5 * python-django-extensions
10 * python-django-celery
12 * python-paramiko (>= 1.7.7.1)
14 * python-django-registration
22 * apache2-shibboleth : The server should be setup as a Shibboleth SP
23 * The tool requires an event supporting web server. It is suggested to deploy gunicorn
24 * If you wish to link your own db tables (peers, networks, etc) with the tool, prefer MySQL MyISAM db engine and use views.
29 Firewall on Demand applies, via Netconf, flow rules to a network device. These rules are then propagated via e-bgp to peering routers.
30 Each user is authenticated against shibboleth. Authorization is performed via a combination of a Shibboleth attribute and the peer network
31 address range that the user originates from.
33 - web server (gunicorn): server the tool to localhost:port and allows for events
34 - memcached: Caches devices information and aids in syncing
35 - gunicorn/beanstalk: Job queue that applies firewall rules in a serial manner to avoid locks
38 3. Operational requirements
40 * Shibboleth authentication
41 - Required shibboleth attributes:
43 - HTTP_SHIB_HOMEORGANIZATION
44 - HTTP_SHIB_INETORGPERSON_MAIL
45 - An appropriate HTTP_SHIB_EP_ENTITLEMENT
46 - Optional Attributes:
47 - HTTP_SHIB_INETORGPERSON_GIVENNAME
48 - HTTP_SHIB_PERSON_SURNAME
49 * A valid domain name in peer table (passed through HTTP_SHIB_HOMEORGANIZATION)
52 4. Installation Procedure
55 Configure and setup celeryd, memcached, beanstalkd, web server (gunicorn mode: django), apache
56 Copy settings.py.dist to settings.py and urls.py.dist to urls.py.
57 In settings.py set the following according to your configuration:
58 * DATABASES (to point to your local database). You could use views instead of tables for models: peer, peercontacts, peernetworks. For this to work we suggest MySQL with MyISAM db engine
59 * STATIC_URL (static media directory)
62 * NETCONF_DEVICE (tested with Juniper EX4200 but any BGP enabled Juniper should work)
63 * NETCONF_USER (enable ssh and netconf on device)
65 * BROKER_HOST (beanstalk host)
66 * BROKER_PORT (beanstalk port)
68 * EMAIL_SUBJECT_PREFIX
69 * BROKER_URL (beanstalk url)
70 * SHIB_AUTH_ENTITLEMENT (if you go for Shibboleth authentication)
71 * NOTIFY_ADMIN_MAILS (bcc mail addresses)
72 * PROTECTED_SUBNETS (subnets for which source or destination address will prevent rule creation and notify the NOTIFY_ADMIN_MAILS)
80 to create all the necessary tables in the database. Enable the admin account to insert initial data for peers and their contact info.
81 * Then to allow for south migrations:
83 * If you have properly set the primary and alternate whois servers you could go for:
84 ./manage.py fetch_networks
85 to automatically fill network info.
86 Alternatively you could fill those info manually via the admin interface.
87 * Via the admin interface, modify as required the existing (example.com) Site instance
88 * Modify flatpages to suit your needs
89 * Once Apache proxying and shibboleth modules are properly setup, login to the tool. If shibboleth SP is properly setup you should see a user pending activation message and an activation email should arrive at the NOTIFY_ADMIN_MAILS accounts.