Juniper Mist Authentication Proxy: Third-Party Device Support

Juniper Networks Mist Access Assurance supports user and device authentication by leveraging a Mist Auth Proxy application running on a Mist Edge device.

The Juniper Mist Cloud manages the Mist Edge device. The Mist Edge device serves as a 'gateway' for non-Mist managed devices that need to authenticate end-clients connecting to them or require management user authentication.

Examples of such devices include:

• A third-party switch
• A wireless LAN controller
• An Access Point
• Firewalls or switches requiring admin login to their CLI management interface

As the administrator, you must add third-party devices as RADIUS clients at the Mist Edge Cluster. The Mist Edge Cluster then wraps all authentication traffic into a secured RadSec tunnel and sends it to the Mist Access Assurance cloud.

Figure 1: Juniper Mist Edge as Auth Proxy—Flow of Connections

Juniper Mist Edge appliences require out-of-band management (OOBM) interface to act as Juniper Mist Auth Proxy.

• Design Considerations
• About RADIUS Attributes

1. From the left menu of the Juniper Mist portal, select Mist Edges.
2. Under Mist Edge Clusters, click an existing cluster or create a new cluster using Create Cluster option.
   Figure 2: Selecting Mist Edge Cluster
3. In the cluster page, under Radius Proxy section, complete the following steps:
   Figure 3: Mist Auth Proxy Settings
   1. Select the Enabled option.
   2. Set type as Mist Auth Proxy, then click Add Client.
   3. Provide an IP address or IP subnet for the RADIUS client (a 3rd party device).
   4. Enter RADIUS shared secret.
   5. Select vendor of the 3rd party device.
   6. Select the site where that 3rd party device is located (optional).
4. Click check-mark to save your settings.

Now you can leverage different Network Access Server (NAS) vendors in your authentication policy rules to differentiate between various vendors/rule combinations as shown in the following example.

Figure 4: Example: Authentication Policy Rules with NAS Vendor as Match Criteria

Now you point your third-party NAS devices towards Mist Edge OOBM IP address as the RADIUS server.

In case you are deploying multiple Mist Edges, add each Mist Edge as RADIUS server in failover or load-balance mode, depending on your third-party device support.