- Pulse Secure Community
- :
- About srv.seguridad_
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
since
10-29-2017
10-29-2017
srv.seguridad_
Occasional Contributor
6
Posts
0
Kudos
0
Solutions
03-02-2011
06:42:AM
We have been asked if it would be possible to automatize the process of creating guest user accounts. The idea is if there is a way by which a guest user who connects to the guest vlan and then opens the captive portal, could request guest user credentials directly from there. The request would fall into an administrator's hands, who will validate/deny the request. Once the request has been validated by the administrator, the UAC sends the credentials back to the user. Its just an idea, other solutions could be valid too, as long as they automatize part of the process. Thanks!
... View more
02-24-2011
06:43:AM
Hi, we are in the process of deploying a pair of IC-4500, with integration of Microsoft SoH. 1. So far, we've seen how to define Host Cheker policies based on SoH, connecting to a NPS server. The fields to fill include the NPS address and a shared key. The first question is where has the UAC to be configured in the NPS server so communication can occur? 2. Second question, on UAC Authentication Protocols, we set PEAP, and SOH as inner authentication method. Oddyssey Access Client includes PEAP but no SOH, what should I set on the inner authenticaion protocol in OAC? Thanks!
... View more
11-26-2010
02:13:AM
Your understanding of my question is correct and thanks for the info, that will do it!
... View more
11-25-2010
04:15:AM
Hi, is there a way to control de access of a user who opens a terminal service through the Juniper Terminal Services, and once connected, opens a nested Terminal Service directly with the Microsoft Windows Remote Desktop application? is it possible to allow the first session but deny the second one? Thanks!
... View more
08-26-2010
04:01:AM
I've tryed setting the port in both multi-host and multi-domain modes. In multi-host, phone and endpoint authenticate and are granted access but the phone is assigned an IP from the same VLAN as the endpoint and traffic and is not even shown in the dot1x authentication table. In multi-domain, not the phone not the endpoint authenticate. In both cases, on the UAC logs show the devices authenticating correctly agains the RADIUS servecr, the correct roles and policies are assigned. The phone and the endpoint are assigned their different corresponding VLANs. The switch also shows the correct VLAN for each device, but the authentication will fail. The phone is using Mac Authentication Bypass since its not 802.1x capable and the UAC is authenticating it correctly thorugh the configured mac authentication server. I've seen some configuration examples on the Cisco forums and the switch should display 2 separate domains on multi-domain mode. One for DATA and one for VOICE but in my case, both appear as UNKNOWN. I've seen there is a special RADIUS returning attribute to tell the switch that the traffic coming from the phone should be assigned to the VOICE domain: device-traffic-class=voice I've been trying to insert it into the RADIUS policy for the IP Phones role but I'm getting a warning message: Selection of mismatching VSA attributes, could result in rejecting the device. I'm inserting it as Attribute: Cisco-AVPAIR Value: device-traffic-class=voice Is that the correct syntax? Thanks!
... View more
08-19-2010
04:53:AM
Hi, we are currently testing the MAC adress authentication feature of the IC series. We have IC-4000, Cisco switches and a Cisco phone. What we want to do is to connect an endpoint to a phone, and the phone to the switch. The phone voice traffic should go to a specific VLAN and the data from the PC connected to the phone should be sent to a different VLAN, depending on the success of 802.1x authentication and the assigned roles depending on the host checker compliance, etc. The switch port is 802.1x enabled and switchport voice vlan is set to 3. On the IC Newtork Access > Radius Attributes, we've set a new policy por VoIP phones: VLAN = 3 Return Attribute: tunnel-type 13 tunnel-medium-type 6 tunnel-private-group-id 3 This configuration is currently working for other VLANs where 802.1x endpoints are being connected directly to the switch with or without Oddyssey Access Client The problem is that although the IC seems to be assigning VLAN = 3 to the phone and its corresponding role, and VLAN = 30 to the endpoint connected to the phone, and its corresponding role, (checked this on Log/Monitoring > User Access) the switch's interface keeps showing the native access VLAN, which in this case, is = 1. I've been checking Cisco forums for switch configuration and everything seems to be ok so I wonder if there is any parameter I'm missing on the IC configuration. Thanks, Gorka.
... View more
Latest Tags
No tags yet
© 2017 Pulse Secure, LLC. Use of this website assumes acceptance of our Legal Notices and Privacy Policy.
Pulse Secure has updated its Privacy Policy effective June 28, 2017.
