About Kamran_

Kamran_ · ‎03-28-2011

Hi eng_mahmood48 1. you got answer for your first question..that is very simple 2. but for second, you should study and experience yourself as its quite difficult to get what Stanislas P is trying to say..but further if you need any guidance i can help you in deployment. i deployed it recently in an organization in Pakistan. Actually i ll feel pleasure if i can help you in any regard as you also belongs to Pakistan. I am giving my cell no. Regards, Raja M Kamran +92-322-3932963

Kamran_ · ‎02-15-2011

on OAC it shows session terminated...but sometimes it is "session established". Regards

Kamran_ · ‎08-11-2010

Dear Ala check whether protocols are same in OAC profile you configured on client machine and in IC-4500 Authentication protocol Set. There should be same protocols in both and try to be in same order if there are more than 1. In IC-----> Authentication->Signing In-->Authentication Protocol Set there can be EAP-TTLS / EAP-PEAP (atleast one outer protocol) also for inner there should be EAP-JUAC + EAP-MS-CHAP-V2 in both PEAP or TTLS. In OAC--->Configuration-->Profiles--->Authentication There should be at least one outer protocol as in IC-4500 (EAP-TTLS / EAP-PEAP) Then in TTLS Tab there should be EAP as inner protocol selected and add EAP-JUAC + EAP-MS-CHAP-V2 same can be in PEAP Tab. ***EAP-JUAC is must for Odyssey Access Client (with agent configuration) Regards, Kamran

Kamran_ · ‎07-26-2010

Hi all, i am getting Session Terminated on Client systems in OAC.. Layer 3 session terminated by IC but layer 2 succeeded...but not on all systems. why..????? plz help me in this regard Regards, Kamran

Kamran_ · ‎07-26-2010

i m getting sbr error 24575 1. Radius: The Auth flood queue has dropped 1 packet(s). 2. Radius: Dropping one new request from due to overload. Also in user logs. 1. Inner authentication failed. but when i restart IC services it works fine for sometime..but after that same behavior... what should i do...?? plz help me in this regard.. Regards, Raja

Kamran_ · ‎02-18-2010

hi, Actually i wanna use External SBR because of IC-4000 internal SBR service continuously stop and start after different intervals and creating problems in OAC authentication.

Kamran_ · ‎02-08-2010

hi, i got event SBR 24575 in IC-4000 event log. Log file's snapshot is attached. when this error occurs dot1x connections failed with error inner authentication failed on Odyssey Access Clients. help me in this regard Regards, Kamran

Kamran_ · ‎01-28-2010

hi will u plz tell me how u have done machine authentication with sbr, i am new to sbr, i was using IC-4000 sbr's instance for dot1x authentication...now i wanna go for separate sbr, i have sbr 6.1, plz tell me detailed config steps on sbr and ic-4000 along with switches if required. regards raja

Kamran_ · ‎01-27-2010

hi addition to my question, In SBR, Ic-4000 will be the client of sbr or all switches will be the client of sbr. at present all switches are client of ic-4000. plz guide me in this regard Regards Raja

Kamran_ · ‎01-27-2010

hi i need help in configuring SBR 6 with already running IC-4000 setup, at present IC-4000's builtin SBR's instance is used. Now i wanna use external sbr server for dot1x authentication. On IC-4000 Active directory server is used for authentication. What minimal changes are required in my current setup? Regards, Raja

Kamran_ · ‎01-11-2010

Thanks Stanislas, you gave me very valuable information. Thanks alot again. Regards, Raja

Kamran_ · ‎01-06-2010

Basically resources are restricted by roles. When a user goes for resources behind firewall, firewall will go to Infranet Auth which you have configured in Firewall earlier, infranet auth (ic-4000) will check that user against roles assigned to it and push information regarding that role to Firewall and an Auth table will be maintained for that user with his role on Firewall.. Regards, Raja

Kamran_ · ‎01-06-2010

hi Thanks Stanislas for ur reply, sorry i forgot one more thing ..with First IC-4000 i already purchased cluster license. Means i have these licenses with First IC-40000 1) add 500 simultaneous endpoints to IC 4000 2) add UAC to installed odyssey client on IC 4000 3) IC-4000-CL Q1) So now still i need CL license with new hardware or this license will work which i have purchased with First IC-4000.. or if in future i wanna add one more hardware, then, i have to purchase one more with that hardware... is Cluster license is also hardware dependent..??? or i can say that for every ic-4000 to be a member of cluster i need to purchase one more cluster license for that hardware Q2) What is External Load balancer? is this a software / a hardware ? Kindly provide a bit details about few brands available? Regards, Raja M Kamran

