Certificate-Based Validation Using EAP-TLS Authentication

Figure 1: J-Web Access and Login

After logging in successfully, you land on the Basic Settings page. Figure 2 shows an example of the landing page.

Figure 2: J-Web Landing Page

1. After you click IPsec VPN, the IPsec VPN page appears. Figure 3 shows an example of the IPsec VPN page.

   Figure 3: IPsec VPN Page

2. At the right corner of the page, select Create VPN > Remote Access > Juniper Secure Connect to create the IPsec VPN setting for Juniper Secure Connect.

   The following warning message appears:

   Figure 4: Warning Message To Generate And Bind Self-signed Certificate

   As mentioned in the warning message, create a self-signed certificate and bind the certificate to the SRX Series Firewall. For more information, see Preparing Juniper Secure Connect Configuration.

   For detailed information about creating a remote access VPN, see Create a Remote Access VPN—Juniper Secure Connect.

3. Again navigate to Network > VPN > IPsec VPN and at the right corner of the page, select Create VPN > Remote Access > Juniper Secure Connect to create the IPsec VPN setting for Juniper Secure Connect. The Create Remote Access (Juniper Secure Connect) page appears. Figure 5 shows an example to create remote access VPN.

   Figure 5: Create VPN - Remote Access

   Figure 6 shows an example of the Create Remote Access page with Certificate-based authentication method.

   Figure 6: Create Remote Access Page For Certificate-Based Authentication Method

1. Enter the name for the Remote Access Connection (this is, the name that will be displayed on the End Users Realm Name in Juniper Secure Connect application) and a description.

2. The routing mode is set to Traffic Selector (Auto Route Insertion) by default.

3. Select the authentication method. For this example, let’s select Certificate Based from the drop-down list.

4. Select Yes to create the firewall policy automatically using Auto-create Firewall Policy option.

Figure 7: Certificate-Based Authentication Method

Figure 8: Remote User Page

Figure 8 shows an example of the Remote User page.

Configure the remote user client by selecting the options on the Remote User page and then clicking OK :

Table 1 summarizes the remote user settings options.

Figure 9 shows an example of the local gateway configuration settings.

Figure 9: Local Gateway Configuration

1. If you enable Gateway is behind NAT, a text box appears. In the text box, enter the NAT IP address. We support only IPv4 addresses. NAT address is the external address.

2. Enter a IKE ID in user@hostname.com format. For example, abc@xyz.com.

3. In the External Interface field, select the IP address for the clients to connect. You must enter this same IP address (in this example: https://12.12.12.12/) for the Gateway Address field in the Juniper Secure Connect application.

   If you enable Gateway is behind NAT, then the NAT IP address becomes the gateway address.

4. From the Tunnel Interface drop-down list, select an interface to bind it to the route-based VPN. Alternatively click Add. If you click Add, the Create Tunnel Interface page appears.

   Figure 10 shows an example of the Create Tunnel Interface page.

   Figure 10: Create Tunnel Interface Page

   The next available ST0 logical interface number is displayed in the Interface Unit field and you can enter a description for this interface. Select the zone to add this tunnel interface to. If Auto-create Firewall Policy (in Create Remote Access page) is set to Yes, the firewall policy uses this zone. Click OK.

5. From the Local certificate field, select one of your already externally signed local certificates. Click Add to add a new local certificate or click Import to import the local certificate.

   Figure 11 shows a configuration example only.

   Figure 11: Generate Certificate Page For Local certificate

6. For CA certificate, from the Trusted CA/Group field, select one of your already externally signed CA certificates, including the matching Trusted CA/Group. If you do not have any of these, click Add CA Profile and fill in the values that match your environment. Figure 12 shows an example of Add CA PROFILE page.

   Figure 12: ADD CA PROFILE page

7. In the User Authentication dropdown menu, you can select existing access profile or click Add to create a new Access Profile. If you click Add, the Create Access Profile window appears.

