Juniper NETWORK AND SECURITY MANAGER 2010.3, Administration Manual

Page: 639 / 1016

•
On the RADIUS server, you populate the external user group with XAuth users, leaving
the group unpopulated NSM. The RADIUS server authenticates the users during Phase
1 IKE negotiations.
•
In NSM, you leave the external user group unpopulated, but you must define each user
as a local user with an IKE ID, then create a group that includes those local users as
members. This IKE ID is used to authenticate the users during the Phase 2 IKE
negotiations.
Additionally, you must add the security device and create an Address object to represent
the FTP server, as well as a protected resource. After you have assembled all the VPN
components, you are ready to create the VPN.
1.
Configure the RADIUS Server. On the RADIUS server, load the Juniper Networks
dictionary file and define Xauth user accounts. Use the Juniper Networks user group
VSA to create the user group xa_grp2 and apply it to the auth user accounts that you
want to add to that group.
NOTE: For instructions on loading the dictionary file onto a RADIUS server, refer to the
RADIUS server documentation. If you are using a Microsoft IAS RADIUS server, there is
no dictionary file to load. Instead, define the correct vendor-specific attributes (VSAs)
on the server.
2.
Add the authentication server object. In the main navigation tree, select Object
Manager > Authentication Servers and click the Add icon. Configure the following,
then click OK :
a. For name, enter radius1 . Select a color and add a comment, if desired.
b. For Main Server, enter the IP 10.20.1.100 ; for Primary Backup Server, enter IP
10.20.1.110 ; for Secondary Backup Server, enter IP 10.20.1.120 .
c. For timeout, enter 30 .
d. Enable For XAuth Users.
e. For Server Type, select RADIUS .
1.
Configure the RADIUS server:
•
For server port, select 4500 (default is 1645).
• For secret, enter A56hYY97kl .
•
For retry timeout, enter 4 .
2.
Add an External User Group (in NSM). In the Object Manager, select User Objects
> External User Groups . Click the Add icon to display the New External User Group
dialog box. Configure the following, then click OK .
• For Name, enter xa-grp2 .
•
For Color, select yellow .
589 Copyright © 2010, Juniper Networks, Inc.
Chapter 12: Configuring VPNs