For authentication, you should be able to use the standard radius dictionary on the IC. The only time a vendor specific dictionary is needed is when you need to send specific attributes back to the switch. The bigger question is why the authentication is failing. What do the user access logs show? Use the RADIUS Troubleshooting logs to see what is going on as well. If this doesn't lead to a resolution, then you should open a case with JTAC. Thanks Craig Brauckmiller ... View more

The problem as you discovered is that UAC is formating the MAC address one way and the address is stored differently in AD. There is no way to change the format that UAC sends out. You also have to remember that the password in most cases for MAC auth will be the MAC address in the same format. So, you have to make sure it is stored the same way in AD A better solution for you customer is our Great Bay integration. Great Bay offers the ability to scan the network and it will catalog all of your devices and store the MAC address in an LDAP database. UAC can then query that database for MAC auth. Talk to sales for more info on it. Good luck. ... View more

You can also force OAC to reauth at a time interval you choose. Tools > Options. Security Tab > Enable Automatic Reauthentication Good luck Craig ... View more

This is an FYI message for the community at large. The radius request attributes are not available to a filter script...only return list attributes are. Thanks Craig Brauckmiller ... View more

One other thing to remember is thatin order for OAC to be able to communicate to the IC, nothing can be blocking the HTTPS port on the IC. In other words, you have to allow HTTPS to the IC from wherever the PC is. Secondly, is the IP address of the PC changing when you are placing him onto the quarantine VLAN? OAC is not responsible for getting the DHCP address, it is up to the host OS to do this. It's possible that you are in fact changing VLANs, but not getting an IP on that VLAN this is what is causing the connection to the IC to fail. Hope that helps Craig ... View more

Nicholai, what specifically were you looking for? Perhaps if we knew what you were looking for, some other users can offer up their experiences wiht it. Thanks Craig ... View more

When you are using the Cisco as the NAS device, what type of authentication protocol are you using on the client end? Is it EAP-PEAP or something along those lines? The reason I ask is that it is possible to disable the MPPE keys in the PEAP or TTLS methods. If you are using an MD5 auth method, this will prevent SBR from dynamically generating the MPPE keys as there is no keying material in an MD5 request we can use to do this. Can you get me the SBR log in debug level logging (LogLevel =2 and TraceLevel = 2 in the radius.ini). This should be completely possible. Thanks Craig Brauckmiller ... View more

Hello, yes, you can limit the allowed user based on MAC address. The radius attribute of 'calling-station-id'. However, since you are using EAP-PEAP, you will need to create a request filter to move the 'calling-station-id' inside of the PEAP tunnel. If you do not do this, you will not be able to filter the MAC address. You have to ALLOW the 'calling-station-id' attribute as part of the filter. Hope that helps Craig ... View more

Hello, juniper does not provide an open API to the SBR server administrator. When SBR was owned by Funk Software, an SDK was available for purches, but this has since been discontinued to bhe best of my knowledge. I would suggest you contact sales to inquire if it is still available. Thanks Craig ... View more

Simple answer is yes. You will need an additional license on the IC to support MS NAP however. UAC will support the EAP-SOH protocol that the Micorsoft supplicants use to report the system's health during authentication. Contact sales for pricing on the licensing costs. Thanks Craig ... View more

Probably the easiest way to do this is with an LDAP lookup against AD and then call a directed realm to do the Windows authentiction. The LDAP auth file will do the lookup in AD. Depending on which group you are in will determine which profile you use. After this, you use the %ProxyRalm paramert to call a directed realm which calls the Windows Domain Group auth method. You need Global Enterprise to make this work. Hope that helps. Craig ... View more

The Connected/Closed status indicates that the SSH connection attempted by the IC to the ISG failed. On the ISG...issue the command : 'get event' Look for a failed SSH login from the IC. Chances are good that the password you supplied on the IC's firewall page does not match the one used on the ISG. Hope that helps. Thanks Craig Brauckmiller ... View more

Aeroplane, one misconception many people have is that OAC obtains the IP address after logon. This is actually an incorrect assumption. Once the 802.1x authentication has occured, OAC will open the network port. This causes a media connect message to be sent to the DHCP client on the PC. The DHCP client is the one ultimately responsible for obtaining the IP address for the workstation. JTAC gets many calls where the user is blaming OAC for not getting an IP address when in fact it is a problem on the OS side. Thanks Craig ... View more

