About Konrad_

Konrad_ · ‎12-11-2013

Thaaaaaank you very much :) Now works great!

Konrad_ · ‎12-11-2013

Thanks ruc for your reply! Maybe I was imprecise, I have interface: internal 192.168.1.5/24 gateway 192.168.1.1 and vlan port on this internal interface: VLAN 120 192.168.10.5 255.255.255.0 192.168.10.1 At the other end of this cable inserted to the internal port I have EX switch with port ge-0/0/44: description MAG-InternalPort; unit 0 { family ethernet-switching { port-mode trunk; vlan { members [ VLAN ]; } native-vlan-id VmyLAN; } } On this EX switch I have direct connection do AD controller with ip 192.168.10.50/24. What I want to do is configured this AD controller as authentication server for one realm. Unfortunately even if I added routing to port internal rouiting table, to send traffic with destination address from 192.168.10.0/24 to vlan interface MAG does not do this - he send all traffic (not paying attention to ANY statis routing) to gateway (192.168.1.1) set to internal port (not to vlan)! Is that possible - force MAG to send authentication traffic to vlan interface - or not?

Konrad_ · ‎12-10-2013

I have Mag6610 chassis + MAG-SM160. I have internal port with address 192.168.1.5/24 (and gateway 192.168.1.1) + vlan port with address 192.168.10.5/24 (and gateway 192.168.10.1). My Active Directory authentication server have address 192.168.10.50/24. Whet I test connection in Troubleshooting > Tools > Ping: - from internal port I can ping to gateway in internal port (vlan untagged works); - from internal port I can ping interface vlan 192.168.10.5 (the same device); - from internal port I can't ping any object from VLAN (Active Directory for example); - from vlan port I can ping my Active Directory server (vlan tagged works OK); - from vlan port I can ping interal port address 192.168.1.5 (the same device); - from vlan port I can't ping any object in LAN 192.168.1.0/24; I try to add auth server 192.168.10.50 - unfortunately: Primary Domain Controller 192.168.10.50 is not reachable. Ok i found information - You must add static route! I added static route to internal port table: 192.168.10.0 255.255.255.0 192.168.10.1 VLAN - unfotunately: Primary Domain Controller 192.168.10.50 is not reachable. I found information - You must enable vlan on User Roles - unfortunately: Primary Domain Controller 192.168.10.50 is not reachable. I debuged this traffic and i found that the source address for this traffic sending to auth server comes from 192.168.1.5 (internal port) Then I found this topic https://forums.pulsesecure.net/topic/pulse-connect-secure/50689-vlans-and-auth-servers/highlight/true#M8810 with information - you must buy IVS license! OK! I try to find IVS license for this MAG - and found information that there is no IVS for MAG!!!! I'm totally depressed - why i can't connect with auth server, what I need to buy or need to enable to achieve connection with autentication server using vlan?

Konrad_ · ‎12-04-2013

Sorry - I found the answer - DNS! I change System > Network > Overview > DNS from public DNS to AD controller ip adress and voila login time does not exceed 3 second!

Konrad_ · ‎12-04-2013

I have Active Directory controller 2008 r2 and I use this for authentication in my MAG. I tested two options - Active Directory/Windows NT and Radius. Login time for Radius does not exceed 5 second. Login time for Active Directory/Windows NT exceeds 30 second. I try to change Kerberos for NTLM and Persistent password caching - without any effect. Is that normal (so long login time - when I use Active Directory) or I have problem with MAG configuration or Active Directory controller. I admit that I would prefer to use Active Directory without Radius.

Re: MAG and Auth Server using vlan.

Re: MAG and Auth Server using vlan.

MAG and Auth Server using vlan.

Re: Radius much faster than the Active Directory -...

Radius much faster than the Active Directory - aut...