still waiting.... any help.... :( ... View more

Since we use capitive portal in srx uac policy, If I dont use the application-services in security policies than how I can redirect the users towards UAC (captive portal)?   Second I cant understand the behavior of security policy. If I use the source-identity with unauthenticated user and uac-policy with application-services the policy is bypass (not matched even user is still unautheticated), and if I did not use source-identity with application services uac-policy the policy is matched but policy did not allow the user traffic...     ... View more

  Yes I upgrade junos software to 12.1x44d40. I remove all the unified-access-control configuration on SRX then commit and then reconfigure the uac settings, but still no luck.   here is uac configuration on srx ------------------------------------------------------------------------------------------------------------------------------------------------------- set services unified-access-control infranet-controller MAG-UAC address 10.50.50.100 set services unified-access-control infranet-controller MAG-UAC interface reth1.50 set services unified-access-control infranet-controller MAG-UAC password [email protected]   set security policies from-zone Wifi to-zone Internet policy test-uac match source-address Arslan-1.12 set security policies from-zone Wifi to-zone Internet policy test-uac match destination-address any set security policies from-zone Wifi to-zone Internet policy test-uac match application any set security policies from-zone Wifi to-zone Internet policy test-uac then permit application-services uac-policy set security policies from-zone Wifi to-zone Internet policy test-uac then log session-init --------------------------------------------------------------------------------------------------------------------------------------------------------   Following is the output of few show commands.   > show services unified-access-control status                                                             node0: -------------------------------------------------------------------------- Host           Address         Port   Interface     State MAG-UAC        10.50.50.100   11123  reth1.50     connected   > show services unified-access-control roles       node0: -------------------------------------------------------------------------- Name                                     Identifier Trust-User                              0000000001.000005.0   Remediate-User                  1396270434.123514.0 Trust-Agentless                    1395391788.690864.0       GUAM                                      1395991600.414804.0       Guest-Users                          1395992372.36996.0        Corporate-Wifi                        1395994939.110403.0   > show services unified-access-control policies node0: -------------------------------------------------------------------------- Id    Resource                Action Apply        Role identifier 1     10.100.111.111:*          allow  selected     1396270434.123514.0 2     *:*                     allow  selected     0000000001.000005.0   > show services unified-access-control counters                     node0: --------------------------------------------------------------------------     (Counter command showing nothing...............)   Should i use the source-identity in security policy? ... View more

  I try the pass through proxy but still the problem is not solved. Application is open via the SA web access but when I click on any button (like New, Edit etc.) nothing happen, application is not responding and did not open the new dialog boxes or text boxes. Is this the issue with CIE? How can I solve the issue? ... View more

Thanks Kanann/Ashish Paul   @Kanan No... I am using the two different realms for both roles. Reason is because I want to ensure that all the users with role "Users-Wireless" will get agent less connection with no client installation. and the all the users with "Users-Trust" role will have option to install the pulse client via web. I configure two different realms and sign in policies for both roles.   If i configure the same realm and segregate users on the basis of role mapping, then users with role "Users-Wireless" will also start junos pulse client installation whereas we want to get them connected to UAC directly (means no pulse client installation - only the agent less connection).   With dynamic policy evaluation the minimum time I can set for role evaluation is 5 minute. Or I need to manually refresh the role. It means users still can use his active session with the same role but with new IP address. And as the end user IP is change the user remain connected to UAC (using his previious UAC session with new IP address) and with same role. It means however his role is not change on UAC but as his IP is change and he is already authenticated on UAC he start using unauthorized accesses on the basis of his sourece IP address.   @Ashish I disable the Roaming Session option on all the roles. I am using L3 enforcement no 802.1x. ... View more

Thanks a lot Raveen and Kannan.   Actually I want to use NAC for the guest users to access limited internet. Usually we can't bind guest to install client on their mobiles and at the same time we want some minimal compliance enforcement like not allow them to use P2P software, torrents etc. Obviously I have workaround and can control the access on layer 3 on SRX firewalls but I think It was better if we can enforce the compliance via MAG directly.   Hopefully it will be in the future roadmap.   Regards   Arslan ... View more

Thanks Kalagesan problem is solved... I succesfully done SSO using SPNEGO user role firewall.   ... View more

  What the meaning of following log message.   Minor EML20770 2013-02-21 14:47:43 - mem1 - [127.0.0.1] Root::Mail-Proxy()[] - SMTP:   Cannot get default server's Capability because server did not return OK   greeting response. Minor EML20860 2013-02-21 14:47:43 - mem1 - [127.0.0.1] Root::Mail-Proxy()[] - Blocked   read from server did not find delimiter.   Minor EML20770 2013-02-21 14:43:26 - mem1 - [127.0.0.1] Root::Mail-Proxy()[] - IMAP:   Cannot get default server's Capability because server did not return OK   greeting response. Minor EML20860 2013-02-21 14:43:26 - mem1 - [127.0.0.1] Root::Mail-Proxy()[] - Blocked   read from server did not find delimiter.     Second can anyone explain how the email proxy in SSL VPN work? ... View more

