Hi Suresh,   Glad that my susggestion helped,you could mark this post as accepted solution, that way it could help others as well. Kudo will be a bonus thanks!   Regards, Kannan ... View more

Hi Jro,   I am glad that my suggestion resolved your query   Regards, Kannan ... View more

Hi,   I am glad that my suggestion helped you in issue resolution, happy to help you in future Regards, Kannan ... View more

Hi ,   Can you now try with EAP -TTLS enabled as outer protocol  & EAP -JUAC as inner protocol on IC.ON pulse lcient have Juniper TTLS enabled. Restart  the Unified access service from services of the local machine after making the above changes.   Hope this helps, i   Regards, kannan ... View more

Hi,   For testing , please test only with local database system locl auth server and user authentication. If you wants to use machine authentication  you need to use AD as auth server. Hence lts just test user auth based on system local auth server.   Can you also enable Microsoft enabled PEAP protocol in authentication tab of windows 7 network properties instead of EAP-TTLS, also enasure that you have PEAP enabled in IC as well in 802.1x protocl section.   If this works, then we will test the certficate auithentication next based on TTLS   Update the results after the above mentioned changes & testing   Regards, Kannan ... View more

Hi,   1. Are you trying to use certficate based authentication or username /password based authentication?   2. Are you trying user authentication or machine authentication?   3. What is the authentication server enabled in IC?   4. If you have the setup ready , what is the error message in IC user access log?   5. Do you see the local Are connection  profile lodaded in the Pulse UI?   6. Can you donload & install the pulse client from  the same IC using agent less access if possible?   REgards, Kannan       ... View more

I am glad  Arslan that your issue is reolsved Regards, Kannan ... View more

Hi Arslan Nawaz, The below information on AD configuration should help for SPNEGO :   On Active Directory, there are two steps that must be performed: ´ Create a dedicated user for the SPN. Add the SPN to this user using 'ktpass.exe' (this will generate the keytab).   NOTE: You must set a password for the user. User must change password on next logon should not be enabled, and Password neverexpires should be enabled.   The SPN must be added in this format: HTTP/[email protected] The SPN iscase sensitive. Note the order of uppercase, lowercase and upper case.   ´ For Active Directory 2008, the commands 'ktpass' and 'setspn' are already installed. For Active Directory 2003, an add-on pack is required. Before adding the SPN, it's a good idea to make sure it doesn't already exist. This will help avoid ticket decryption issues on Junos Pulse Access Control Service. On the endpoint, the MAG Series device must be added as a trusted host(with Internet Explorer or Firefox). This can also be done with an Active Directory group policy. Without this, the browser will not participate in SPNEGO.   On the MAG Series device, you must upload the keytab file and verify thatthediode turns green (indicating a successful join).SPNEGOdoes not workunless the diode is green.   Sample Active Directory Commands To search for a particular SPN: C:\>setspn -Q HTTP/dev94.abc-domain.lab.test.com To search for all the SPNs of user 'spnuser': C:\>setspn -Lspnuser To delete this SPN of user 'spnuser': C:\>setspn -d HTTP/dev94.abc-domain.lab.test.com spnuser In this example, the MAG Series device FQDN is: xyz.abc-domain.lab.test.com and the AD realm is: ABC-DOMAIN.LAB.JUNIPER.NET. This adds an SPN to the user: Additional Information   The 'kerbtray.exe' program is helpful for viewing and deleting Kerberos tickets on the endpoint.Old ticketsmust be purgedfromthe endpoint ifSPNs are updatedor passwords are changed (assuming the endpoint still has a cached copy of the ticket from a prior SPNEGOrequest to the MAG Series device. During testing,you should purge tickets before each authentication request.   A similar program to 'kerbtray.exe' is klist.exe. This is a command line program to view and purge tickets. This can be downloaded from Microsoft's site. When troubleshooting, Juniper Network recommends that you restart the browser between auth requests to avoid cache issues.   If Internet Explorer pops-up a Windows dialog box during authentication, this signifies that the ICisn't trusted for SPNEGO. You should add the MAG Series device FQDN underOptions -> Security -> Local Intranet -> Sites ->Advanced. In Firefox, you can install the 'Live HTTP Headers' plug-in to monitor HTTP traffic. You should verify that the ticket is being sent as base64 data. To add the MAG Series device as a trusted host in Firefox, load URL about:config in the address window and set:network.negotiate-auth.trusted-uris. Note: If I have answered your questions, you could mark this post as accepted solution, that way it could help others as well. Kudo will be a bonus thanks!   Regards, Kannan ... View more

Hi,   Yes your requirement of customizing the loginpage of UAC is possible.   You can use custom signin pages options in UAC to achive your requirement, below is the URL for accessing the custoemr signin page guide which you or your IT team can use it for creating custom signinpages as per your requirement   http://www.juniper.net/techpubs/en_US/sa8.0/information-products/topic-collections/security-access-customsigninpages-developer-reference-8-0-5-0.pdf   Hope this resolves your query.   Note: If I have answered your questions, you could mark this post as accepted solution, that way it could help others as well. Kudo will be a bonus thanks!   Regards, Kannan ... View more

Hi Jiff,   Yes, your understanding is correct and your requirement posted in the last update is possible and supported in MAG UAC   Regards, Kannan ... View more