Hi guys, Can anyone help me or point me in the right direction or do I have to log a call with JTAC ? Regards, Martin ... View more

Hi Guys, I don't know whether this will help, but below is a quick written overview of my UAC config that I confirmed just now: I had a look in our LAB and to give you an overview of how it is connected: Equipment in Rack: -------------------------- EX4200 Switch EX4200 Switch IC4000 Infranet Controller ISG1000 Firewall/Enforcer The IC plugs directly into the top EX4200 switch and the ISG plugs directly into the bottom EX4200 switch. Communication between the IC and ISGis working perfectly. What the switches are setup like, I am not sure as my one colleuge completed this for me (I do not have the relevant knowledge to setup the switches. I have two VLAN's > VLAN2000 - Trust VLAN > VLAN2001 - Untrust VLAN IP Ranges for the VLAN's > Trust - 10.10.101.0/24 > Untrust - 10.10.102.0/24 Config for IC4000: ============= > Authentication > Signing in > Signing-In Policies > */ > Default Sign-In Page > Users (802.1X) > Endpoint Security > AV Protection - Policy where it checks for specific AV > Windows Update - Policy where it check for specific Update > Auth Servers > LAB_AD_LDAP > IP of AD LDAP Server > Active Directory > System Local > Users > testuser > Full Access and Quarantine > trust > Full Access > utrust > Quarantine > Users > User Realms > LDAP > Role Mapping > Group "trusted" > Full Access > Group "untrusted" > Quarantine > Users > Role Mapping > Username "trust" > Full Access > Username "utrust" > Quarantine > Username "testuser" > Full Access and Quarantine > User Roles > Full Access > Restrictions > Host Checker > AV Installed and up to date > Windows Update installed > Quarantine > Restrictions > Host Checker > AV Installed and up to date > Windows update installed > UAC > Infranet Enforcer > Connection > ISG1000 hostname > Screen OS Policies > SRC "Untrust" > DST "Trust" > Type "Source IP > Resource > Full Access > TCP/ICMP allow to all Trust IP's > Quarantine > TCP/ICMP allow to all Untrust IP's > Auth Table Mapping > No Policy due to Dynamic Auth Table Assignment > Network Access > Location Group > lab_locationgroup > Sign-In Policy > */ > lab_ic_radius_client > Radius Client > lab_ic_radius_client > IP Address: 10.10.101.2 (EX4200 Switch) > IP Range: 100 > Host Enforcer > Full_Access_Policy > Allow > Trust network TCP/ICMP > Full Access > Quarantine_Access_Policy > Allow > Untrust network TCP/ICMP > Quarantine Regards, Martin ... View more

Hi Jeff, I have had a look just now with regards to the Infranet Auth Policy. There are no users listed in the auth table. What can be the cause to this ? Regards, Martin ... View more

Hi Guys, I saw that you all posted responses, but I did not have the time to actually answer them. Was on a JNCIP-M course last week and have been busy working on a tender since Monday. Manoj, Well, I have both appliances, but not the license. I have an IDP75 stand alone appliance and also an ISG-1000 with the IDP module (i am not entirely sure about this one though, but accoring to my collegue it does). I am still very unclear as to how I will be integrating IDP with the UAC solution as I have never worked on a Juniper IDP appliance before and have limited skills on the ISG. I have only worked a little bit on a SSG50 FW, so I have a little bit of a background on ScreenOS. Jeff, Unfortunately I do not have a diagram. I want to draw up one when I am finished of the whole UAC solution, but currently we are running a whole bunch of Juniper kit in our LAB and we are two engineers that are busy with customer demo's and simulations, so its a bit chaos with regards to what goes where and on top of that, I am new at the company and new to Juniper. Still struggling a bit to keep head above water. Actually I have no idea where the VLANs terminate. Our switching expert did that for me and I am now not able to get a hold of him to find out how he configured it. I am not at liberty to post the ISG config as we are busy with other simulations and also have live sensitive customer data running, sorry for that. With regards to the Infranet Auth Firewall Policy, I have to confirm that when I am back at the office. I have an Active Directory LDAP server setup with some user configured on it and on the IC I have enabled LDAP authentication, when a user authenticates on the IC, the IC runs an LDAP query to the LDAP server to verify that the username and password are indeed correct. Are you still unclear ? I want to use OAC with the XP GINA, but I haven't had any success with implementing that. Do you perhaps have a document on how to configure that ? Thanks for all the information and help thus far guys. Cheers, Martin ... View more