Machine Authentication for Junos Pulse Connections

[MrSprinkles_]

hi,

Has anyone had success setting up Machine Authentication for Junos Pulse Connections on 7.2?

I'm testing with a domain machine and set up the pulse connection per the admin guide settings specified in the Machine Auth for pulse section, First time i log in as an end user via IE to provision Pulse it downloads, installs, and when pulse tries to run it says it fails due to invalid server certificate. I'm not trying machine cert auth yet. Just domain machine username/password. And the error message applies to server certificate. debuglog.log says:

00351,09 2012/06/19 12:54:01.687 4 brian Pulse.exe Pulse p2440 t7BC UiModelListener.cpp:348 - 'JamUI' last-status-msg: 1107 <short: Invalid server certificate., long: Server certificate validation failed. If you are certain that this is a valid destination, click Connect to continue. Otherwise, click Cancel and contact your network administrator.>,

I don't seem to have this option to "click Connect to continue" for this connection.

There is a self-signed device cert on the system but the hostname resolves and I added the cert to my trusted roots store in IE on the client PC. So I don't know why at this point I'm getting this message. The date validity on the cert is ok as is the time clocks on the clien PC and server.

[zanyterp_]

I can't comment on if it is something that is in the works to see if we can work around this limitation; however, it is noted in the KB system at http://kb.pulsesecure.net/KB16105. And this is only if you must use the AD/NT server instance (which is rare).

If you are connecting to a 2008R2 Server, you can use the LDAP server instance to allow login and this does not require any change to the cryptographic settings. This is also a much more flexible and quicker form of communication with the AD server; unless you have multiple domains AND don't want to create multiple server instances, there is no reason to use an AD server instance.

[zanyterp_]

Yes, you are correct. I am sorry for misreading the part about using this for machine authentication (not sure how I missed that but I did).

Yes, you are correct that only the AD/NT server type can be used and that there are restrictions on the AD server that require the change in cryptographic algorithm. Yes, you are correct that machine certs and then user certs or an AD/NT server instance.

Sorry again for mis-speaking. You have found another item that requires the use of the AD/NT server that I need to remember about.

[billiam_]

We do generally define our AD servers on the SA as LDAP instances, but from the admin guide to use the automatic connections the server must be defined as a AD instance.

I've also tested this today, changing the server type in the realm used for machine authentication to LDAP causes a new error to appear in the logs:

2013-10-22 09:52:57 - ive - [xx.xx.xx.xx] Root::host/<hostname>.<domain>.com(PLAP)[] - Could not authenticate user host/<hostname>.<domain>.com in LDAP server LDAP-AD using protocol MSCHAPV2: challenge-response open protocols are disabled.

Also if using either of the options to auto establish with machine credentails and then switch to user credentials at login using an LDAP server fails, switch this to an AD instance and the user authentication works. Testing the LDAP server outside of the PLAP configuration works fine.

So it seems to me the only true way without changing GPOs and cryptographic settings of the AD is to use machine certificates for the machine authentication and then either user certs or an AD instance for the user connection.

[billiam_]

I'm reviewing this requirement again for a specific customer and it looks like the only option without creating domain policies to allow NT4 cryptographic algorithms is to use certificates? As the domain servers are all Windows 2008 R2, has there been nothing done to enable this? If not it starts to question the use of machine username and password on the SA/MAGs, if it doesn't work, perhaps the admin guides should be updated to include a note on this limitation / caveat?

[zanyterp_]

are you seeing this with 3.0R1 or 3.0R2?

can you disable certificate verification in IE and test?

when you connect directly in your browser does the error show?

[MrSprinkles_]

3.0R2

This is machine auth.. not end user browser auth (so doing those things with IE does not apply here). The message is in Pulse directly. I have it all set up per the admin guide. I do not have any device certificate errors, etc. I have AD set up to auto enroll Machine Certficiates. That works. The AD CA root cert is in the machine cert store trusted authorities. I also imported the Juniper device cert public key as a trusted authority. Verified via mmc snapin.

In juniper access logs it simply says:

Info AUT23457 2012-06-20 16:08:22 - ive - [172.25.202.17] OLYMPIC\WIN7-LAB-32$(Plotnik)[] - Login failed using auth server Olympic-AD (Samba). Reason: Failed

And in the event logs on AD I see these details for an audit "success" event. So it was successful (as in Juniper did some kind of credential auth at the machine level for the cert and it was successful) but Juniper says it is not? and "WIN7-LAB-32" is the client PC machine name (not a username). As a side note, general testing of username/password auth for AD works fine.

+ System
- Provider
[ Name] Microsoft-Windows-Security-Auditing
[ Guid] {5484625-5478-4994-A5BA-3E3B0330D}
EventID 4776
Version 0
Level 0
Task 14336
Opcode 0
Keywords 0x8020000000000000
- TimeCreated
[ SystemTime] 2012-06-20T23:08:05.886799400Z
EventRecordID 8739
Correlation
- Execution
[ ProcessID] 452
[ ThreadID] 2892
Channel Security
Computer 2K8.ol.com
Security
- EventData
PackageName MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
TargetUserName WIN7-LAB-32$
Workstation \\JUNIPER1
Status 0x0

[zanyterp_]

ok; looks like there were two scenarios posed in the original query: one with pulse through the browser for initial install (which is why i asked about the root CA being installed in the certificate store in the browser).

you also reference machine auth; however, i'm not sure when.where you are seeing this.

the error message you posted is indicative of the AD server denying login (such as invalid user credentials).

the machine is trying to login and that is my expected reason for what you are seeing.

[billiam_]

Hi MrSprinkles,

Did you manage to resolve your issue with machine auth using machine username / password. I appear to be having the exact same issue, with the IVE reporting Samba failed. Out of interest is your domain Server 2003, Server 2008, or Server 2008R2? The reason I ask is because I remember the SA having some issues with 2008R2 and I'm wondering if this could be related especially as the message relates to Samba.

Cheers

[zanyterp_]

billiam: where are you seeing the failure for samba: user access or events log?