Thanks Stan ... View more

    are you using layer 3 or layer 2 topology?   how are you mapping non-compliant users to quarantine role? ... View more

  Hi Prasanth   IC4500 is the infranet controller or also known us Unified Access Controller (UAC).   How many users you have and how are they spread on access switches?   1) Should the IC controller internal interface connected to the core be trunk or access? Switches are all juniper   it can be access or trunk as well or Layer 3 as well,depends how many users and VLANs you have.   2) Since the remediation vlan is l3 interface on the core, if the user is placed on this vlan provided that he doesnot fullfil the policy, wouldn;t the user still be able to reach all the subnets?   You can configure your VLAN as remediation having access list configured on interface or you can use host enforcement when assigning a role to user to limit host traffic.   3) Is certificate necessary in my senario   Certificate is used to encrpt credential info from end point to IC , You can use IPSEC option too..Not so sure about this.     4) Cisco IP phones are deployed in the network. How can I bypass the ip phones from UAC   You can build a authserver of MACs in IC for these or use a third party software like Great Bay   5) Can anyone provide step by step configuration on deploying the UAC for 802.1x. I went through documents in Juniper, unfortunately everything involves the Infranet Controller     you can refer to Quick start guide on Juniper website.   Regards Kashif ... View more

  Thanks Stanislas   Your configuration seems right, but the thing is that I am pushing only the Qurantine VLAN from UAC, Production VLAN is authenticated and assigned locally on switch. So I wont be able to configure the first radius attribute rule which you mentioned.   When I tried this with only rule 2 of radius attributes, I got pushed into Qurantine VLAN in both the cases whether compliant or not   Thanks ... View more

  I dont think a warning would be displayed as for VLAN20 role mapping policy hostcheker did not fail , hence no warning would be generated. Simply VLAN 20 would be assigned.     ... View more

  Thanks for your help Kannan   I was able to do it in following manner :   Map username * and hostcheckerpolicy=mypolicy to acmerole Map Username * and hostcheckerpolicy!=mypolicy to acmerole and non-compliant role.   Non-compliant role configured to push qurantince VLAN   Disable Require and Enforce on ACME Realm level.   Enable hostchecker on acmerole Disable hostchecker on non-compliant role   IC merges the settings for both the roles and end result is USer in Qurantine VLAN with Warnings   If I do reverse   Disable hostchecker on acmerole Enable hostchecker on non-compliant role   Users goes into production VLAN with warnings..   Hope this helps others too..   Regards Kashif ... View more

  Hi Thanks for the reply.   My user logs in ACME realm, I have configured two rules for this realm   1. user = * AND hostcheckerpolicy='myavpolicy' maps role acmerole and stops 2. user = * maps Qurantine Role.   Quarantine role is configured to push Qurantine VLAN ID and it works. But No non-copmliance message is displayed to user in this method   when I enable hostchecker on relam level to Require and Enforce mode or when I enable on acmerole restriction host checker, user gets disconnected from the network and is given proper warnings and everything.   I want both of these , meaning non-compliant user pused to Qurantine VLAN and given non-compliance warnings as well..   Regards kashif ... View more

    one more thing, if I use this method and push the VLAN from IC, the qurantined users gets an IP from DHCP and sits in that VLAN with no warnings on suplicant.   where as when I enable the hostchecker enforcement, the IC pushes the warnings and etc to user but user is totally off the network with Odyssey client in red state.   Is there a way I can do both with user having a IP and warnings as well   Thanks Kashif ... View more

  Junos pulse is the client/supplicant for windows , you dont need to configure dot1x on windows, create a profile for Odyessey or JunOs pulse client, and install it on PC manually.   Ideal setup would be to have a domain environmnet, and then push the client on domain on end stations, then you can integrate your IC with AD, and use user credentials to authenticate from the supplicant installed on windows machine,   REgards Kashif ... View more

  why use IPSEC policy, when you can use a certificate. ... View more

  Insted of pushing VLANS from IC, configure Guest and Productions  locally on switch and configure events for these   For Qurantine users you can push the VLAN.   actions Fail (auth fail) server dead (IC not accessible from switch) no response server alive   Using cisco terms, I am sure you can fid equivalents commands on Juniper,   any more questions .. skype me :)   Kashif Zarif     ... View more

Configure radius accounting to send status start-stop to IC from switch, so IC knows when users goes off   ... View more

    Hey configure dot1x to use radius group, then configure IC as  radius server on switch.   Configure switch as a radius client on IC.   Now you would be able to forward the authentication request to IC on Layer3.   Kashif Zarif ... View more

Thanks Man ... View more

I do get a yellow light ON HD LED when I power On the Device ... View more