com o recurso de PBR (Policy Based Routing)
• É necessário alterar manualmente o nome do objeto de cada usuário para corresponder à configuração do SCRIPT
• Para usar mais de 2 Links de Internet, o script precisa ser adaptado
• Para este PoC, assumimos que você já possua o recurso de IA (Identity Awareness) integrado ao AD usando WMI
• Para este PoC, estamos usando autenticação da API por chave (API Key) ao vez de Usuário/Senha
• Configuração do IA "Assume that only one user is connected per computer" precisa estar ativada

Topologia

Em nosso laboratório, estamos usando o GloudGuard VE (Virtual Edition) na R80.40 tanto no Security Gateway quanto na Manager e o VMware Workstation 12 como plataforma de virtualização.

Ambiente Virutal:

• 1 x Check Point Gateway R80.40
• 1 x Check Point Manager R80.40
• 1 x Microsoft Windows Server 2012 R2
• 3 x Windows 7 Ultimate

Ambiente Físico do Hospedeiro:

• 1 x Notebook (Windows Professional) com o VMWare Workstation 12

Scripts

FirstTimeSetup.sh

Este script irá preparar o ambiente pela primeira vez (First Time Wizard).

#!/bin/bash -f

source /opt/CPshrd-R80.40/tmp/.CPprofile.sh

#Script Directory

EXECDIR="/home/admin/PBRPerUser"

#User that will Execute the Scripts and Cron Job

EXECUSER="admin"

echo "First time setup"

echo "Creating all files and Gaia configuration"

echo "Creating Exec Directory"

mkdir $EXECDIR

echo "Creating Files"

touch $EXECDIR/PBRPerUser.log

touch $EXECDIR/PBRPerUserLink1.sh

touch $EXECDIR/PBRPerUserLink1_IPs.txt

touch $EXECDIR/PBRPerUserLink1_Table.txt

touch $EXECDIR/PBRPerUserLink1_Table_To_Compare.txt

touch $EXECDIR/PBRPerUserLink1_ToRemove.txt

touch $EXECDIR/PBRPerUserLink1_Users.txt

touch $EXECDIR/PBRPerUserLink1_Watch.sh

touch $EXECDIR/sid_c.txt

echo "Copying Scripts to $EXECDIR"

cp ./PBRPerUserLink1.sh $EXECDIR/PBRPerUserLink1.sh

cp ./PBRPerUserLink1_Watch.sh $EXECDIR/PBRPerUserLink1_Watch.sh

cp ./PBRPerUserLink1_CronJob.sh $EXECDIR/PBRPerUserLink1_CronJob.sh

echo "Change Permission"

chmod 760 $EXECDIR/PBRPerUserLink1.sh

chmod 760 $EXECDIR/PBRPerUserLink1_Watch.sh

chmod 760 $EXECDIR/PBRPerUserLink1_CronJob.sh

echo "Adding System-Startup Recurrence for PBRPerUserLink1_Watch.sh at Cron Job"

clish -c "add cron job PBRPerUserLink1_CronJob command '$EXECDIR/PBRPerUserLink1_CronJob.sh >> $EXECDIR/PBRPerUser.log 2>&1' recurrence system-startup"

if grep -q PBRPerUserLink1_Watch.sh /var/spool/cron/admin; then

    echo "Job already in Cron"

else

    echo "Creating Cron Job"

    echo "##PBRPerUser" >> /var/spool/cron/$EXECUSER

    echo "*       *       *       *       * $EXECDIR/PBRPerUserLink1_Watch.sh >> $EXECDIR/PBRPerUser.log 2>&1" >> /var/spool/cron/$EXECUSER

fi

echo "Lock Database Override"

clish -c "lock database override"

### Creating IP Reachability Detection ###

### CHANGE IP TO REFLET YOUR ON ENVIRONMENT ###

echo "Creating IP Reachability Detection"

clish -c "set ip-reachability-detection ping address 200.150.0.100 enable-ping on"

clish -c "set ip-reachability-detection ping address 200.200.0.100 enable-ping on"