Thanks Sir;   Actually i am bit confuse with pulse client software behavior. With L3 enforcement we create the connection on pulse manually or download it from IC. But with 802.1x is it necessary to enable 802.1x in TCP/IP settings? Can we control the connections manually? Can we disable 802.1x in windows TCP/IP connection settings and then use 802.1x? We use pulse as a supplicant but what is windows supplicant? ... View more

  Yes I read this topic in admin guide... Actually I read all the topics in admin guide.... I have confusion regarding provisioning the resources with dynamic ipsec routing policies. This feature is not supported on JUNOS enforcer it is only supported screen os with release 6.3. With this feature we do not need to configure the ipsec policies for each resource on ic.   Any how thanks a lot for the support.   best regards   Arslan Nawaz ... View more

Dear Raveen   I try to explain my query further... I have two Vlans 10 and 20. End point get the ip 192.168.10.11/24 with vlan 10 and ip 192.168.20.11/24 with vlan 20. Both vlans are also configure on IC and on IC vlan 10 ip is 192.168.10.200 and vlan 20 ip is 192.168.20.200. When client connect with vlan 10 my pulse client show a connection name "Local Area Connection" with IP 192.168.10.200 and with IC change the vlan dynamically the pulse client show the "Local Area Connection" with IP 192.168.20.200. As vlan change pulse connection is also automatically change which is understandable.   Now as I moce IC on layer-3 means there is a layer three device between the IC I am not able to connect IC with pulse client? Can I configure manually a connection for 802.1x on pulse client      Pulse-Client (Supplicant) ---->    EX3200 (Authenticator)  --------> L3 Router/Firewall   -----> IC/Radius       The links bw EX3200, Router and IC are layer-3.   Regards   Arslan Nawaz ... View more

Thanks kalagesan and raveen for all the help and support. I will check these solutions....   My question regarding 802.1x and layer-3......???? Regards   Arslan Nawaz ... View more

Dear Kalagesan   My query is regarding the IC. Juniper documentation saying that with screen os earlier 6.1 we need to configure the screen os ipsec policies and an ipsec routing policy for each recource that we wnat to protect however with screen os 6.1 and later IC device can dynamically provision ipsec routing policies so we dont need to configure a seperate policy for each resource.   My question is how this ipsec policy works and how we can configure it? ... View more

Thanks Kalagesan/Raveen for your support.   Can you guide me how to configure reauthentication on EX switch and how I can configure the radius accounting msgs... how i can configure radius accounting messages both on authenticator and IC?   One more question regarding 802.1x...   I understand that suplicant and authenticator must be on layer-2 so they can exchange EAPOL msgs. Is it necessary for IC to communicate with authenticator on layer-2 for Radius communications? I think it is, bcoz pulse client need to access the IC on layer 2 for automatically adding the connection according the vlan client can access. so can we deploy IC so that authenticator communicate with IC on layer-3 and if we can then how can pulse client connect with IC?   Regards   Arslan Nawaz     ... View more

Thanks kalagesan   With dynamic policy evaluation I can set the time minimum 5 mints but I want to close the session immediately user disconnect from the network,   Here I explain the problem I am facing. I implement 802.1x IC solution with EX3200 as an enforcer. I configure two vlans one is employee and second is guest on EX3200. Also I configure the guest vlan as guest-vlan in ex3200 dot1x configuration.   I configure IC with two roles one in Full-Access role and second is Quarantine role. I create a relam and in role-mapping I create a single rule and map both roles with used identities. Full-Access role have host-checker policy to check the user end point before assign him full role if host checker policy on end point fails user assign Quarantine role and if host checker policy pass user assign both Full-Access and Quarantine role.   In Radius Return Attribute policy I configure first policy with Full-Access role return the vlan employee and second policy with Quarantine role return the vlan guest.   As user connect to IC with full fill the host checker policy IC assign the user correct vlan that is employee and user get the full access. During the session user lost the compliance and when host checker policy re-evaluate it disconnect the user re-authenticate and assign the user guest vlan with Quarantine role having restrict access to corporate resources.   Now the problem is when user has guest vlan and at that time user disconnect from network (cable unplug or TCP/IP connection disable) and during the off line time somehow user meet the end point compliance then connect to network again IC not re-authenticate the user nor recheck the compliance instead IC create new session with same vlan and end point IP that IC assign the user previously that was the guest vlan. Although user meet the compliance but user get the limited access with guest vlan.   To solve the problem I remove the connection manually on IC and ask user to re-connect to network or I instruct user to remove the session from pulse and the re-connect to network.   Why IC not assign user right vlan i.e. Employee after user connect to network again with full compliance. IC create new session assign both roles but not return the Employee vlan but user get the guest vlan instead of employee vlan.   Any suggestion or help regarding this issue   Many  Regards Arslan Nawaz     ... View more

Thanks..... Means I must have a license to use 802.1x or Layer-3 Firewall for policy enforcement with IC4000. ... View more

Thansk Viji.. Now I understand this with mobile phone. But can I connect IVE from PC without installing any client software on PC. ... View more