About willem.redelijkh

willem.redelijkh · ‎11-07-2013

Hi Kevin, you are correct if I was using the native Windows dot1x supplicant. The Pulse supplicant (EAP-TTLS) doesn't have this feature. In this case, the certificate warnings option is set in the Pulse configuration on the UAC. Will create a JTAC case for this. When a solution comes along I'll share it here.

willem.redelijkh · ‎11-07-2013

Hi, I have a UAC test environment with an EX2200 (12.3R2.5), SRX100 (12.1X45-D15.5), and a UAC (DTE) server (4.4r6.0). The latter is connected to a Windows 2008R2 Active Directory. I got everything working, but I keep running into a certificate error when I try to connect a Windows 7 client (with all the patches etc. up till today) with Pulse on a dot1x connected port (on the EX2200). The certificate on the UAC is issued from an Internal CA, and this CA is set as a Trusted Root Certification Authority on all domain members. The FQDN of the UAC is uac.lan. When I connect with a browser from the same Windows client, I get NO certificate validation errors, so the basic setup is oke. The Pulse Connection settings for 802.1x on the UAC are configured that the client should accept ANY certificate issued by the internally trusted CA which issued the uac.lan certificate (I didn't type the ANY word, I left it blank, and ANY was automatically inserted). The error on the Pulse client is that the server is not listed in the Truster Server listing (on the UAC I presume), but I say it is. Everytime I try to connect the network, I get the error. Even when I check the Remember Settings button. Somehow the Pulse client won't listen to the config of the UAC, and/or the user input. When I add a L3 connection to the UAC, the authentication goes as expected. No warnings whatsoever. Anyone any ideas on this?

willem.redelijkh · ‎06-07-2012

Hi all, I've a customer with a Juniper Network (FW, EX-Switches, UAC, SA, the works). They have a 10+ story building with (Juniper) wireless. Wireless is implemented with two Wireless Controllers. The idea is to assign the users on each floor a specific VLAN for that floor. Wireless authentication is done by using 802.1x (UAC). The reason for this is that we want to limit the amount of users to max 500 per vlan (/23). Since all the AP's are connected to the Wireless Controllers I only have 1 RADUIS source address for filtering on originating traffic. The RADIUS messages contain the name and SSID of the Access Point used by the client, so I can filter on that (especially if we use a good naming convention for the AP's). The only problem is that RADIUS Request Policies can ONLY be used in selecting a realm. While it would be more logical to have this attribute on the role mapping part in the UAC. Having one realm with multiple role-mappings is more logical than working with a lot of realms with only one role-mapping per realm. I would also guess that processing realm could be more CPU/performance intensive that the role-mapping part. So, with the current situation I would need to create 10+ REALMS (at least one for every floor) if I want to assign wireless users in the VLAN for their floor. B.t.w. Static VLAN assignment is not an option. Same goes for different SSID's etc. for each floor. I appreciate any insights into this matter.

Re: Pulse won't accept UAC certificate for Layer 2...

Pulse won't accept UAC certificate for Layer 2 aut...

[UAC] Creating location awareness in role mapping