# 03 - Configuration

## **1) Topologie réseau Wi-Fi**

<span style="font-family: Arial, serif;"><span style="font-size: small;">L'infrastructure Wi-Fi est isolée du réseau de production via le VLAN 40. Le tableau suivant récapitule l'adressage réseau utilisé :</span></span>

<table border="1" cellpadding="5" cellspacing="0" id="bkmrk-%C3%89l%C3%A9ment-vlan-adresse" style="border-collapse: collapse; width: 602px; height: 237.578px; border-spacing: 0px; border-color: #000000; border-style: solid;" width="602"><colgroup><col width="156"></col> <col width="157"></col> <col width="123"></col> <col width="124"></col> </colgroup><thead><tr style="height: 35.7969px;"><td bgcolor="#2e4a7a" style="height: 35.7969px; border-color: rgb(0, 0, 0);" width="156"><span style="color: #ffffff;"><span style="font-family: Arial, serif;"><span style="font-size: small;">**Élément**</span></span></span>

</td><td bgcolor="#2e4a7a" style="height: 35.7969px; border-color: rgb(0, 0, 0);" width="157"><span style="color: #ffffff;"><span style="font-family: Arial, serif;"><span style="font-size: small;">**VLAN**</span></span></span>

</td><td bgcolor="#2e4a7a" style="height: 35.7969px; border-color: rgb(0, 0, 0);" width="123"><span style="color: #ffffff;"><span style="font-family: Arial, serif;"><span style="font-size: small;">**Adresse IP**</span></span></span>

</td><td bgcolor="#2e4a7a" style="height: 35.7969px; border-color: rgb(0, 0, 0);" width="124"><span style="color: #ffffff;"><span style="font-family: Arial, serif;"><span style="font-size: small;">**Masque**</span></span></span>

</td></tr></thead><tbody><tr style="height: 35.7969px;"><td bgcolor="#ffffff" style="height: 35.7969px; border-color: rgb(0, 0, 0);" width="156"><span style="font-family: Arial, serif;"><span style="font-size: small;">WAP150 (gestion)</span></span>

</td><td bgcolor="#ffffff" style="height: 35.7969px; border-color: rgb(0, 0, 0);" width="157"><span style="font-family: Arial, serif;"><span style="font-size: small;">VLAN 40</span></span>

</td><td bgcolor="#ffffff" style="height: 35.7969px; border-color: rgb(0, 0, 0);" width="123"><span style="font-family: Arial, serif;"><span style="font-size: small;">192.168.10.198</span></span>

</td><td bgcolor="#ffffff" style="height: 35.7969px; border-color: rgb(0, 0, 0);" width="124"><span style="font-family: Arial, serif;"><span style="font-size: small;">/27</span></span>

</td></tr><tr style="height: 35.7969px;"><td bgcolor="#f2f2f2" style="height: 35.7969px; border-color: rgb(0, 0, 0);" width="156"><span style="font-family: Arial, serif;"><span style="font-size: small;">Réseau VLAN 40</span></span>

</td><td bgcolor="#f2f2f2" style="height: 35.7969px; border-color: rgb(0, 0, 0);" width="157"><span style="font-family: Arial, serif;"><span style="font-size: small;">VLAN 40</span></span>

</td><td bgcolor="#f2f2f2" style="height: 35.7969px; border-color: rgb(0, 0, 0);" width="123"><span style="font-family: Arial, serif;"><span style="font-size: small;">192.168.10.192</span></span>

</td><td bgcolor="#f2f2f2" style="height: 35.7969px; border-color: rgb(0, 0, 0);" width="124"><span style="font-family: Arial, serif;"><span style="font-size: small;">/27</span></span>

</td></tr><tr style="height: 35.7969px;"><td bgcolor="#ffffff" style="height: 35.7969px; border-color: rgb(0, 0, 0);" width="156"><span style="font-family: Arial, serif;"><span style="font-size: small;">Passerelle VLAN 40</span></span>

</td><td bgcolor="#ffffff" style="height: 35.7969px; border-color: rgb(0, 0, 0);" width="157"><span style="font-family: Arial, serif;"><span style="font-size: small;">VLAN 40</span></span>

