Juniper RADIUS integration

Log in to the Arculix RADIUS Agent as an administrator.

Open the radius-agent-config.env file with an editor.

The file is located in the installed directory of RADIUS Agent. RADIUS clients are configured in this setting.

At the end of the radius-agent-config.env file, set the following configuration for the ARA_CLIENTS attribute:

ARA_CLIENTS = <An optional name for your Juniper>; <Internal IP address of your Juniper>; <a shared secret>

For example, set:

ARA_CLIENTS = Juniper;192.168.10.10/32;testing12345

Save the file.

Run the following command to apply the changes:

docker-compose down && docker-compose up -d

Log in to your Juniper device with an administrative user account and change the mode to Configuration Mode.

Create an IP address pool for your VPN clients:

set access address-assignment pool vpn-pool family inet network <addresses for your VPN clients> xauth-attributes primary-dns <the IP address of the DNS server>

Create an access profile for the RADIUS Agent by entering the following commands.

set access profile arculix-radius authentication-order radius
set access profile arculix-radius address-assignment pool vpn-pool
set access profile arculix-radius radius-server <the RADIUS Agent IP address> timeout 120 retries 2 secret <the shared secret configured in the Arculix RADIUS Agent>
Commit

Create an IKE proposal configuration by entering the following commands. You may need to customize this configuration depending on your security policy; this example is just the basic setup.

set security ike proposal ike-proposal1 authentication pre-shared-keys
set security ike proposal ike-proposal1 dh-group group20
set security ike proposal ike-proposal1 authentication-algorithm sha-384
set security ike proposal ike-proposal1 encryption-algorithm aes-256-cbc
set security ike proposal ike-proposal1 lifetime-seconds 86400
Commit

Create a policy that uses the proposal above and authenticates the client using a pre-shared key:

set security ike policy ike-policy1 mode aggressive
set security ike policy ike-policy1 proposals ike-proposal1
set security ike policy ike-policy1 pre-shared-key ascii-text <the preshared key for your clients>
Commit

Create a gateway to terminate the VPN connections.

set security ike gateway gateway1 ike-policy ike-policy1
set security ike gateway gateway1 dynamic user-at-hostname <user@junipervpn.example.com>
set security ike gateway gateway1 dynamic connections-limit <X>
set security ike gateway gateway1 external-interface <interfaceX>
set security ike gateway gateway1 version v1-only
Commit

Create a tunnel interface that is going to handle the traffic between the external and internal zones.

set interfaces st0 unit 0 family inet
Commit

Create an IPSEC proposal for VPN clients.

set security ipsec proposal ipsec-proposal1 protocol esp
set security ipsec proposal ipsec-proposal1 authentication-algorithm hmac-sha-256-128
set security ipsec proposal ipsec-proposal1 encryption-algorithm aes-256-cbc
set security ipsec proposal ipsec-proposal1 lifetime-seconds 32400
Commit

Create an IPSEC policy for the VPN clients.

set security ipsec policy ipsec-policy perfect-forward-secrecy keys group20
set security ipsec policy ipsec-policy proposals ipsec-proposal1
commit

Create the VPN. Bind the interfaces and policy, and associated traffic selectors.

set security ipsec vpn remote-vpn1 bind-interface st0.0
set security ipsec vpn remote-vpn1 ike gateway gateway1
set security ipsec vpn remote-vpn1 ipsec-policy ipsec-policy
set security ipsec vpn remote-vpn1 traffic-selector ts1 local-ip 10.0.0.0/24
set security ipsec vpn remote-vpn1 traffic-selector ts1 remote-ip 0.0.0.0/0

Open the NCP user interface and select the Configuration tab. Click Profiles.

The profile configuration menu appears. Click Add.

In the new profile wizard window, select Manually configure profile and click Next.

Enter a friendly name for the new VPN client configuration in the Profile Name field and select Next.

Select the media over which the VPN is going to be connected. In this example, we are using LAN. Then, select Next.

Select the usage of certificates to authenticate the client. Certificates are recommended. Select Next.

Configure the VPN gateway and then select Next.

Select the Diffie-Hellman (DH) group to use. This group must match the DH group configured in the vSRX device. Select Next.

Select the user identity that identifies the tunnel to the device. In this example, we are using user@domain. It must match the configuration from step 8 of “Configure the Juniper vSRX device.” Click Finish.

When the profile configuration menu appears, select Edit > IPSEC General Settings. Review the settings and ensure they exactly match the configuration on the vSRX device.

Optionally, you may select Policy Editor and create IKE and IPSEC policies that match the configuration in the vSRX device.

Edit the IKE policy by providing a valid name and setting the authentication method for the tunnel, encryption, and hashing algorithms to match the tunnel IKE configuration. Then select OK.

Edit the IPSEC policy. Provide a friendly name and select the Protocol, Encryption, and Authentication algorithms that match the tunnel IPSEC configuration. Then select OK.

Open the newly configured NCP VPN client and select the sliding control to connect to the Internet.

The VPN client prompts the user for authentication. The user must input a valid Active Directory username and password.

The VPN client sends the credentials to the vSRX device, and the vSRX authenticates the user to RADIUS. If the user’s credentials are correct, the user is prompted to approve the authentication by the Arculix Mobile application, and is then logged in.

What to look for if the connection is unsuccessful: