Yes, it's AD2008. ... View more

Hi,   I've managed to solve this problem. The problem was with Active Directory Legacy Mode. Apparently it does not support EAP-PEAP with MS-CHAPv2, although the IC documentation stated only that the native Active Directory mode is RECOMMENDED for 802.1x with MS-CHAPv2. There is no sentence about Legacy mode not supporting it at all.     ... View more

Did somebody managed to resolve this issue? ... View more

YES!!! That was it :) Auth was successful, network is working. I've used a preconfigured settings file with downloaded Junos Pulse Client msi installer.  Example command: msiexec -i JunosPulse.msi CONFIGFILE=c:\temp\myconfiguration.jnprpreconfig   After that I have my Local connection in Pulse UI. When connecting I'm prompted for username and password. And finally only one license is eaten up on the IC :)    It makes me curious, though. Previously I've deploed Junos Pulse Client by allowing full access to the network for the PC and then opened up the IC in the browser. The realm has agent option (Pulse) enabled on it. After successful installation there was no 802.1x connection in the UI. Maybe automatic preconfig installation is available only with the agentless option You've suggested and with manual installation? I will try the agentless option later.   Thank You for Your help. Sometimes the answer is so close that we don't see it :) ... View more

@kalagesan and @apaul   What I've done: -reset IC services -set Juniper EAP-TTLS as an auth method in windows 802.1x supplicant -set "anonymous" in properties of this EAP-TTLS method in the field "Anonymous" -verified that on the IC in Users-->Junos Pulse-->Connections-->Default i have only one connection called dot1X of type (UAC 802.1x) -verified that in dot1X I have Outer username set to anonymous and that I trust Client side CA server   After those changes I get the same messages as I did previously - auth unsucessful contact administrator. The logs from Junos Pulse Client are useless because the client waits for the 802.1x auth and only then connects to the IC via IP.   I wonder about one more thing. My connection dot1X is of type UAC 802.1x but I don't see it on the PC in Junos Pulse Client. What I see there is a connection to the IC IP address (L3). Is this correct?  ... View more

I've set up realm to use local database - no certificates - and on the PC I've set the 802.1x method to EAP-PEAP. After those changes authorization i sucessful. After the user is assigned correct VLAN (as configured on IC) the Junos Pulse connects correctly to the IC. But I see a flaw here :) IC shows me that 2 user licenses are being eaten - one for 802.1x and one for L3. I think it's because the limitation of Junos Pulse that cannot handle EAP-PEAP, as noted in the documentation Junos Pulse 5.0 Admin Guide on page 214.   As far as I know to run a 802.1x UAC deployment with host checker one needs to use EAP-JUAC as the inner authentication protocol. And that's only supported with EAP-TTLS as the outer authentication in Junos Pulse.   So we're back to my orignial question :)   Please correct me if I'm wrong.    @glaberge I don't post the config of my EX because the sucessful EAP-PEAP atuh confirms that the EX<->RADIUS (IC) is working. ... View more

Dear apaul, thank you for Your reply. Before posting this thread I've read every little piece of documentation, KB articles, admin guide, examples that is available on Juniper sites as well as on this forum. Therefore I've read the article You have posted. Unfortunately for me none of those texts solve my problem nor give me any guidance at all. There are plenty of examples of  how to implement 802.1x with different types od EAP with OAC, but not even one with Junos Pulse.   That's why I've reached out to the community for some real-life configurations and examples of 802.1x with Junos Pulse.     ... View more

Hi, thank's for the interest in the case.   1. I was trying to do both. 2. I would like to have a user authentication (using personal keys) 3. When I was trying username based auth it was set to System local with a Realm restriction on personal certificate. When I was trying cert atuh the auth server was set to Certificate server 4. There is no log in User access, Events or via Troubleshooting (session recorder). Capture of pacets on the PC says only that authentication has failed after the creation of outer SSL/TLS tunnel from the switch. 5/6. Under Pulse conncections I've enabled only one connection - 802.1x. This connection has a defined Outer user name as anonymous and a Trusted Client side CA certificate that was used to sign user certificate. At first I've opened the port on the switch to allow dowload of the Junos Pulse client from the IC to the PC. After that I've switched back the switch port to use 802.1x with a RADIUS server (IC). The connection is listed in the Pulse GUI. When I click connect it says: "Waiting for the network" and then I get a notification form windows about unsucessful 802.1x auth.     ... View more