📦 Livrable 1 : Fichier .gns3

Topologie GNS3/EVE-NG : switch + AP (+ client WiFi simulé).

{
  "name": "TP_WiFi_Pro_VLANs",
  "version": "2.2.0",
  "topology": {
    "nodes": [
      {"node_id": "sw1", "name": "Switch_VLANs", "node_type": "ethernet_switch", "x": 200, "y": 200, "properties": {"ethernet_ports": 24}},
      {"node_id": "ap", "name": "AP_WiFi", "node_type": "qemu", "x": 0, "y": 100, "properties": {"image": "openwrt-22.03.3-x86-64-generic-ext4-combined.img"}},
      {"node_id": "client1", "name": "Client_CORPO", "node_type": "vpcs", "x": -150, "y": 0},
      {"node_id": "client2", "name": "Client_INVITES", "node_type": "vpcs", "x": -150, "y": 100},
      {"node_id": "client3", "name": "Client_IOT", "node_type": "vpcs", "x": -150, "y": 200},
      {"node_id": "fw", "name": "Firewall", "node_type": "qemu", "x": 400, "y": 200, "properties": {"image": "pfSense-2.6.0.iso"}}
    ],
    "links": [
      {"nodes": [{"node_id": "ap","port":0},{"node_id": "sw1","adapter":0,"port":24}]},
      {"nodes": [{"node_id": "sw1","adapter":0,"port":1},{"node_id": "fw","adapter":0,"port":0}]}
    ]
  }
}

🐍 Livrable 2 : Script Python

Scanner WiFi + test isolation (ping entre clients du même SSID).

Installation : pip install colorama wifi

Utilisation : python3 wifi_tester.py --menu

#!/usr/bin/env python3
# wifi_tester.py - Testeur d'isolation WiFi

import subprocess, sys, argparse, socket
from datetime import datetime
try:
    from colorama import init, Fore, Style
    init()
except:
    class Fore: RED=GREEN=YELLOW=CYAN=RESET=''

class WiFiTester:
    def __init__(self):
        self.results = []
        self.config = {
            "ssids": ["SSID_CORPO", "SSID_STAFF", "SSID_INVITES", "SSID_IOT"],
            "vlans": {
                "CORPO": {"ip": "10.0.10.10", "gateway": "10.0.10.254"},
                "STAFF": {"ip": "10.0.20.10", "gateway": "10.0.20.254"},
                "INVITES": {"ip": "10.0.30.10", "gateway": "10.0.30.254"},
                "IOT": {"ip": "10.0.40.10", "gateway": "10.0.40.254"}
            }
        }
    
    def ping(self, ip, count=2):
        param = '-n' if sys.platform.lower().startswith('win') else '-c'
        try:
            r = subprocess.run(['ping', param, str(count), '-W', '2', ip], capture_output=True)
            return r.returncode == 0
        except:
            return False
    
    def scan_wifi(self):
        """Scan des réseaux WiFi disponibles"""
        print(f"{Fore.CYAN}📡 Scan des SSID...{Fore.RESET}")
        # Sous Linux
        result = subprocess.run(['iwlist', 'wlan0', 'scan'], capture_output=True, text=True)
        for ssid in self.config["ssids"]:
            if ssid in result.stdout:
                print(f"  {Fore.GREEN}✓{Fore.RESET} {ssid} détecté")
            else:
                print(f"  {Fore.RED}✗{Fore.RESET} {ssid} NON détecté")
    
    def test_isolation(self):
        """Teste si les clients WiFi peuvent se ping entre eux"""
        print(f"\n{Fore.CYAN}🔒 Test d'isolation entre clients WiFi...{Fore.RESET}")
        
        # Test intra-SSID (isolation)
        guests = ["10.0.30.11", "10.0.30.12"]  # Deux clients guest
        if self.ping(guests[1]):
            print(f"  {Fore.RED}✗{Fore.RESET} Client Guest → Guest: CONNEXION (Client Isolation DEVRAIT bloquer)")
        else:
            print(f"  {Fore.GREEN}✓{Fore.RESET} Client Guest → Guest: ISOLATION OK")
    
    def test_intervlan(self):
        """Teste la connectivité inter-VLAN"""
        print(f"\n{Fore.CYAN}🌐 Test inter-VLAN...{Fore.RESET}")
        tests = [
            ("CORPO", "STAFF", "ALLOW"),
            ("STAFF", "CORPO", "BLOCK"),
            ("INVITES", "CORPO", "BLOCK"),
            ("INVITES", "8.8.8.8", "ALLOW"),
            ("IOT", "8.8.8.8", "BLOCK")
        ]
        for src_name, dst, expected in tests:
            if dst in self.config["vlans"]:
                dst_ip = self.config["vlans"][dst]["ip"]
            else:
                dst_ip = dst
            src_ip = self.config["vlans"][src_name]["ip"]
            result = self.ping(dst_ip)
            passed = (result and expected=="ALLOW") or (not result and expected=="BLOCK")
            status = f"{Fore.GREEN}✓{Fore.RESET}" if passed else f"{Fore.RED}✗{Fore.RESET}"
            self.results.append({"src": src_name, "dst": dst, "result": result, "passed": passed})
            print(f"  {status} {src_name} → {dst}: {'SUCCÈS' if result else 'ÉCHEC'} (attendu: {expected})")
    
    def html_report(self, filename="wifi_report.html"):
        passed = sum(1 for r in self.results if r['passed'])
        total = len(self.results)
        score = (passed/total)*100 if total>0 else 0
        html = f"""