In theory, yes it is possible to have two auth table entries with the same Ip but different user names. But, the IC should eventually clean it up. This can happen in cases where an endpoint does not gracefully disconnect from the IC and thus the auth table is not cleared until the user's session is expired on the IC. If NAT is detected, the IC will not push the auth table down to the IE as the IP is used by the IE to filter access to the protected resource. The only way NAT and auth tables will work is to use IPSEC from the OAC or Pulse Clients. In this case, the IC will send down the IP address issued to it from an address pool. Does that help? Thanks Craig ... View more

I don't think the SSG5 support port based MAC auth. You'd need to ask the Firewall folks to be 100% sure though. Also, in every switch I've ever seen, MAC auth and 802.1x are mutually exclusive. You can do one or the other, but not both. I know the HP switches can try MAC auth first and if that fails, move on to 802.1x. Again, you switch vendor needs to confirm that. Hope that helps. Craig ... View more

This question is better answered by one of our System Engineers. In short, SBR is a full featured RADIUS server. It supports all major 802.1x auth methods including Cisco's EAP-FAST and LEAP. UAC doe snot. Currently, UAC 4.1 can handle basica accounting data, but has no mechanism to record it externally such as a SQL server. SBR can authenticate AND send accounting data to a SQL server (MS SQL, Oracle, MySQL, or any ODBC/JDBC compliant database). The biggest advantage to using UAC for its RADIUS function is that you can run the IC hardware as your radius server and in the future, should you want to upgrade to the full version of UAC, you simply add another license key. Its a great way to migrate into a NAC environment. Thanks Craig ... View more

1. You will need to consult the Microsoft NPS documentation on adding the IC as a server. It is not part of the UAC documentation. 2. OAC is not the intended client with EAP-SOH is in use. The Microsoft Supplicant on the OS would be used. If you were using the OAC cleint, SoH functionality is covered by the built-in Host Checker policies used when EAP-JUAC is configured with OAC. Thanks Craig ... View more

This is absolutely possible. UAC will talk to both the SRX and ScreenOS firewalls and will sent auth table entries to both. You must configure both firewalls on the IC as enforcers. Once the user signs in, by default, the IC will push an auth table entry to all enforcers that are configured. Thanks Craig ... View more

Licensing is based on maximum number of simultaneous users on the IC. UAC tracks this based on the client being used. With our Pulse or OAC clients, you establish a connection to the IC over layer 3 with our proprietary JUAC protocol. Once you drop off the network, we remove the session from the IC. If not using our clients, we are dependent on the accounting start and stop messages from the NAS device. Hope that answers your questions Thanks Craig ... View more

Have you opened a JTAC case on this? If not, please do so. This issue needs to be investigated further. Thanks Craig ... View more

This feature does not currently exist withing the UAC solution. You should contact Juniper sales and request this feature be added in a future release. Thanks Craig ... View more

If you want to verify the user's NAS-PORT-ID, you must use this in the FILTER of the LDAP search. Simply adding it to the ATTRIBUTES and RESPONSE secions only tells SBR to RETURN the value in the LDAP database to the RADIUS attribute. It does not tell SBR to use it as a checklist attribute. With LDAP, the only way you can get a checklist attribute to be used is to use a PROFILE. You can define the PROFILE in the SBR GUI and then add your checklist values there. In the LDAP file, you can add a [DEFAULT] section and put something like myProfile=PROFILENAME (whatever you defined in the GUI. Then, in the [RESPONSE] section, you add %Profile=myProfile. This will tie the profile to a successfully authenticated user. That profile's checklist will be evaluated. If they pass the checklist, they will authenticate. Hope that helps Craig ... View more

The IC must receive accounting start and stop from the access point or switch to accurately track the user session. If there are no accounting messages, the session will remain active on the IC until the role session length is hit. Thanks Craig ... View more

What you are asking is not as easy to accomplish as one would hope. The only REAL way to lock a user down to a specific RADIUS client is to use a check-list attribute. You would have to use the USER-NAME attribute for each user. Its a lot of administrative effort, but that really is the only way to do this given your specifications. If you wanted to use SQL as an auth server, you could create a stored procedure that checks the user name and the RADIUS client and sends back an accept as appropriate. The same thing can also be done with Java Scripting. This, however, requires that you run the Global Enterprise Edition of SBR AND purchase a Java Script license. Hope that helps Craig ... View more

There are plent of people here with experience supporting SBR. What is your issue? ... View more

The registry key mentioned in the link only works when transitioning from Machine Authentiction to Windows GINA user authentication.. What operating system are you running? We have seen cases in which Win XP does not do this even with the registry ket added. Thanks Craig ... View more

DId you verify that your device certificate is bound to the VLAN port? It is very possible that the config may not work. There are several services that do not work with VLAN ports on the IC. NSM is one of the services that falls into this category. I would not be surprised of the radius process was another. Hope that helps. Craig ... View more