Configure Authentication Policy Labels

date_range 17-Mar-25

Add labels to identify the users and resources that you want to refer to in your authentication policies, to control access to your network.

A network access control policy is a set of rules and guidelines for providing secure access to the devices that attempt to connect to a network. A policy consists of certain criteria that devices and users must fulfill to get access to the network and use network resources.

You can configure Juniper Mist Access Assurance with an authentication policy to enable Juniper Mist-managed devices to connect the clients to the network or applications.

Juniper Mist leverages "Labels" as policy matching criteria and the uses labels apply the relevant policy actions that specify permission. That is, when you create authentication policies, you can use the labels as:

Match criteria: A set of match criteria that must be satisfied to apply the policy rule.
Policy permit action: A set of actions to apply in case of a match—such as applying additional attributes (VLAN, role, and group-based policy tag).

Create Labels

You can create labels on the following pages:

Authentication Policies
Authentication Policy Labels

To create labels in the Authentication Policy Labels page:

On the Juniper Mist portal, from the left menu, select Organization > Access > Auth Policy Labels.
A list of existing labels, if any, appears.

On the Auth Policy Labels, click Add Labels and enter the following details:

Label Name—Enter a unique name for the label. You can use up to 32 characters including alphanumeric characters and one or more of the special characters.
Label Type—Specify the label type. See the information in Table 1 to select the label type.

Table 1: Parameters for New Label
Label Type	Details	Role in Authentication Policy Rule
AAA Attribute	A group of user attributes that works as the match criteria and helps determine the policy action that specifies permission. Options: Role: Assigned user role. This can be used in applying role-based policies. VLAN: VLAN ID or named VLANs. This can be used to assign VLAN to a client. Realm: A domain used in authentication, often to specify where user credentials are valid. User Name: unique identifier assigned to an individual or device. This can be used match the User Name RADIUS attribute of the authenticating device. GBP Tag: Group Policy Tag) used to assign specific groups of users or devices to different types of network traffic management. Session Timeout (sets the maximum time allowed before user sessions are reset, from 3600 to 604800 seconds). Custom Vendor Specific Attribute (these are returned in the Access-Accept message, for example, Sec-Admin-Role=superuser, and can be modified with additional attributes). Custom Standard RADIUS Attribute (these are standard IETF RADIUS attributes such as Idle-Timeout=600 or Termination-Action=RADIUS-Request, and can be modified with additional attributes. Dynamic Wired Port Configuration (these are VLAN names that Access Assurance returns for the RADIUS attribute Egress-VLAN-Name in Access-Accept message, and are especially useful with dynamic port configurations, for example to automatically use trunk ports for AP connections or to differentiate between tagged and untagged VLANs). Returned User Name: Identifier of the user such as username, email that gets into the system once the user has successfully authenticated. Options: Automatic Certificate CN Certificate SAN:UPN Certificate SAN:Email Certificate SAN:DNS Configured Port VLAN ID: VLAN ID that a device is assigned to on a particular port after successful authentication. NAS IP Address: The IP address of the network access server (the gateway device) where the authentication request is being made.	Match criteria and policy permit action
Certificate Attribute	A group of user or device certificate fields used during authentication. Options: Common Name (CN) Subject Serial Number Issuer Subject Alternative Name (SAN)	Match criteria
Client List	A list of MAC addresses or MAC Organizationally Unique Identifiers (OUIs) identified by wildcard values. Examples: 1122AA33BB44 or 11-22-AA-33-BB-44 or 11-22-AA* For devices that don't support 802.1X, you can use Client Lists to allow approved devices access the network.	Match criteria
SSID	SSID name used during user or device authentication, based on the incoming called station identifier attribute. You can combine multiple SSIDs in one label using comma-separated values.	Match criteria
Directory Attribute	User group membership. The identity provider (IdP) provides user group information during user or device authorization.	Match criteria
MDM Compliance	Used in the Match section of the policy rule by evaluating client posture compliance received from the Mobile Device Management provider during authorization. Compliant Non-Compliant Unknown	Match criteria
Client Label	Used to match a label or list of labels assigned to a MAC address in the NAC Endpoints Database. Enter text. Example: building3, floor2, printer.	Match criteria

Click Create to save your settings for the new label.
The labels you create in this task become available for you to select as match condition or policy permit action when you create authentication policies.

arrow_backward PREVIOUS Configure Authentication Policy

NEXT arrow_forward Add an Endpoint, Label, and Policy

English

keyboard_arrow_right

Juniper Mist Access Assurance Guide

Configure Authentication Policy Labels

Create Labels

Stay in touch