I have been on and off on forum. Kamran, You should contact JTAC if you see any assertion. are you seeing these assertions continuously? do you have any Standalone IDPs or ISG-IDPs connected to IC? Are you using Co-ordinated threat control on IC? if you donot have any IDPs connected to IC, there may not be much impact to existing user sessions on IC. IC would work normally. if you have IDPs connected to IC, you might see that connection with IDP would have been established again and everything should start working again. in any case, contacting JTAC would help you. Thanks ... View more

Please check with your Juniper SE or your Juniper Account Manager for information on Evaluations. ... View more

please look at the link LTO has suggested. following links also might help you in understanding how DHCP relay works. http://www.juniper.net/techpubs/en_US/junos9.3/topics/task/configuration/dhcp-subscriber-access-dhcp-relay-interaction.pdf http://support.microsoft.com/kb/120932 http://www.serverwatch.com/tutorials/article.php/2193031/Back-to-Basics-The-DHCP-Relay-Agent.htm to put it simple, DHCP relay agent(typically a router) will insert IP Address of its interface on which it recieved the DHCP discover message into the DHCP message and relays it to DHCP server. DHCP server looks at the IP of router in DHCP message and identifies from which subnet the request is coming and allocates an IP from that subnet. a simple search on your fav search engine will give you lot of results with good amount of information. ... View more

this is a bit complicated. look at: http://support.microsoft.com/kb/823732 see if you can prepare a script to automate the process mentioned in this Microsoft's KB link. if you can prepare a script to perform the operations, use "Session Start/End Scripts" feature of IC/OAC and trigger the script. ... View more

can you post screenshots of your role mapping rules page and radius attribute policies page? also mention to which role you enabled notepad host checker policy. I wanted to look at the order of roles and radius attribute policies. ... View more

You need to install device cert(server certificate) on IC And CA cert on FW. as some one mentioned above, you donot need to install device cert on FW. FW needs only CA certificate of CA which issued certificate to IC. reply, if you are still facing the issue. ... View more

create a username based role mapping rule and mention * as user name in the role mapping rule and and select the roles to which you want to map the users to. this will map all authenticated MAC addresses to the selected roles. ... View more

this will work on any of the IC hardware. you can use machine authentication feature of OAC to get this to work. please read admin guide of OAC for details on how to do machine auth and read admin guide for details on how to configure IC for 802.1x if you got any questions about the procedures in docs, please mention here. ... View more

See if this helps: http://www.avaya.com/master-usa/en-us/resource/assets/applicationnotes/dot1x-cisco-96x.pdf ... View more

on switch: set system authentication-order radius set system radius-server <IC IP> secret <shared secret> set system login user remote class super-user (configure whatever class that is required) Configure following on IC: configure an auth protocol set on IC and select PAP/CHAP configure AD auth server in IC configure a realm and mske it use above created AD Auth server for authentication and create role mapping rules configure a sign-in policy and attach the realm and auth protocol set to it create location group and attach it to above created sign-in policy create EX switch as radius client and attach to above created location group create radius return attribute policy and select the attribute ïJuniper-Local-User-NameÍ and give its value as ïremoteÍ(or what ever you configured on the ex) and apply the policy to the roles to which you are mapping your users. ... View more

In IC's AD Auth server configuration page, make sure that the new checkbox: "Domain Controller is a Windows 2008 server" is checked. this checkbox is newly added in UAC3.0 R1. ... View more

Look at the attached screenshots. 1)click on 'Groups' button in role mapping rule based on 'group membership' page in IC. 2)then search for groups. 3)once search is done, IC makes the 'selected' groups available for use in role mapping rules. Message Edited by ManojReddy on 03-30-2009 02:46 PM ... View more

for Kerberos to work, time difference between AD server and IC shouldn't be more than 2 mins(Microsoft enforces this). please make sure that IC's and AD's time is in sync. ... View more

Martin, >>With regards to the IDP integration, how will I do this ? do you have a Juniper Network's standalone IDP or do you have IDP security module in the ISG-1000? either way, before you start configuring IC for integration with IDP you need "Coordinated Threat Control License" on IC. do you have the license already? Thanks Manoj ... View more

Regarding Outlook, try allow all in both directions,enable traffic logging on the policies. start outlook and see traffic log to findout what ports the exchange server and clients use and then remove allow all policy and create a policy allowing only the ports outlook/exchange works on. you can have following resource access policies on IC for controlling access from remediation and quarantineVLANs: 1) for Secure Role allow all 2) for Quarantine Role Allow access only to servers you want(like AD server or server from where user can get certificate for becoming complied to your certificate policies ..etc) 3) For Remediation Rolle Deny All (or allow only resources you want to allow) make sure you enabled 'infranet-auth' for policies towars Trust zone. otherwise ISG will not honor the resource access policies you created on IC. Message Edited by ManojReddy on 02-25-2009 12:33 PM ... View more

