TACACS+ privileges with Juniper

[franlara521]

Hello,

I am trying to configure TACACS+ Pulse Secure appliance (PSA-5000). I am not sure if the shell policies work fine with the Juniper devices, I would need to apply them to separate admin roles from the read-only ones.

As far as I remember there was some kind of attributes that Juniper use for authentication that was not supported in the past.

Is this still happening?

Thanks and regards,

Fran

[EstherdTM]

Hello Fran,

To configure the shell rules for Juniper devices in the PSA-5000 (Endpoint Policy > Network Device Administration > Shell policies), it's important you fill in the "service" field as "junos-exec" and then, the custom attributes you want to include from the avialble ones:

service = junos-exec {
      local-user-name = <username-local-to-router>
      allow-commands = "<allow-commands-regex>"
      allow-configuration-regexps = "<allow-configuration-regex>"
      deny-commands = "<deny-commands-regex>"
      deny-configuration-regexps = "<deny-configuration-regex>"
}

I tried myself and it's working fine.

BR,

Esther