- Pulse Secure Community
- :
- About Stanislas P_
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
since
10-29-2017
10-29-2017
Stanislas P_
Contributor
35
Posts
0
Kudos
4
Solutions
01-10-2013
04:09:AM
there is no requirement for number of licenses to be equal on both the devices. you need 1+2+4 the IC4.5K-HW is for spare units. Regards,
... View more
01-10-2013
02:07:AM
Hi, the new model is: - 2 boxes with licences - N user for box 1 - M user for box 2 - If the box 1 fail, the second box will accept N+M users on the second box with a maximum of M*2 during 10 days (time to replace the first box) If you buy a box without licence, the second box will accept 0*2 = 0 to allow 1000 users on the second box, you can buy 500 users for the second box or the clustering licence. Regards, Stanislas
... View more
12-06-2012
12:22:AM
Hi, UAC host checker is only available with JUAC inner authentication of TTLS and PEAP. JUAC protocol requires Juniper agent (Pulse or OAC) on windows platform only. You can authenticate Mac OS X clients with TLS or PEAP/MSCHAPV2 protocol without host checker. Regards, Stanislas
... View more
10-29-2012
01:36:AM
Hi, What do you mean about multiple Production VLAN? Do you need to configure different vlan assignment based on switch location or user LDAP group? the Guest VLAN asignment must be configured on the switch and not on the IC! Regards, Stanislas
... View more
10-09-2012
02:28:AM
Hi, When a computer with OAC connect to the switch port, there is the 802.1x communication. At the end, the IC send to the switch RADIUS attributes (VLAN, ...) to the computer the IP address for the realtime connection After 802.1x, the OAC connect to the received IP address through HTTPS If the IC is not available from switch, it will redirect next authentication to the secondary IC. existing connections won't be disconnected by the switch to connect to the new active IC. The HTTPS connection will time out and is displayed as "Terminated" If you want to keep connection from OAC, you need to define IC as active / Passive cluster to share one IP address or as Active / active Cluster with an external Load balancer. Regards, Stan
... View more
10-08-2012
12:57:AM
Hi, Since UAC 4.2 : Junos Pulse Access Control Service (UAC) 4.2 on MAG2600 Previously, the MAG2600 platform only supported Enterprise Guest Access licenses. In Pulse Access Control Service (UAC) 4.2, the MAG2600 platform may be deployed as a complete Juniper UAC (NAC) appliance, with up to 200 concurrent user licenses, addressing network access control for small-to-medium sized businesses (SMBs), branches, or for small segments of larger enterprises. Source http://www.juniper.net/techpubs/software/ive/releasenotes/j-sa-sslvpn-7.2R1-whatsnew.pdf Regards, Stan
... View more
09-25-2012
06:44:AM
when you configure a host checker restriction on a role, this host checker is added automatically as Evaluate in all realms mapping it. So the warning will be displayed because the realm evaluate the host check and one role was unavailable due to this restriction. Regards, Stanislas
... View more
09-25-2012
12:05:AM
Hi, I think your configuration is complex! You must create 2 roles: - AD_user_Compliant (with host checker restriction) - AD_user create one role mapping rule username=* => roles AD_user_Compliant and AD_user configure 2 802.1x attribute rules Rule 1 : role AD_user_Compliant VLAN 10 Rule 2 : role AD_user VLAN 20 if the host is compliant, the VLAN 10 is applied, if not, the VLAN 20 is applied and the OAC display a warning Regards, Stanislas
... View more
08-06-2012
02:40:AM
Hi, the error explain that you can't configure dot1x max-count if port-security is enabled! in your configuration, disable the following configuration: port-security port-mode userlogin-secure-or-mac Regards, Stanislas
... View more
05-22-2012
04:20:AM
Hi, to configure UAC, you need a Infranet Controler which is a RADIUS Server. Regards, Stanislas
... View more
05-10-2012
02:54:AM
Hi, in a configuration with both IP Phone and PC are connected on the same switch port, the configuration is the folowing: - Data VLAN is configured as Access VLAN - Voice VLAN is tagged with 802.1Q In 802.1X, RADIUS server can provide only VLAN number for Acces (without 802.1Q tagging) for the Voice VLAN, you need to configure the voice VLAN on the switch port, and configure the RADIUS Server (the IC in your configuration) to send attribute : Cisco-AVPair == "device-traffic-class=voice" to use the VLAN configured as voice vlan. http://www.avaya.com/master-usa/en-us/resource/assets/applicationnotes/802_1x_ciscomda.pdf Stanislas