### Creating Default Route HA without ISP Redundancy With ICMP Health Checking ###

### CHANGE IP TO REFLET YOUR ON ENVIRONMENT ###

echo "Creating Default Route HA without ISP Redundancy With ICMP Health Checking"

clish -c "set static-route default nexthop gateway address 200.150.0.100 priority 1 on"

clish -c "set static-route default nexthop gateway address 200.150.0.100 monitored-ip 200.150.0.100 on"

clish -c "set static-route default nexthop gateway address 200.150.0.100 monitored-ip-option fail-any"

clish -c "set static-route default nexthop gateway address 200.200.0.100 priority 2 on"

clish -c "set static-route default nexthop gateway address 200.200.0.100 monitored-ip 200.200.0.100 on"

clish -c "set static-route default nexthop gateway address 200.200.0.100 monitored-ip-option fail-any"

### Creating PBR Table ###

### CHANGE IP TO REFLET YOUR ON ENVIRONMENT ###

echo "Creating PBR Table"

clish -c "set pbr table PBRPerUserLink1 static-route default nexthop gateway address 200.200.0.100 on"

echo "Saving Config"

clish -c "save config"

 PBRPerUserLink1_Watch.sh

Esse script verificará se há alterações entre a última vez que o script foi executado e, se sim, executar o script para alterar a PBR

#!/bin/bash -f

source /opt/CPshrd-R80.40/tmp/.CPprofile.sh

#Script Directory

EXECDIR="/home/admin/PBRPerUser"

#User that will Execute the Scripts and Cron Job

EXECUSER="admin"

APIKEY="4JjIKMtzRCLx8MEs4rcRTg=="

MGMTIP="10.0.50.10"

cd $EXECDIR

echo "#### Executing PBRPerUserScript_Watch.sh at $(date -u) ####"

echo "MGMT Login"

mgmt_cli login --management $MGMTIP api-key $APIKEY > sid_c.txt

echo "Erasing PBRPerUserLink1_Users.txt file"

> PBRPerUserLink1_Users.txt

echo "Getting information from AR_PBRPerUserLink1 Object and saving on file PBRPerUserLink1_Users.txt"

mgmt_cli --management $MGMTIP -s sid_c.txt show access-role name "AR_PBRPerUserLink1" --format json | jq '.users[].name' | awk -F'_' '{gsub(/"/, "", $2); print $2}' > PBRPerUserLink1_Users.txt

echo "MGMT Logout"

mgmt_cli --management $MGMTIP -s sid_c.txt logout

echo "Erasing PBRPerUserLink1_Table.txt file"

> PBRPerUserLink1_Table.txt

echo "Creating Matrix with User and IP Information"

sort PBRPerUserLink1_Users.txt | while read a; do NAME=$a; IP=$(pdp monitor user $a | grep "Ip: " | awk -F ' ' '{print $2}'); echo "$NAME;$IP" >> PBRPerUserLink1_Table.txt; done

echo "Comparing PBRPerUserLink1_Table.txt file with previous version"

diff -q PBRPerUserLink1_Table_To_Compare.txt PBRPerUserLink1_Table.txt 1>/dev/null

if [[ $? == "0" ]]

then

  echo "No changes on PBRPerUserLink1_Table.txt file"

else

  echo "Running script $EXECDIR/PBRPerUserLink1.sh"

  sh PBRPerUserLink1.sh     

fi

echo "#### End of Execution of PBRPerUserScript_Watch.sh at $(date -u) ####"

PBRPerUserLink1.sh

Este script irá alterar a configuração da PBR no Gaia.

#!/bin/bash -f

source /opt/CPshrd-R80.40/tmp/.CPprofile.sh

#Script Directory

EXECDIR="/home/admin/PBRPerUser"

#User that will Execute the Scripts and Cron Job

EXECUSER="admin"

cd $EXECDIR

echo "#### Executing PBRPerUserScript.sh at $(date -u) ####"

echo "Lock Database Override"

clish -c "lock database override"

echo "Erasing current PBR per User"

cat PBRPerUserLink1_ToRemove.txt | while read a; do clish -c "$a"; done

echo "Erasing old PBRPerUserLink1_IPs.txt file"

> PBRPerUserLink1_IPs.txt

echo "Creating new PBRPerUserLink1_IPs.txt file"

sort PBRPerUserLink1_Users.txt | while read a; do pdp monitor user $a | grep "Ip: " | awk -F ' ' '{print $2}' >> PBRPerUserLink1_IPs.txt; done

echo "Creating PBR Match condition Based on Extracted IP Information form User"

pn=100 && cat PBRPerUserLink1_IPs.txt | while read a; do clish -c "set pbr rule priority $pn match from $a/32"; clish -c "set pbr rule priority $pn action table PBRPerUserLink1"; pn=$((pn+1)); done

echo "Erasing PBRPerUserLink1_ToRemove.txt file"

