I just pulled it out from the documentation, and should help to understand the relam selection in IC. I think whenever you are having the issue, the client may be requesting Authentication protocol which is not part of the available realms.       ... View more

Hi Steve , Yes your understanding is right , any 802.1x switch can participate in the captive portal however the enforcement can be done only using the Junos based FW , EX switch and Screen OS firewall. In this case customer wanted a web redirection from the cisco switch, normally web redirection for protected resources are configured on the Juniper supported enforcers and as you said I also believe as long as the vlans are behind either a Junos or ScreenOS firewall as the infranet enforcer our solution should work for this customer. It.s not a must to have a junos switch to use the captive portal. Regards Kannan ... View more

unfortunately, there is not much that can be done if there is no test system and alternate solutions cannot be implemented while working with JTAC. one option, depending on how strict your change control policies are, would be to upgrade as-needed to get logs with JTAC (Rewrite troubleshooting and log collection) and then rollback for production use. ... View more

Hi again, the constore.dat was the culprit - after letting client systems regenerate the local guid it seem that this problem went away. Thanks for the tip! BR, Kalev ... View more

In theory, yes it is possible to have two auth table entries with the same Ip but different user names. But, the IC should eventually clean it up. This can happen in cases where an endpoint does not gracefully disconnect from the IC and thus the auth table is not cleared until the user's session is expired on the IC. If NAT is detected, the IC will not push the auth table down to the IE as the IP is used by the IE to filter access to the protected resource. The only way NAT and auth tables will work is to use IPSEC from the OAC or Pulse Clients. In this case, the IC will send down the IP address issued to it from an address pool. Does that help? Thanks Craig ... View more