Infranet Controller doesn't have in-built reporting capabilities. if you are using Juniper Networks NSM to manage IC, it has some reporting capabilites for UAC. using NSM you can create your own reports too. you can also configure IC to send logs to a syslog server and you can have your own reporting tool query the syslog server and generate reports. ... View more

Solution-1(simple and strainght forward): Use Kerberos SSO(this works only using OAC and if end-point is joined to domain):- if the users are logging into IC(using OAC) from an end-point which is joined to domain and user logged into PC as a domain user: Configure Forest root's domain controller as AD Auth server in IC and give root domain's admin username password in auth server config and enable "Allow Trusted Domains" setting in Auth server config on IC. Configure your realm to use this AD Auth Server for authentication and make sure 'Enable SSO' checkbox is checked under: Users->User Realms-> your realm-> Authentication Policy -> SSO tab in Admin UI. note that your relam is realm name that you are using for user authentication. Now login to a computer (as a domain user) which is part of domain(either root or child domain) and start OAC and click on 'connect to infranet controller' checkbox. Now you will be logged into IC as same user who is logged into the domain computer. no need to mention any domain prefix for username. leave the username field as it is and set the password setting in OAC profile to 'prompt for password'. Solution-2(not that easy, requires too much of configuration):- configure domain controller of each child domain in as a seperate auth server in IC and configure seperate realms one for each child domain and make the realm use respective child domain's domain controller as auth server. please reply if this not you are looking for. ... View more

New AD users won't be able to login to Windows as machine doesn't have cached credentials of the new user locally. How to get it to Work: You can enable 'GINA' in OAC When GINA is enabled: after windows user give his username password(in Windows login prompt), OAC captures the credentials, pauses Windows Login and then authenticates user with IC and puts the machine into authorised VLAN(based on your config) and then allows Windows to continue its logon process. when Windows starts login process, machine has IP Address so that it can reach Domain Controller to authenticate new user. Please refer OAC Admin guide and OAC user guide to know about how to enable GINA in OAC. Thanks Manoj ... View more

your problem description "802.1x authentication using computer certificates" mislead me to think that you are using certificate authentication :=) . 1)Use AD as auth server for the realm and create role mapping rules based on AD group lookup and map users to 3 roles(dept role, remediation role and quarantine role in same order) 2)make sure that Certificate CA is added in trusted CA list on IC 3)on IC, create 3 Host Checker Policies a) Custom:Antivirus Policy for checking Antivirus on user's computer. configure what AV parameters you want to check b) Custom:Patch Assement Policy for checking Patches for specific softwares on user's PC c) Custom:Machine Certificate policy for checking computer certificate. make sure you select proper which issued the machine certificate. you can also configure other certificate parameters you want to check for. 4)Assign all three HC policies to dept role and assign Machine Cert HC policy to Remediation role and leave Quarantine role without any HC policies. 5)Now create Radius Attribute policies for each role in following order: a) Applies to Dept Role and returns dept's VLAN ID b) Applies to Remediation Role and returns Remediation role's VLAN ID c) Applies to Quaratine Role and returns Quarantine role's VLAN ID Question arises in my mind..!!! whether i use firewall as a inforcer or not ???..why.??? This matters when you are using non EAP-JUAC as inner auth protocol for authentication(for example when you are using user certs for authentication). IC doesn't know user's IP and can't enforce infranet auth policies on FW. Is it possible both computer certficates checking and group membership checking (2 different servers CA /AD)..?? if you are checking for machine certficates using Host Checker policy YES, it is possible. in this case you don't have to create Certificate auth server. just use AD auth server what configurations are required at client (OAC configuration) + XPSP3 802.1x configuration..?? Nothing fancy. just add the adapter on which you are doing 802.1x and select the profile you want to use and configure required username/password settings in profile. Message Edited by ManojReddy on 09-18-2008 08:30 AM ... View more

