*已解决*实现ipsec规则的PowerShell脚本

Question

我正在对本地IT基础设施中的问题进行故障排除。不久前，一个GPO被推送，它阻止了从我们的IT管理程序到我们的生产设备的流量。

长话短说，大公司做出了一个错误的决定，错误地影响了我们部门非常具体的IT需求/设计。

由于纯粹的巧合，我们设法解决了这个问题，通过在设备上手动添加IPSEC安全异常来解决不同的问题。

现在，下面我试图创建PS命令的不可靠尝试只是一个基础，因为正确的参数仍然需要在与业务和IT的多个方面会面后决定。

但是为了减少我需要在数百个设备上实现解决方案的时间，我想让一个脚本工作，当我收到"go“这个词时，我只需要添加或调整参数。

我需要下面的命令与我们所有设备的输入(列表/数组)一起使用。我正在研究CimSession cmdlet，但我很难想出一个解决方案来遍历列表/数组，并将目标计算机及其IP地址添加到脚本中。

提前感谢您关于如何继续操作的提示。

通过下面的响应，我将脚本扩展为以下内容：

    ```Powershell
# Ask for the csv file
$CsvLocation = Read-Host -Prompt 'input the location of the csv file (for 
example c:\Users\USERNAME\Documents\workstations.csv)'
$CsvFile = Import-CSV -Path $CsvLocation
# Create empty Hash Table
$Machines = @{Workstation = "Test" ; IP = "123"}
# create a hashtable to store the parameters in for splatting
$ruleParams = @{
Confirm              = $false
Enabled              = $true
Description          = 'This rule is instated to allow MobiControl 
Administration to be performed on this device.'
DisplayName          = 'MobiControl connection'
IPsecRuleName        = 'Mobicontrol connection'
OutboundSecurity     = 'None'
InboundSecurity      = 'None'
Platform             = '6.1+'
PolicyStore          = 'PersistentStore'
Profile              = 'Any'
RemoteAddress        = '10.133.120.207'
RequireAuthorization = $false
Protocol             = 'any'
}

# For each Element in the csv file add name and ip address to the hash 
table
$CsvFile | ForEach-Object {
$Workstation = $_.Workstation
$IpAddress = [System.Net.Dns]::GetHostAddresses($Workstation) |
   Where-Object { $_.AddressFamily -eq 'InterNetwork' } | Select-Object - 
ExpandProperty IpAddressToString
$Machines.add($Workstation, $IpAddress)
# fill in the two remaining parameters with the IP address and computer 
name
<# test print contents
Read-Host  "press enter to see the values for hostname and ip address"
Echo $Machines.keys
Read-Host  "press enter to continue"
#>
$ruleParams['LocalAddress'] = $_.Value     # IP Address
$ruleParams['CimSession']   = $_.Key       # HostName
# execute using the ruleParams splat
Write-Host "Creating IPsecRule on computer $() with IP address $()"
# New-NetIPsecRule @ruleParams

}

这看起来更符合我的想法。有什么明显的缺陷吗？输入的csv文件将只是工作站名称的列表。

在执行New-NetIPsecRule之前，测试代码似乎都在正常运行。哈希表$Machines中的值是其相关参数的无效输入。

Answer 1

将参数添加到cmdlet的方式是不正确的，并且需要在每行的末尾加上非常讨厌的反引号，前面加一个空格。

类似的，但是更好的是使用Splatting

# create a hashtable to store the parameters in for splatting
$ruleParams = @{
    Confirm              = $false
    Enabled              = $true
    Description          = 'This rule is instated to allow MobiControl Administration to be performed on this device.'
    DisplayName          = 'MobiControl connection'
    IPsecRuleName        = 'Mobicontrol connection'
    OutboundSecurity     = 'None'
    InboundSecurity      = 'None'
    Platform             = '6.1+'
    PolicyStore          = 'PersistentStore'
    Profile              = 'Any'
    RemoteAddress        = '10.133.120.207'
    RequireAuthorization = $false

    # I'm not sure about the Protocol parameter..
    # The docs say it is a String, but also refer to the Get-NetFirewallPortFilter
    # cmdlet where this parameter is a string array (String[])
    Protocol            = 'TCP,UDP'
}

# now iterate over the $machines hashtable, fill in the two missing parameters in the hash and execute
$machines.GetEnumerator() | ForEach-Object { 
    $CimSession = Get-CimSession -ComputerName $_.Key
    # fill in the two remaining parameters with the IP address and computer name
    $ruleParams['LocalAddress'] = $_.Value     # IP Address
    $ruleParams['CimSession']   = $CimSession
    # execute using the ruleParams splat
    Write-Host "Creating IPsecRule on computer $($_.Key) with IP address $($_.Value)"
    New-NetIPsecRule @ruleParams
    $CimSession | Remove-CimSession
}

免责声明..我自己不能尝试这样做，而且我不确定Protocol参数是单个逗号分隔的字符串还是字符串数组，请先在有限的机器测试集上尝试这样做。

附注:创建$machines哈希表时，请更改此行

$IpAddress = [System.Net.Dns]::GetHostAddresses($Workstation) |
Where-Object { $_.AddressFamily -eq 'InterNetwork' } | select IpAddressToString

转到

$IpAddress = [System.Net.Dns]::GetHostAddresses($Workstation) |
Where-Object { $_.AddressFamily -eq 'InterNetwork' } | Select-Object -ExpandProperty IpAddressToString