... View more
01-31-2012
02:10:AM
Hi, The IC / MAG is the Management Server for UAC. the CM060 card is a Management card for the MAG 661X appliances, not for the configuration of Services Cards. (you can remotely restart cards, access to the console port...) If you want to centralise configuration of multiple, you can: - Use NSM to configure IC / MAG Appliance (not very usefull) - Configure policy on one box and use the "Push config" tool to apply it on all other appliances. Junos Space is not able to manage Mag appliances Regards, Stanislas
... View more
01-02-2012
12:51:AM
Hello, If you do not need user authentication to assign different VLAN associated to groups, the best solution is Certificate Machine authentication. the deployement of machine certificates is easy with GPO. there is no difference between machine and user authentication in IC. but AD does not support LDAP machine authentication. Regards, Stanislas
... View more
12-29-2011
02:41:AM
Hello, in a UAC architecture, you will install IC (Infranet Controller) in a network available from Switchs and users. If you need to compare UAC with Cisco NAc appliance: IC is the Policy decision point as Cisco NAC Manager In a layer 3 configuration, Infranet enforcer is the Policy enforcement point as Cisco NAC Server The Infranet enforcer (Juniper firewalls) can act as DHCP server, but in most cases, you do not need it. In a 802.1x only configuration, the differents steps are: The switch initiate authentication between hosts and IC. IC push VLAN associated with User identity, Host checker results and Switch location. the host receive the authentication response and the IP address of the IC the host request a DHCP address the router receive the request, redirect it to the DHCP server defined in its configuration (DHCP Helper) the host connect to the IC through HTTPS for real time host checker Regards, Stanislas
... View more
12-28-2011
12:33:AM
Hello, UAC can act as: - Network access : 802.1X enforcement - Infranet Enforcer : Layer 3 enforcement with a Juniper SRX or SSG/ISG firewall as enforcer - Host enforcer : Local Layer 3 enforcement by.the Oddyssey client The Infranet Controler is the Policy decision point of UAC.it act as Radius server for 802.1X, captive portal and for Layer 3 enforcement. you can download the quick start guide here : http://www.juniper.net/techpubs/software/uac/4.1xguides/j-ic-uac-4.1-quickstart.pdf Regards, Stanislas
... View more
12-20-2011
03:14:AM
you need to create a new package with "setting update file" option. it will create a package with configuration and without new install. Regards, Stanislas
... View more
12-20-2011
01:25:AM
Hi, The Authentication Realm is identified by the protocol set used Mac authentication use PAP protocol 802.1X use EAP protocols Regards, Stanislas
... View more
11-21-2011
03:14:AM
Hi, You can't use 802.1x Vlan assignment with clientless configuration. clientless need Infranet Enforcer (ScreenOS or Junos Firewall) as Layer 3 enforcer. 802.1x need either OAC or JunOS Pulse. with one of these clients, the host is checked before the first VLAN assignment. there is no temporary vlan assignement as some other unsecured NAC competitors. Regards, Stanislas
... View more
10-05-2011
09:13:AM
You will need to import the Public CA certificate which signed your certificate and all the certification tree of this CA! Stanislas
... View more
10-05-2011
08:10:AM
Hi, What do you mean by "trusted CA"? a trusted is a CA you trust. you can use different trusted CA: - Public CA as Verisign, Thawte, ... - Private CA you need to add as trusted CA in your PC! (in AD GPO ou manually on IE / Windows) Regards, Stanislas
... View more
10-05-2011
06:35:AM
Hi, What is your authentication method? OAC, Junos Pulse, Captive portal? The certificate signed by Openssl is used for IE connection and for User access. Add the Openssl CA cert (same as you added to the IE) as trusted CA in Windows (for OAC, Junos Pulse or Captive portal with Internet Explorer or Chrome) or Firefox (for Captive portal with Firefox) Stanislas
... View more
10-05-2011
12:33:AM
Hi, For IC, you can create a internal certificate ( Microsoft Certificate authority, Openssl, ...) to sign the CSR generated on the IC. the procedure to create this certificate with openssl is described on the admin Guide. To ignore warning message, you can use one of following methods: - add the CA certificate as trusted certificate authority in the AD GPO. (to ignore message when using captive portal with IE) - Add the CA Certificate as trusted Certificate in OAC Configuration before generating pr_-configured OAC installer. this certificate will be included in the OAC intaller. Stanislas