   Figure 13 shows an example of the Create Access Profile page.

   Figure 13: Create Access Profile Page

   Enter the access profile name. From the Address Assignment drop-down list, select an address pool or click Create Address Pool. If you click Create Address Pool, the Create Address Pool page appears.

   Figure 14 shows an example of the Create Address Pool page.

   Figure 14: Create Address Pool Page

   • Enter the details for the Local IP pool that is in the VPN policy for the clients. Enter a name for the IP address pool.

   • Enter the network address that you use for the address assignment.

   • Enter your DNS server address. Enter WINS server details, if required. Now click the add icon (+) to create the address range to assign IP addresses to the clients.

   • Enter the name, and the lower and higher limits. After entering the details, click OK.

   Select the RADIUS check box, where all the authentication details are stored on an external radius server.

   • Click on the add icon (+) to configure the radius server details. See Figure 15.

     Figure 15: Create RADIUS Server Page

   • Enter the Radius Server IP Address, the Radius Secret, and Source Address for the radius communications to be sourced from. Click OK.

     In the Authentication Order, from Order 1 drop-down list select RADIUS. Click OK to complete the access profile configuration.

     Figure 16 shows an example of Create Access Profile page.

     Figure 16: Create Access Profile Page

8. From the SSL VPN Profile drop-down list, select an existing profile or click Add to create a new SSL VPN profile. If you click Add, the Add SSL VPN Profile page appears.

   Figure 17 shows an example of the Add SSL VPN Profile page.

   Figure 17: Add SSL VPN Profile Page

   On the Add SSL VPN Profile page , you can configure the SSL VPN profile. Enter the SSL VPN profile name in the Name field, and enable logging using the toggle, if required. In the SSL Termination Profile field, select the SSL termination profile from the drop-down list. SSL termination is a process where the SRX Series Firewalls act as an SSL proxy server, and terminates the SSL session from the client. If you want to create a new SSL termination profile, click Add. The Create SSL Termination Profile page appears.

   Figure 18 shows an example of the Create SSL Termination Profile page.

   Figure 18: Create SSL Termination Profile Page

   • Enter the name for the SSL termination profile and select the server certificate that you use for the SSL termination on the SRX Series Firewalls. Click Add to add a new server certificate or click Import to import the server certificate. The server certificate is a local certificate identifier. Server certificates are used to authenticate the identity of a server.

   • Click OK.

9. The Source NAT Traffic option is enabled by default. When Source NAT Traffic is enabled, all traffic from the Juniper Secure Connect application is NATed to the selected interface by default. Click the toggle button to disable the Source NAT Traffic option. If the option is disabled, you must ensure that you have a route from your network pointing to the SRX Series Firewalls for handling the return traffic correctly.

10. Under Protected Networks, click the add icon (+) to select the networks that the Juniper Secure Connect application can connect to.

    Figure 19 shows an example of the Create Protected Networks page.

    Figure 19: Create Protected Networks Page

    By default, any network 0.0.0.0/0 is allowed. If you configure a specific network, split tunneling for Juniper Secure Connect application is enabled. If you retain the default value, you can restrict access to your defined networks by adjusting the firewall policy from the client network. Click OK, and the selected networks are now in the list of protected networks. Click OK to complete the local gateway configuration.

    Figure 20 shows an example of successful completion of remote access configuration with remote user and local gateway.

    Figure 20: Complete Remote Access Configuration

    IKE Settings and IPsec Settings are advanced options. J-Web is already configured with default values for the IKE and IPsec parameters. It is not mandatory to configure these settings.

Figure 21 highlights the URL that remote user must enter in the Gateway address field in Juniper Secure Connect application to establish remote access connection.

Figure 21: Commit Remote Access Configuration

1. Click Save to complete the Juniper Secure Connect VPN Configuration and associated policy if you have selected the auto policy creation option.

2. Click the highlighted Commit button (at the top right of the page next to Feedback Button) to commit the configuration.