Kamran_ · ‎01-05-2010

Juniper's documentation ...i cant understand that...ok let me explain my requirements. 1) I have one IC-4000 working fine in my environment, i wanna go for its backup or redundancy u can say that.. 2) i wanna know that should i have to purchase just one more hardware or licenses also...if yes then which liceses 3)on first IC-4000 i have these licenses add 500 simultaneous endpoints to IC 4000 and add UAC to installed odyssey client on IC 4000 4) In documentation there is a load balancer in Active/Active. What is this where can i get this..??? Regards, Raja

Kamran_ · ‎01-05-2010

hi thanks for reply but Just IP..??????? i asked for detailed steps.. regards Raja

Kamran_ · ‎01-04-2010

Hi everybody, i wanna deploy 2 ic-4000 as Active / Passive mode, also need information regarding load balancer, plz guide me through detailed steps for creating Active/Passive cluster..At the moment 1 IC-4000 is working with isg-2000 as enforcer in my environment.. Guide me what configuration changes are required on Firewall / OAC Agent also. how many IP addresses are required. on OAC there is already one IP address is configured (IC-4000 current) Regards, Raja

Kamran_ · ‎10-29-2009

hi thnx for replying but is there any solution or sug other than that..?? Regards, Raja M Kamran

Kamran_ · ‎10-29-2009

hi how r u manoj i got few error (Critical) on IC-4000 event log (snapshot is attached along with log file).. juniper.events.txt --> replace .txt with "log" Regards, Raja M Kamran

Kamran_ · ‎10-29-2009

hi manoj n everybody i got few error in IC-4000 events (related snapshot along with logs attached)... juniper.events.txt--> replace .txt by 'log' Regards, Kamran

Kamran_ · ‎02-22-2009

Hi all My scenario is One Lan firewall isg-2000, One IC-4000, 4 Zones, Trust (Servers), Untrust(endpoints/clients), DMZ (IC-4000), WAN (other Site) i m using 802.1x on switches, OAC is installed on every client system, IC-4000 works as Radius. problem is that everything is working fine except Outlook 2003, one more thing every client system is XP SP3 with office 2003. outlook connection is continously drops and restored why..????? On firewall ANY->ANY policy is configured for all zones. IP address schemes are different for Trust, Untrust, DMZ and WAN i have also configured three VLANS on every switch, 1 is Secure, 2 is Remediation, 3 is Quarantine users with fully compliance are in Secure (1), users with little problem like antivirus not updated or installed are in Remediation(2), users without Computer Certificate are in Quarantine(3). i also wanna know how can i block remediation Vlan users to restrict access to Trust Zone, resource access policies also how can i utilize isg-2000 more efficiently in my network. Thanks / Regards Raja

Kamran_ · ‎02-22-2009

Hi all sorry for interrupting but i have same issue a little bit my scenario is One Lan firewall isg-2000, One IC-4000, 4 Zones, Trust (Servers), Untrust(endpoints/clients), DMZ (IC-4000), WAN (other Site) i m using 802.1x on switches, OAC is installed on every client system, IC-4000 works as Radius. problem is that everything is working fine except Outlook 2003, one more thing every client system is XP SP3 with office 2003. outlook connection is continously drops and restored why..????? On firewall ANY->ANY policy is configured for all zones. IP address schemes are different for Trust, Untrust, DMZ and WAN i have also configured three VLANS on every switch, 1 is Secure, 2 is Remediation, 3 is Quarantine users with fully compliance are in Secure (1), users with little problem like antivirus not updated or installed are in Remediation(2), users without Computer Certificate are in Quarantine(3). i also wanna know how can i block remediation Vlan users to restrict access to Trust Zone, resource access policies also how can i utilize isg-2000 more efficiently in my network. Thanks / Regards Raja

Kamran_ · ‎02-22-2009

hi check Authentication Protocol Set in IC-4000 interface and OAC protocols at Endpoint, both should match Regards, Raja

Kamran_ · ‎12-23-2008

hi everyone i need information in silent deployment of OAC on client desktops without any user interaction with preconfig file in IC for GINA and other settings. plz help me in this regard Regards, Kamran

Kamran_ · ‎12-22-2008

hi 2 all i have ic-4000 , i m facing problem in making resource access policies for different roles / vlan, plz guide me easy+necessary steps for doing this both on IC and Juniper Firewall

Kamran_ · ‎09-29-2008

one more thing i found out IC doesnt check computer / machine membership in groups...!!! is it true.?? bcz i have added user and computer in same group suppose Finance, then it was working when i removed user from finance and then login again it didnt get finance Vlan...why..??? thanks Raj