... View more
08-11-2011
05:07:AM
Hi, the "force off" is initiated by the IC through the EAPoHTTP connection (connection to IC). this connection is configured in the Network access policy applied to the role -> Interface If this parameter is set to "Automatic (use configured VLANs)_", the OAC will access to the IP in the same network as the PC, or IC Internal port address if the IC do not have IP address in the same network. Did you configure a default gateway in the DHCP server for UserVLAN Network to connect to IC Address (defined in you screenshot in the quarantine VLAN)? Regards, Stanislas
... View more
08-01-2011
01:42:AM
Hi, 1 - If you need to use Host checker, you must authenticate with EAP-TTLS or EAP-PEAP with EAP-JUAC inner authentication. 2 - Why authenticate on an external RADIUS server for Certificate authentication? IC is able to authenticate users and workstations by certificates. read the following extract of Administration Guide: Note: When RADIUS proxy is used, realm or role restrictions cannot be enforced. Host Checker policies, Source IP restrictions, and any other assigned limits are bypassed. Use RADIUS proxy only if no restrictions have been applied. The exception is that session limitations can be enforced for inner proxy. With outer proxy, no session is established._ 3 - when defining 802.1X Authentication protocol set, the realm is not "configured only to accept 802.1x_". it is configured with defined 802.1X protocols during 802.1X authentication. Stanislas
... View more
07-26-2011
06:21:AM
hello, when you create the MSI file, you can create an "update package". this package include configuration only. Stanislas
... View more
07-07-2011
01:54:AM
Hi, A customer want to identify corporate hosts. the directory is Novell, so he can't deploy certificates as we can do with AD and Certificate authority. I proposed to create a registry key or identify a Novell reg Key to identify corporate hosts. the customer prefer identify corporate hosts by Mac Address (I know, it's not a secured solution) the customer have an iventory containing all mac addresses of corporates hosts(1000 hosts) and I don't know if the Mac address host checker can support 1000 entries in a production environnement. Is there someone who use this configuration in a production environnement? Is there another solution to identify corporate hosts in a novell architecture? Regards, Stanislas
... View more
03-17-2011
04:45:AM
Hi, When you deployed OAC, did you create a Oddyssey Custom installer? If you used a custom installer, - edit your initial settings / Macchine Account settings as you did to create the installer - add the new certificate as trusted server - create a new installer with "setting update file" option - Deploy this MSI file with your deployement tool! Regards, Stanislas
... View more
02-28-2011
08:40:AM
Hi, YES, you can't use the self signed certificate for IC / IE Communication. you must create a new CA (or use your organisation CA if exist) to sign IC Certificate and import CA certificate as Tusted certificate in the firewall configuration. follow Administration guide to create a new CA and generate IC Certificate. Regards, Stan
... View more
02-24-2011
01:26:AM
Hi, in IC configuration, you can choose : - Certificate authentication : Add CA in Administration / Certificate / Trusted Client certificates, create a Certificate authentication server and use this Auth server in the realm used - AD Authentication based on the host name / password on the domain. You must use AD/NT and not LDAP for machine authentication in OAC, in tools / Oddyssey Access Client administrator / Connection settings / machine account, check "enable network connection using machine account". Configure 802.1X authentication in tools / Oddyssey Access Client administrator / machine account as you configure user authentication in the main window. Stan
... View more
02-23-2011
06:25:AM
Hi, 1 - what is IF? 2 - UAC Administration Guide page 70. http://www.juniper.net/techpubs/software/uac/4.1xguides/j-ic-uac-4.1-adminguide.pdf Regards, Stan
... View more
Latest Tags
No tags yet
© 2017 Pulse Secure, LLC. Use of this website assumes acceptance of our Legal Notices and Privacy Policy.
Pulse Secure has updated its Privacy Policy effective June 28, 2017.