> where is this feature in IC-4000's interface, i cant find anything like this.. in IC's Admin UI under: Authentication->Signing In -> Authentication Protocol Sets->New Authentication Protocols Set >I wanna check patches, OS version, Installed applications like Oracle, MS Office etc You can do this by creating a Host Checker policy of "Custom-Patch Assessment" type. inside the Patch Assessment HC Policy select the softwares and patches you want to check for. (refer UAC Admin guide for more details on how to do this). >>Also whether IC-4000 can update Patches or Antivirus automatically..??? IC Can launch Live Update for updating Antivirus signatures. inside the HC policy that you are using for checking Antivirus on end-points: Enable "Download Latest Virus Definition Files" Check box. if this is enabled, When IC checks the users PC and finds that Antivirus definitions are not latest, it will automatically launch the Live Update of AV signatures in the background(user can't see that Live Update is going on). Once, Liveupdate finishes downloading new defintions your AV program will have latest definitions. IC currently doesn't have capability to update patches for any software in users PC. IC only supports automatic update AV definitions. >Domain name must be verified first before assigning IP address by DHCP. This can be done by doing HC checks of "Custom:Registry Setting" type. findout which registry key in windows stores the domain name and create a HC policy to check for that particular registry key and assign the HC policy to a role. if you want to check for NetBIOS name of user's PC, you can create a "Custom:NetBIOS" HC Policy and check for a particular NetBIOS name. Message Edited by ManojReddy on 09-16-2008 11:49 AM ... View more

IC doesn't support the attaching a location group to multiple sign-in policies. regarding enhancement request: please work with your Juniper SE or Juniper Marketing contact. Message Edited by ManojReddy on 09-10-2008 06:49 PM ... View more

I understood you reservations in asking your users to change their usernames. How users are trying to authenticate? are they using OAC or some other client for authentication? I can suggest fewthings based on your response. ... View more

>Why does the Radius client have to be tied to a location group ? if you are not adding radius client to the location group(which inturn is tied to a sign-in policy), RADIUS requests from this orphan radius client are going to be dropped by IC because IC doesn't know which (sign-in policy, Realm and) Auth server to use for authenticating users coming in via radius client. > Do I have to use the location group if I have sign-in policies ? Yes. in otherwords you have to add Radius client to a location group and location group to a sign-in policy. why don't you use different realms for each company and enable following settings for sign-in policy(after adding those realms to the sign-in policy): "User may specify the realm name as a username suffix" and "Remove realm suffix before passing to authentication server" Then create different realms/roles for different companies and use different auth server for each realm. for this to work a user who belongs to realm "company1" will have to give username as [email protected] and "company2" realm user will have to give username as [email protected] IC will strip off the @companyx from username when forwarding it to that companies auth server. sounds good? Message Edited by ManojReddy on 09-09-2008 07:57 PM ... View more

1)Load the CA Certificate onto IC's Trusted Client CA certificates list and select the cert status checking to what ever that suits your deployment. you can set it to none if you are confused. and make sure you select "Trusted for Client Authentication?" checkbox and save settings. 2)Create a new Certificate Auth Server, give a name to it and just save changes. nothing much to configure here. 3)Create a New Authentication Protocol set. you can have two possible configurations here(choose any one): a) remove EAP-TTLS and EAP-PEAP from the selected protocols list and add EAP-TLS and save the auth protocol set by giving some name to it. b) remove EAP-TTLS from the selected protocols list and under PEAP section remove exisitng entries under selected protocols and add EAP-TLS only and save the auth protocol set. 4)you need to have protocol config in OAC profile as well: a)Create a Profile in OAC and uncheck permit login using password check box. b)under authentication tab, remove EAP-TTLS and add EAP-TLS or EAP-PEAP depending upon what auth protocol set you created on IC. if you selected EAP-PEAP, goto PEAP tab and remove existing protocols and add EAP-TLS 5)Under User Infro->Certificate tab select "permit login using my certificate" and "user automatic cert selection" 6)use this profile in OAC for authenticating to IC. 7)Create a sign-in URL in IC which uses the just created auth protocols set and assosciate it with a realm which uses the just created certificate auth server. create roles as per your requirement. 8)create Location group and attach it to this sign-in URL, add radius clients and create radius attribute policies as per your requirement let me know if things are not working. problems with this config is: 1)you won't be able to do host checks 2)you won't be able to use Firewall as Infranet Enforcer with Infranet Auth policies reply if you need to any of the above things. I can suggest other options. thanks Message Edited by ManojReddy on 09-09-2008 12:40 PM ... View more

Hi Seb, How did you install the OAC onto user's PC? ... View more

can do this without making UAC listen on multiple IP Addresses: create multiple location groups and multiple sign-in policies(and realms, roles, radius attribute policies for roles too) attach each location group to a different sign-in URL(make sure you select required auth protocols for each sing-n URL) add each device from your several platforms as a RADIUS client in different location group(or the way you want it to be..). boom, you are done!! I hope you know the rest. ... View more