> PBRPerUserLink1_ToRemove.txt

echo "Create file to remove PBR"

pn=100 && cat PBRPerUserLink1_IPs.txt | while read a; do echo "set pbr rule priority $pn off" >> PBRPerUserLink1_ToRemove.txt; pn=$((pn+1)); done

echo "Creating copy of PBRPerUserLink1_Table.txt"

cp PBRPerUserLink1_Table.txt PBRPerUserLink1_Table_To_Compare.txt

echo "#### End of Execution of PBRPerUserScript.sh at $(date -u) ####"

PBRPerUserLink1_CronJob.sh

Esse script será chamado pelo Cron Job PBRPerUserLink1_CronJob para criar um Cron Job personalizado que será executado a cada minuto para verificar as alterações no PDP MONITOR e / ou no objeto AR_PBRPerUserLink1.

#!/bin/bash -f

source /opt/CPshrd-R80.40/tmp/.CPprofile.sh

#Script Directory

EXECDIR="/home/admin/PBRPerUser"

#User that will Execute the Scripts and Cron Job

EXECUSER="admin"

cd $EXECDIR

echo "#### Executing PBRPerUserScript.sh at $(date -u) ####"

echo "Lock Database Override"

clish -c "lock database override"

echo "Erasing current PBR per User"

cat PBRPerUserLink1_ToRemove.txt | while read a; do clish -c "$a"; done

echo "Erasing old PBRPerUserLink1_IPs.txt file"

> PBRPerUserLink1_IPs.txt

echo "Creating new PBRPerUserLink1_IPs.txt file"

sort PBRPerUserLink1_Users.txt | while read a; do pdp monitor user $a | grep "Ip: " | awk -F ' ' '{print $2}' >> PBRPerUserLink1_IPs.txt; done

echo "Creating PBR Match condition Based on Extracted IP Information form User"

pn=100 && cat PBRPerUserLink1_IPs.txt | while read a; do clish -c "set pbr rule priority $pn match from $a/32"; clish -c "set pbr rule priority $pn action table PBRPerUserLink1"; pn=$((pn+1)); done

echo "Erasing PBRPerUserLink1_ToRemove.txt file"

> PBRPerUserLink1_ToRemove.txt

echo "Create file to remove PBR"

pn=100 && cat PBRPerUserLink1_IPs.txt | while read a; do echo "set pbr rule priority $pn off" >> PBRPerUserLink1_ToRemove.txt; pn=$((pn+1)); done

echo "Creating copy of PBRPerUserLink1_Table.txt"

cp PBRPerUserLink1_Table.txt PBRPerUserLink1_Table_To_Compare.txt

echo "#### End of Execution of PBRPerUserScript.sh at $(date -u) ####"

Passo-a-Passo

• Copie os 3 (três) scripts para o Gateway

• Alterar permissão de execução do script "FirstTimeSetup.sh"

• Executar o script “FirstTimeSetup.sh”

• Verifique se o CRON JOB foi criado

OBS1: As tarefas (Cron Job) personalizadas não sobrevivem após o sistema serem reiniciados; por isso, criamos uma outra tarefa (Cron Job) para configurar novamente o tarefa (Cron Job) personalizado na inicialização.

OBS2: Se você usar o Gaia para editar a lista de tarefas programadas (Cron Job), as tarefas personalizadas serão apagadas.

OBS3: Para maiores informações sobre como alterar o serviço de Cron Job no Gaia, veja: sk77300 - How to create a scheduled job (cron job) in Gaia with frequency of less than a day

• Crie o usuário para autenticação da API

• Crie o "Access Role Object" com o nome “AR_PBRPerUserLink1” e adicione todos os usuários que você deseja rotear para o primeiro link de Internet não padrão

• Clique em cada membro do grupo e altere o nome do objeto para corresponder à seguinte estrutura PBR_ [AD_Login]

OBS: Neste exemplo, o nome original do objeto era ad_user_Anna_Smith e nós mudamos para PBR_asmith.

• Checar o arquivo de log PBRPerUser.log para ver se os scripts estão funcionando corretamente

• Checar o arquivo PBRPerUserLink1_Table.txt para ver os Usuários que realizaram Login que pertecem ao grupo (Access Role Object) AR_PBRPerUserLink1 e seus respectivos IPs.

• Checar se as respectivas regras de PBR (PBR RULES) foram criadas