Mag2600 Pulse Secure
Mag2600 Pulse Secure
Integration Guide
Description
SafeNet Authentication Service delivers a fully automated, versatile, and strong authentication-as-a-service
solution.
With no infrastructure required, SafeNet Authentication Service provides smooth management processes and
highly flexible security policies, token choice, and integration APIs.
The Juniper MAG2600 Junos Pulse Gateway provides SSL/VPN, network access control (NAC) with Unified
Access Control (UAC), or guest access capabilities to SMBs and small and medium enterprises.
Junos Pulse software enables dynamic SSL VPN connectivity, network access control (NAC), mobile security,
and collaboration, through a simple end-user interface. It simplifies and optimizes connectivity to end users at
the same time it checks their device type and security state, location, identity, and adherence to corporate
access control policies.
This document describes how to:
Deploy multi-factor authentication (MFA) options in Juniper MAG2600 Junos Pulse Gateway using SafeNet
one-time (OTP) authenticators managed by SafeNet Authentication Service.
Configure Juniper MAG2600 Junos Pulse Gateway to work with SafeNet Authentication Service in RADIUS
mode.
It is assumed that the Juniper MAG2600 Junos Pulse Gateway environment is already configured and working
with static passwords prior to implementing multi-factor authentication using SafeNet Authentication Service.
Juniper MAG2600 Junos Pulse Gateway can be configured to support multi-factor authentication in several
modes. The RADIUS protocol will be used for the purpose of working with SafeNet Authentication Service
Applicability
The information in this document applies to:
SafeNet Authentication Service (SAS)—SafeNet’s cloud-based authentication service
SafeNet Authentication Service – Service Provider Edition (SAS-SPE)—A server version that is used by
Service Providers to deploy instances of SafeNet Authentication Service
SafeNet Authentication Service – Private Cloud Edition (SAS-PCE)—A server version that is used to
deploy the solution on-premises in the organization
Audience
This document is targeted to system administrators who are familiar with Juniper MAG2600 Junos Pulse
Gateway, and are interested in adding multi-factor authentication capabilities using SafeNet Authentication
Service.
RADIUS Protocol
Local RADIUS hosted on-premises—A RADIUS agent that is implemented in the existing customer’s
RADIUS environment. The agent forwards the RADIUS authentication requests to the SAS cloud
environment. The RADIUS agent can be implemented on a Microsoft NPS/IAS or FreeRADIUS server.
RADIUS Protocol
This document demonstrates the solution using the SAS cloud hosted RADIUS service.
4 3
1. A user attempts to log on to Juniper MAG2600 Junos Pulse Gateway using an OTP authenticator.
2. Juniper MAG2600 Junos Pulse Gateway sends a RADIUS request with the user’s credentials to SafeNet
Authentication Service for validation.
3. The SAS authentication reply is sent back to the Juniper MAG2600 Junos Pulse Gateway.
4. The user is granted or denied access to the Juniper MAG2600 Junos Pulse Gateway based on the OTP
value calculation results from SAS.
All SafeNet Authentication Service documentation can be found on the SafeNet Knowledge Base site.
3. In the Auth Nodes module, click the Auth Nodes link. The SAS RADIUS server details are displayed.
(The screen image above is from Juniper Networks®. Trademarks are the property of their respective owners.)
3. In the New menu, select Radius Server, and then click New Server.
(The screen image above is from Juniper Networks®. Trademarks are the property of their respective owners.)
(The screen image above is from Juniper Networks®. Trademarks are the property of their respective owners.)
3. Under Authentication Realms, click the user realm to edit.
4. Click the General tab.
(The screen image above is from Juniper Networks®. Trademarks are the property of their respective owners.)
5. Under Servers, click the Authentication menu, and then select the authentication server that you created
in the previous section.
6. Click Save Changes.
(The screen image above is from Juniper Networks®. Trademarks are the property of their respective owners.)
4. Enter the user credentials in the User Name and Password fields, and then click Connect.
(The screen image above is from Juniper Networks®. Trademarks are the property of their respective owners.)
(The screen image above is from Juniper Networks®. Trademarks are the property of their respective owners.)
(The screen image above is from Juniper Networks®. Trademarks are the property of their respective owners.)
3. Click the Sign-in Pages tab.
(The screen image above is from Juniper Networks®. Trademarks are the property of their respective owners.)
(The screen image above is from Juniper Networks®. Trademarks are the property of their respective owners.)
6. Extract the sample.zip file and copy the following files into the extracted folder (replace the existing files):
loginPage.html
loginPage-ipad.thtml
loginPage-mobile-webkit.thtml
gridsure.js
7. Compress the files in the folder to a zip file.
8. On the Upload Custom Sign-In Pages window, under Sign-in Pages, complete the following:
(The screen image above is from Juniper Networks®. Trademarks are the property of their respective owners.)
4. In the Sign-in Page menu, select the login policy name that you created in step 8 in “Configuring the
Juniper Login Pages” on page 17, and then click Save Changes.
(The screen image above is from Juniper Networks®. Trademarks are the property of their respective owners.)
(The screen image above is from Juniper Networks®. Trademarks are the property of their respective owners.)
3. In the Additional password field, enter the characters from the grid that correspond to your PIP (personal
identification pattern), and then tap Sign In.
After successful authentication, you will be redirected to the default SSL page.
(The screen image above is from Juniper Networks®. Trademarks are the property of their respective owners.)
International 1-410-931-7520