hello all, wasn't sure if I should put this question here, or in the EX section . . . I have an EX switch that is working with the UAC to provide 802.1x authentication for both supplicant users and a MAC-based authentication for devices that don't support it. now I would like to have the UAC also authenticate SSH sessions to the EX itself for management. I got this working a long time ago, but the RADIUS server was IAS. Here is my current config for radius auth for admin sessions: [edit system[ radius-server { 172.17.100.15 { secret "$9$GYUHmf5FnCuZU/tOBEh"; ## SECRET-DATA source-address 172.17.10.2; } } login { class radius-ro { permissions view; } class radius-rw { permissions all; } user radius-ro { uid 2001; class radius-ro; } user radius-rw { uid 2002; class radius-rw; } } from what I remember, the class had to match the user-name (at least working with IAS . . .), hence my class and login names are the same. on the UAC side, the EX is already a RADIUS client in a "Wired" Location Group, and already has a policy to assign a VLAN based on successful authentication and AD Group membership. I created a new policy to return Juniper-Local-User-Name of 'radius-rw'. However when I try to login, the UAC log shows the following: Radius authentication rejected for wmclendon (realm 'Mac-Auth-Realm') from location-group 'Wired' and attributes are: NAS-IP-Address = 172.17.10.2 Requested authentication protocol may not be available EDIT: also seeing this in the Event log on the UAC: RADIUS: Library Requires EAP and credentials are not EAP --- at a loss on this one it appears to be trying to authenticate against the MAC Authentication Realm I configured for the Location Group, and no tthe Realm that actually has the information . . . and i'm not sure why i'm seeing the requested protocol may not be available messages... ... View more

Hi everyone, quick question I am hoping someone has run into before -- I am setting up UAC in a lab environment and testing the various configuration options with native supplicants, OAC, etc. I am running into an issue with the native Windows 802.1x supplicant authenticating with my IC: - Radius authentication rejected for wmclendon (realm 'wired') from location-group 'Internal Loc Group' and attributes are: NAS-IP-Address = 172.17.1.1,NAS-Port = 76,NAS-Port-Type = 5 Info AUT23457 2009-08-31 11:09:28 - ic - [0.0.0.0] wmclendon(wired)[] - Login failed using auth server LAB-AD (LDAP Server). - Primary authentication failed for wmclendon/LAB-AD from 00-21-70-76-4d-01 - Could not authenticate user wmclendon in LDAP server LAB-AD using protocol MSCHAPV2: challenge-response open protocols are disabled. I have my ADserver in the IC as an LDAP server (I seem to remember someone telling me this was a better idea than just using AD . . . is that still the case?) The issue seems obvious, but I have no idea how to enable MSCHAPv2 on my AD server . . . and google has gotten me nowhere. I realize this is an MS issue and not Juniper, but hoping my fellow Juniper brethren know a quick fix for this :) If the supplicant is OAC, authentication works without issue Also when I change it from an LDAP server to an AD server, everything works fine. So really I guess my question is what are the advantages (disadvantages?) of using an LDAP server vs configuring it as an AD? Thanks, Will ... View more

Hi all, Seeing a weird oddity here with NetConnect with Windows 7 -- The platform is an SA700 running v7.0R1 NetConnect launches and connects, we can ping internal addresses and have the access we need, but if we run the diagnostic, we see "NC Tunnel Not established" When an XP client connects, we get "NC Tunnel Established" as expected. Here's the weird thing...I test the same Windows 7 client against an SA2500 running 7.0R1 (different configuration though), and I get "NC Tunnel Established" from the diagnostics like I would expect. Anyone have any ideas what could be causing that behavior?  In the grand scheme of things it appears not to be causing connectivity issues, but I'm not sure if it is indicative of some other possible config issues or something. Thanks, Will ... View more