</td><td bgcolor="#ffffff" style="height: 35.7969px; border-color: rgb(0, 0, 0);" width="123"><span style="font-family: Arial, serif;"><span style="font-size: small;">192.168.10.194</span></span>

</td><td bgcolor="#ffffff" style="height: 35.7969px; border-color: rgb(0, 0, 0);" width="124"><span style="font-family: Arial, serif;"><span style="font-size: small;">/27</span></span>

</td></tr><tr style="height: 58.5938px;"><td bgcolor="#f2f2f2" style="height: 58.5938px; border-color: rgb(0, 0, 0);" width="156"><span style="font-family: Arial, serif;"><span style="font-size: small;">Plage DHCP visiteurs</span></span>

</td><td bgcolor="#f2f2f2" style="height: 58.5938px; border-color: rgb(0, 0, 0);" width="157"><span style="font-family: Arial, serif;"><span style="font-size: small;">VLAN 40</span></span>

</td><td bgcolor="#f2f2f2" style="height: 58.5938px; border-color: rgb(0, 0, 0);" width="123"><span style="font-family: Arial, serif;"><span style="font-size: small;">192.168.10.196 – .222</span></span>

</td><td bgcolor="#f2f2f2" style="height: 58.5938px; border-color: rgb(0, 0, 0);" width="124"><span style="font-family: Arial, serif;"><span style="font-size: small;">/27</span></span>

</td></tr><tr style="height: 35.7969px;"><td bgcolor="#ffffff" style="height: 35.7969px; border-color: rgb(0, 0, 0);" width="156"><span style="font-family: Arial, serif;"><span style="font-size: small;">Port switch</span></span>

</td><td bgcolor="#ffffff" style="height: 35.7969px; border-color: rgb(0, 0, 0);" width="157"><span style="font-family: Arial, serif;"><span style="font-size: small;">Fa0/23 (trunk)</span></span>

</td><td bgcolor="#ffffff" style="height: 35.7969px; border-color: rgb(0, 0, 0);" width="123">—

</td><td bgcolor="#ffffff" style="height: 35.7969px; border-color: rgb(0, 0, 0);" width="124">—

</td></tr></tbody></table>

<span style="font-family: Arial, serif;"><span style="font-size: small;">Le port Fa0/23 du switch Cisco est configuré en mode trunk et autorise le VLAN 40 ainsi que le VLAN natif. Le DHCP snooping est activé sur ce port en mode trusted pour autoriser les réponses DHCP provenant du serveur.</span></span>

## **2) Configuration du réseau sans fil (SSID)**

<table border="1" cellpadding="5" cellspacing="0" id="bkmrk-param%C3%A8tre-valeur-con" style="border-collapse: collapse; width: 602px; border-width: 1px; border-spacing: 0px; border-color: #000000; border-style: solid;" width="602"><colgroup><col width="222"></col> <col width="357"></col> </colgroup><thead><tr><td bgcolor="#2e4a7a" style="border-color: rgb(0, 0, 0);" width="222"><span style="color: #ffffff;"><span style="font-family: Arial, serif;"><span style="font-size: small;">**Paramètre**</span></span></span>

</td><td bgcolor="#2e4a7a" style="border-color: rgb(0, 0, 0);" width="357"><span style="color: #ffffff;"><span style="font-family: Arial, serif;"><span style="font-size: small;">**Valeur configurée**</span></span></span>

</td></tr></thead><tbody><tr><td bgcolor="#ffffff" style="border-color: rgb(0, 0, 0);" width="222"><span style="font-family: Arial, serif;"><span style="font-size: small;">Nom du réseau (SSID)</span></span>

</td><td bgcolor="#ffffff" style="border-color: rgb(0, 0, 0);" width="357"><span style="font-family: Arial, serif;"><span style="font-size: small;">Visiteurs-IRS</span></span>

</td></tr><tr><td bgcolor="#f2f2f2" style="border-color: rgb(0, 0, 0);" width="222"><span style="font-family: Arial, serif;"><span style="font-size: small;">Diffusion du SSID</span></span>

