cancel
Showing results for 
Search instead for 
Did you mean: 

use IC4500 as radius server to manage network device account

Highlighted
Occasional Contributor

use IC4500 as radius server to manage network device account

hi all,

I have an IC4500 box with radius feature and some device as srx3400, ex2200 ...

I want to use IC4500 as radius server to manage all account to login to srx, ex device. These account will be store on IC4500.

On srx, I have configue follow links: http://kb.pulsesecure.net/InfoCenter/index?page=content&id=KB16607&smlogin=true

set system radius-server 10.20.20.11 port 1812 secret abc

set system authentication-order radius

insert system authentication-order password before radius

set system login user remote full-name "all remote users"

set system login user remote class operator

 

 

On IC4500, I have try to configure something as users realm, users role, radius client ... but srx authentication by account manage on IC4500 fail.

Please tell me what I have to configure on IC4500, srx, ex ... to do my task.

Thanks.

 

8 REPLIES 8
Highlighted
Regular Contributor

Re: use IC4500 as radius server to manage network device account

Here are the config steps in IC-4500.

  1. Configure Sign-in Policies and ensure you have the right realm and protocol set in here
  2. Configure Location Group and select the above Sign-in-Policy
  3. Configure New Radius Client (e.g. SRX)
  4. Ensure the Location Group Selected as part of Radius Client provisioning is pointed to the right Sign-in-Policy
  5. At Realm ensure you have the correct Authentication server along with appropriate role mapping rules.

The above should get you going. In case if you have issues kindly collect a policy trace for the failing user as well.

 

Thanks

Highlighted
Occasional Contributor

Re: use IC4500 as radius server to manage network device account

Thanks Paul,

I will try as soon as. So could I must configure any thing on srx, ex ..?

please help me.

Best regards.

Highlighted
Regular Contributor

Re: use IC4500 as radius server to manage network device account

I was thinking that you will be following the KB that you highlighted for SRX config

Highlighted
Occasional Contributor

Re: use IC4500 as radius server to manage network device account

I have try to configure

Signing In */

01.png
"vph user" is our realm and I choise 802.1X
02.png

 

"vph user" realm

03.png

 

with Role Mapping

04.png

Authentication server is "vph auth.server", type: Local Authenticaion Server

and I creat an user  "vphfpt"

05.png

 

this is "vph user role"

06.png

nothing special for this role

I creat vph group with Sign-in Policy */

07.png

and I have Radius client

08.png

IP address:

IC4500: 10.20.20.11

SRX3400: 10.20.254.33

they connect over a mangement switch and core switch

 

on srx3400

10.png

 

but I can not login srx3400 with accoun vphfpt I creat on vph auth.server

please help me

thanks.

 

Highlighted
Occasional Contributor

Re: use IC4500 as radius server to manage network device account

and from srx3400, I can not telnet to IC4500 port 1812, there is no firewall between 2 devices

Highlighted
Regular Contributor

Re: use IC4500 as radius server to manage network device account

Can you attach the logs, User access logs as well as Radius troubleshooting logs.

In order to enable the Radius logs use Troubleshooting --> Monitoring --> Radius

Ensure you recreate the failure and collect these logs

 

The config looks OK for the most of it, however can you try with only a single realm (vpn user) in the Sigining in Policies

 

Thanks

Highlighted
Occasional Contributor

Re: use IC4500 as radius server to manage network device account

Hi,

I can not do it,

Check it and help me please,

Highlighted
Regular Contributor

Re: use IC4500 as radius server to manage network device account

The logs report that User vphfpt firmly rejected by MS-CHAP-V2 auth method (refer below). Have you enabled the Password stored as clear text option in the AUTH Server configuration ? If not can youtry this option please ?

 

info - [127.0.0.1] - System()[] - 2013/10/04 02:18:45 - (b0da4250)Authenticating user vphfpt with authentication method MS-CHAP-V2
info - [127.0.0.1] - System()[] - 2013/10/04 02:18:45 - (b0da4250)Request::Authenticate called. Username is vphfpt
info - [127.0.0.1] - System()[] - 2013/10/04 02:18:45 - (b0da4250)Client supplies MSCHAP2 password
info - [127.0.0.1] - System()[] - 2013/10/04 02:18:45 - (b0da4250)MsChapV2Request::ForwardCredentials
info - [127.0.0.1] - System()[] - 2013/10/04 02:18:45 - (b0da4250)User vphfpt firmly rejected by MS-CHAP-V2 auth method
info - [127.0.0.1] - System()[] - 2013/10/04 02:18:45 - (b0da4250)ProcessAuthMethod Returned TRY NEXT
info - [127.0.0.1] - System()[] - 2013/10/04 02:18:45 - (b0da4250)Unable to find user vphfpt with matching password
info - [127.0.0.1] - System()[] - 2013/10/04 02:18:45 - (b0da4250)User vphfpt being passed to Auth-Final-Response control point method .
info - [127.0.0.1] - System()[] - 2013/10/04 02:18:45 - (b0da4250)-----------------------------------------------------------
info - [127.0.0.1] - System()[] - 2013/10/04 02:18:45 - (b0da4250)Authentication Response (reject)
info - [127.0.0.1] - System()[] - 2013/10/04 02:18:45 - (b0da4250)Packet : Code = 0x3 ID = 0xfa
info - [127.0.0.1] - System()[] - 2013/10/04 02:18:45 - (b0da4250)Vector =
info - [127.0.0.1] - System()[] - 2013/10/04 02:18:45 - (b0da4250)000: 8f958ad7 0635ba3d 4e0231cf 3e359b55 |.....5.=N.1.>5.U|
info - [127.0.0.1] - System()[] - 2013/10/04 02:18:45 - (b0da4250)MS-CHAP-Error : Value =
info - [127.0.0.1] - System()[] - 2013/10/04 02:18:45 - (b0da4250)000: fa453d36 39312052 3d302020 563d33 |.E=691 R=0 V=3 |
info - [127.0.0.1] - System()[] - 2013/10/04 02:18:45 - (b0da4250)-----------------------------------------------------------