📊 Rapport WiFi / Isolation VLAN
Date: {datetime.now()}
Score: {score:.1f}% ({passed}/{total})
"""
        for r in self.results:
            html += f""
            html += f""
        html += "
Source
Destination
Résultat
Statut
{r['src']}
{r['dst']}
{'SUCCÈS' if r['result'] else 'ÉCHEC'}
{'✅ OK' if r['passed'] else '❌ ÉCHEC'}
Généré par WiFi Tester | CyberRéseau Pro

"
        with open(filename, 'w', encoding='utf-8') as f:
            f.write(html)
        print(f"{Fore.GREEN}📄 Rapport généré: {filename}{Fore.RESET}")
    
    def menu(self):
        while True:
            print(f"\n{Fore.CYAN}════════════════════════════════════════╗{Fore.RESET}")
            print(f"{Fore.CYAN}           TESTEUR WIFI / ISOLATION{Fore.RESET}")
            print(f"{Fore.CYAN}════════════════════════════════════════╝{Fore.RESET}")
            print("1. 📡 Scanner les SSID")
            print("2. 🔒 Tester isolation client")
            print("3. 🌐 Tester inter-VLAN")
            print("4. 📄 Générer rapport HTML")
            print("5. 🚪 Quitter")
            choice = input(f"{Fore.YELLOW}Votre choix : {Fore.RESET}")
            if choice == '1': self.scan_wifi()
            elif choice == '2': self.test_isolation()
            elif choice == '3': self.test_intervlan()
            elif choice == '4':
                if self.results: self.html_report()
                else: print("Lancez d'abord les tests")
            elif choice == '5': break

if __name__ == "__main__":
    tester = WiFiTester()
    if len(sys.argv) > 1 and '--menu' in sys.argv:
        tester.menu()
    else:
        tester.scan_wifi()
        tester.test_isolation()
        tester.test_intervlan()
        tester.html_report()

🔧 Livrable 3 : Script Bash

Diagnostic WiFi : scan, état interfaces, isolation, checklist.

Utilisation : chmod +x diagnostic_wifi.sh && ./diagnostic_wifi.sh --all

#!/bin/bash
RAPPORT="wifi_diag_$(date +%Y%m%d_%H%M%S).txt"
GREEN='\033[0;32m'; RED='\033[0;31m'; YELLOW='\033[1;33m'; CYAN='\033[0;36m'; NC='\033[0m'

log() { echo -e "$1" | tee -a "$RAPPORT"; }
log_header() { echo ""; log "${CYAN}═══════════════════════════════════════${NC}"; log "$1"; log "${CYAN}═══════════════════════════════════════${NC}"; }

check_wifi_interfaces() {
    log_header "Interfaces WiFi"
    iwconfig 2>/dev/null | tee -a "$RAPPORT"
    if command -v nmcli &>/dev/null; then
        nmcli device status | tee -a "$RAPPORT"
    fi
}

scan_ssids() {
    log_header "SSID détectés"
    sudo iwlist wlan0 scan 2>/dev/null | grep -E "ESSID|Quality" | tee -a "$RAPPORT"
}

test_isolation() {
    log_header "Test isolation clients WiFi"
    # Simule un ping entre deux clients du même SSID
    # À adapter selon votre infrastructure
    log "Vérification manuelle requise: connectez deux clients au SSID_INVITES"
    log "Ping entre eux doit échouer si Client Isolation activé"
}

check_vlans() {
    log_header "VLANs sur le switch AP"
    if command -v show &>/dev/null; then
        show vlan brief 2>/dev/null | tee -a "$RAPPORT"
    fi
    ip -d link show | grep -E "vlan|@|type vlan" | tee -a "$RAPPORT"
}

checklist() {
    log_header "CHECKLIST WIFI PRO"
    cat >> "$RAPPORT" << 'EOF'
□ 1. VLANs créés sur le switch (10,20,30,40)
□ 2. Trunk vers AP configuré (allowed vlan)
□ 3. SSID créés sur le point d'accès
□ 4. VLAN mapping des SSID correct
□ 5. Client Isolation activé pour SSID_INVITES
□ 6. Limitation débit configurée (5 Mbps guest, 2 Mbps IOT)
□ 7. Règles firewall bloquant Guest → LAN
□ 8. Règles firewall autorisant Guest → Internet (80,443)
□ 9. Pas d'accès Internet pour IOT
□ 10. Tests de connectivité validés
EOF
    cat "$RAPPORT" | tail -15
}

auto_mode() {
    log_header "DIAGNOSTIC WIFI AUTOMATIQUE"
    check_wifi_interfaces
    scan_ssids
    check_vlans
    checklist
    echo -e "${GREEN}✓ Rapport sauvegardé: $RAPPORT${NC}"
}

show_menu() {
    echo ""; echo -e "${CYAN}═══════════════════════════════════════${NC}"
    echo -e "         DIAGNOSTIC WIFI / ISOLATION"
    echo -e "${CYAN}═══════════════════════════════════════${NC}"
    echo "1. 🔍 Diagnostic complet"
    echo "2. 📡 Scanner SSID"
    echo "3. 🌐 Vérifier VLANs"
    echo "4. 📋 Afficher checklist"
    echo "5. 🚪 Quitter"
    echo -n "Votre choix : "
}

if [ "$1" == "--all" ] || [ "$1" == "-a" ]; then
    auto_mode
else
    while true; do
        show_menu; read choice
        case $choice in
            1) auto_mode ;;
            2) scan_ssids | tee -a "$RAPPORT" ;;
            3) check_vlans | tee -a "$RAPPORT" ;;
            4) checklist ;;
            5) echo -e "${GREEN}Au revoir !${NC}"; exit 0 ;;
            *) echo -e "${RED}Choix invalide${NC}" ;;
        esac
    done
fi