Kamran_ · ‎09-29-2008

dear Manoj thanks for ur help, its working now, host checker policy for computer certificates working f9, but another problem that i m facing is new user whose profile is not on system cant login... !!!!! i tried various combinations of authentication through OAC client but its not working actually problem is that Computer get IP from DHCP after user's login-->OAC connects to IC-->user authentication performs-->VLAN assignment now plz help me in this regard. i want computer get ip before user's login..bcz i m just checking computer certificates and VLAN assignment based on computer groups.(dept wise computer groups) or if u can suggest me better solution then plz u r welcome Thanks / Regards Raja

Kamran_ · ‎09-21-2008

hi everyone, Thanks alot Mr. Manoj for your great great help, one more thing i wanna discuss with u i.e Authentication time, it takes alot of time before getting an ip.. what configuration steps required on switch / IC / Client for getting faster response in authentication. OAC takes a lot of time in authentication and Vlan assignment also on IC user logs shows after a great delay why..??? Logs of 9:45 appear on IC after 10:10 why..?? however i m continously pressing update update n update..?? Thanks Raja M Kamran

Kamran_ · ‎09-18-2008

hi Thanks alot Mr. Manoj for your kind help now i m on my way...i just upgraded my IC now these option are available to me like Authentication protocol set, actually i was using UAC 2.0 R2 version... Now i ll tell u soon about my progress .... Once again i m very grateful for ur quick and helpful responses .. one thing i wanna ask which certificate attributes i can use for checking Client system validation.. reply me with CA attributes.. Thanks Take gr8care Raja M Kamran

Kamran_ · ‎09-16-2008

hi I am still facing difficulties in login using certificates.....give me suggestions what to do..???? i have told you i wanna check computer certificates not user....but in OAC properties when i click on certificate it shows only user's certificates not computer certs. if u want to give suggestions regarding changes in scenarios plz go ahead. i m tired now....it is very................................................difficult actually my Goals are 802.1x implementation using only computer certificates...users have no certificates dynamic vlan assignment based on computer groups(department wise) AV, Patches check and remediation Remediation Vlan assignment if point no. 3 fails Quarantine Vlan assignment if point no. 1 fails (computer has no certificate) Question arises in my mind..!!! whether i use firewall as a inforcer or not ???..why.??? Is it possible both computer certficates checking and group membership checking (2 different servers CA /AD)..?? what configurations are required at client (OAC configuration) + XPSP3 802.1x configuration..?? Plz help me.!!!!! Raja M Kamran

Kamran_ · ‎09-10-2008

Hi Thanks for your immediate response, but i m facing few difficulties...... 3)Createa New Authentication Protocol set. you can have two possible configurations here(choose any one): a) remove EAP-TTLS and EAP-PEAP from the selected protocols list and add EAP-TLS and save the auth protocol set by giving some name to it. b) remove EAP-TTLS from the selected protocols list and under PEAP section remove exisitng entries under selected protocols and add EAP-TLS only and save the auth protocol set. Manoj where is this feature in IC-4000's web interface, i cant find anything like this.. Few more questions for you: I wanna check patches for Windows, Oracle, MS Office etc. Also whether IC-4000 can update Patches or Antivirus automatically..??? one more thing, that i wanna do to check a registry entry, if this entry is not available on a client system it should be disallowed to access network and also send mail to Administrator. Domain name of client machine must be verified first before assigning IP address by DHCP. Also tell me how can i use ISG-1000 Firewall as an enforcer with 802.1x (Computer Certificates). Or give me suggestions what changes can be done to my scenario to achieve required goals . Thanks / Regards, Raja M Kamran

Re: UAC deployment questions

Re: Session Terminated in OAC

Re: IC4500 Host Enforcer configuration and authen...

Session Terminated in OAC

SBR error messages

Re: SBR 6.0 with IC-4000

SBR 24575

Re: network user authentication windows SBR

Re: SBR 6.0 with IC-4000

SBR 6.0 with IC-4000

Re: IC-4000 Cluster

Re: UAC IP enforcement solution

Re: IC-4000 Cluster

Re: IC-4000 Cluster

Re: IC-4000 Cluster

IC-4000 Cluster

Re: IC-4000 Logs (Critical Errors)

IC-4000 Logs (Critical Errors)

IC-4000 Logs (Critical Errors)

IC-4000 resource policies and isg-2000

Re: UAC with IC4000 and 802.1x - Remediation quest...

Re: L3 and L2 UAC Deployment with linksys SRW248G4

OAC deployment at clients

Resource Access Policies

Re: How to check Computer Certificates on clients ...

Re: How to check Computer Certificates on clients ...

Authentication Time

Re: How to check Computer Certificates on clients ...

Re: How to check Computer Certificates on clients ...

IC-4000 issues continued.....