</td><td bgcolor="#f2f2f2" style="border-color: rgb(0, 0, 0);" width="357"><span style="font-family: Arial, serif;"><span style="font-size: small;">Activée</span></span>

</td></tr><tr><td bgcolor="#ffffff" style="border-color: rgb(0, 0, 0);" width="222"><span style="font-family: Arial, serif;"><span style="font-size: small;">VLAN associé</span></span>

</td><td bgcolor="#ffffff" style="border-color: rgb(0, 0, 0);" width="357"><span style="font-family: Arial, serif;"><span style="font-size: small;">VLAN 40</span></span>

</td></tr><tr><td bgcolor="#f2f2f2" style="border-color: rgb(0, 0, 0);" width="222"><span style="font-family: Arial, serif;"><span style="font-size: small;">Bande de fréquence</span></span>

</td><td bgcolor="#f2f2f2" style="border-color: rgb(0, 0, 0);" width="357"><span style="font-family: Arial, serif;"><span style="font-size: small;">2,4 GHz</span></span>

</td></tr><tr><td bgcolor="#ffffff" style="border-color: rgb(0, 0, 0);" width="222"><span style="font-family: Arial, serif;"><span style="font-size: small;">Standard</span></span>

</td><td bgcolor="#ffffff" style="border-color: rgb(0, 0, 0);" width="357"><span style="font-family: Arial, serif;"><span style="font-size: small;">802.11b/g/n</span></span>

</td></tr><tr><td bgcolor="#f2f2f2" style="border-color: rgb(0, 0, 0);" width="222"><span style="font-family: Arial, serif;"><span style="font-size: small;">Canal</span></span>

</td><td bgcolor="#f2f2f2" style="border-color: rgb(0, 0, 0);" width="357"><span style="font-family: Arial, serif;"><span style="font-size: small;">Auto (sélection automatique)</span></span>

</td></tr><tr><td bgcolor="#ffffff" style="border-color: rgb(0, 0, 0);" width="222"><span style="font-family: Arial, serif;"><span style="font-size: small;">Puissance d'émission</span></span>

</td><td bgcolor="#ffffff" style="border-color: rgb(0, 0, 0);" width="357"><span style="font-family: Arial, serif;"><span style="font-size: small;">100 % (pleine puissance)</span></span>

</td></tr><tr><td bgcolor="#f2f2f2" style="border-color: rgb(0, 0, 0);" width="222"><span style="font-family: Arial, serif;"><span style="font-size: small;">Isolation clients</span></span>

</td><td bgcolor="#f2f2f2" style="border-color: rgb(0, 0, 0);" width="357"><span style="font-family: Arial, serif;"><span style="font-size: small;">Activée (clients isolés entre eux)</span></span>

</td></tr><tr><td bgcolor="#ffffff" style="border-color: rgb(0, 0, 0);" width="222"><span style="font-family: Arial, serif;"><span style="font-size: small;">Chiffrement</span></span>

</td><td bgcolor="#ffffff" style="border-color: rgb(0, 0, 0);" width="357"><span style="font-family: Arial, serif;"><span style="font-size: small;">WPA2 Personal </span></span>

</td></tr></tbody></table>

  
Le SSID Visiteurs-IRS est dédié aux accès des visiteurs et invités. L'isolation des clients est activée afin d'empêcher toute communication directe entre les postes connectés au Wi-Fi. Seul l'accès à travers le portail captif NoDogSplash est autorisé.

#### **Affectation VLAN sur l'interface réseau**

L'interface Ethernet du WAP150 est configurée en mode trunk pour transporter à la fois le VLAN de gestion (VLAN 99) et le VLAN visiteurs (VLAN 40).

**Configuration trunk côté switch (port Fa0/23)**

```
Switch(config)# interface FastEthernet0/23
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk allowed vlan 40,99
Switch(config-if)# ip dhcp snooping trust
Switch(config-if)# spanning-tree portfast
```

#### **Configuration VLAN côté WAP150**

Dans l'interface web du WAP150, les paramètres VLAN sont accessibles via le menu Advanced &gt; VLAN &amp; Radio Settings. Le SSID Visiteurs-IRS est associé au VLAN 40.

