Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1, Administration Manual

Page: 457 / 1026

RADIUS server, you enter the IP address 10.20.1.100 and change its port number from the
default port number (1645) to 4500.
Next, you populate the auth user group “ auth_grp2” with auth users on the RADIUS server
only, leaving the group unpopulated in NSM. The members in this group are accountants
who require exclusive access to a server at IP address 10.1.1.80. You create an address
book entry for the server and name the address “ midas.” Finally, you configure a security
policy that permits only authenticated traffic from auth_grp2 to midas, both of which are
in the Trust zone.
1.
On the RADIUS server, load the Juniper Networks dictionary file and define auth user
accounts. Use the Juniper Networks user group VSA to create the user group auth_grp2
and apply it to the auth user accounts that you want to add to that group.
NOTE: For instructions on loading the dictionary file onto a RADIUS server,
refer to the RADIUS server documentation. If you are using a Microsoft
IAS RADIUS server, there is no dictionary file to load; you must manually
define the correct vendor-specific attributes (VSAs) on the server.
2.
In NSM, in the main navigation tree, select Object Manager > Authentication Servers
and click the Add icon. Configure the server:
a. For name, enter radius1 . Select a color and add a comment, if desired.
b. For Main Server, enter the IP 10.20.1.100 ; for Primary Backup Server, enter IP
10.20.1.110 ; for Secondary Backup Server, enter IP 10.20.1.120 .
c. For timeout, enter 30 .
d. Select For Firewall Auth Users .
e. For Server Type, select RADIUS , then configure the RADIUS server:
• For server port, enter 4500 (default is 1645)
•
For secret, enter A56hYY97kl
•
For retry timeout, select 4 .
f. Click OK to save the RADIUS authentication server object.
3.
Configure the External User Group in NSM:
a. In the Object Manager, select User Objects > External User Groups .
b. Click the Add icon to display the New External User Group dialog box. Configure
the following, then click OK :
407 Copyright © 2010, Juniper Networks, Inc.
Chapter 8: Configuring Objects