#### **Intégration du portail captif NoDogSplash**

Le portail captif NoDogSplash est déployé sur une machine virtuelle Debian 12 hébergée sur Proxmox. Cette VM joue le rôle de passerelle pour le VLAN 40 et intercepte les requêtes HTTP des clients Wi-Fi pour les rediriger vers une page d'authentification.

<table border="1" cellpadding="5" cellspacing="0" id="bkmrk-%C3%89l%C3%A9ment-d%C3%A9tail-os-de" style="border-collapse: collapse; width: 602px; border-spacing: 0px; border-color: #000000; border-style: solid;" width="602"><colgroup><col width="189"></col> <col width="391"></col> </colgroup><thead><tr><td bgcolor="#2e4a7a" style="border-color: rgb(0, 0, 0);" width="189"><span style="color: #ffffff;"><span style="font-family: Arial, serif;"><span style="font-size: small;">**Élément**</span></span></span>

</td><td bgcolor="#2e4a7a" style="border-color: rgb(0, 0, 0);" width="391"><span style="color: #ffffff;"><span style="font-family: Arial, serif;"><span style="font-size: small;">**Détail**</span></span></span>

</td></tr></thead><tbody><tr><td bgcolor="#ffffff" style="border-color: rgb(0, 0, 0);" width="189"><span style="font-family: Arial, serif;"><span style="font-size: small;">OS de la VM</span></span>

</td><td bgcolor="#ffffff" style="border-color: rgb(0, 0, 0);" width="391"><span style="font-family: Arial, serif;"><span style="font-size: small;">Debian 12 (Bookworm)</span></span>

</td></tr><tr><td bgcolor="#f2f2f2" style="border-color: rgb(0, 0, 0);" width="189"><span style="font-family: Arial, serif;"><span style="font-size: small;">Interface LAN (VLAN 99)</span></span>

</td><td bgcolor="#f2f2f2" style="border-color: rgb(0, 0, 0);" width="391"><span style="font-family: Arial, serif;"><span style="font-size: small;">ens18 — accès gestion / supervision</span></span>

</td></tr><tr><td bgcolor="#ffffff" style="border-color: rgb(0, 0, 0);" width="189"><span style="font-family: Arial, serif;"><span style="font-size: small;">Interface Wi-Fi (VLAN 40)</span></span>

</td><td bgcolor="#ffffff" style="border-color: rgb(0, 0, 0);" width="391"><span style="font-family: Arial, serif;"><span style="font-size: small;">ens19 — 192.168.10.194/27</span></span>

</td></tr><tr><td bgcolor="#f2f2f2" style="border-color: rgb(0, 0, 0);" width="189"><span style="font-family: Arial, serif;"><span style="font-size: small;">Logiciel portail captif</span></span>

</td><td bgcolor="#f2f2f2" style="border-color: rgb(0, 0, 0);" width="391"><span style="font-family: Arial, serif;"><span style="font-size: small;">NoDogSplash (sources GitHub)</span></span>

</td></tr><tr><td bgcolor="#ffffff" style="border-color: rgb(0, 0, 0);" width="189"><span style="font-family: Arial, serif;"><span style="font-size: small;">Port d'écoute</span></span>

</td><td bgcolor="#ffffff" style="border-color: rgb(0, 0, 0);" width="391"><span style="font-family: Arial, serif;"><span style="font-size: small;">TCP 2050</span></span>

</td></tr><tr><td bgcolor="#f2f2f2" style="border-color: rgb(0, 0, 0);" width="189"><span style="font-family: Arial, serif;"><span style="font-size: small;">Démarrage</span></span>

</td><td bgcolor="#f2f2f2" style="border-color: rgb(0, 0, 0);" width="391"><span style="font-family: Arial, serif;"><span style="font-size: small;">Service systemd (nodogsplash.service)</span></span>

</td></tr></tbody></table>

Le flux d'un client visiteur se déroule comme suit : le poste obtient une adresse IP du DHCP du VLAN 40, puis toutes ses requêtes HTTP sont interceptées par NoDogSplash et redirigées vers le portail de connexion. Après validation sur la page d'accueil, l'accès au réseau est autorisé.