Description

After following the steps outlined in the SRX Security and Configuration Guide, the SRX device is unable to communicate with the Infranet Controller.

Symptoms

In JUNOS 9.6, the Security Configuration Guide for the SRX enforcer contains step by step instructions for connecting the SRX to an Infranet Controller. Step two of the instructions (on page 374) states to “specify the port to which the SRX Series device should use to connect”.

2.  Specify the Infranet Controller port to which the SRX Series or J Series device should connect:
edit services unified-access-control infranet-controller hostname port port
The problem is that the port is not configurable on the Infranet Controller. The IC will only accept a connection on port 11123 from a JUNOS device. (Port 11124 is reserved for ScreenOS devices.)

When the port is misconfigured an error message will appear in the IC event log and should provide insight into the nature of the problem:
NACN message from <IP of the SRX> has bad message type field
The above error message resulted when port 11124 (instead of 11123) was configured in the SRX.  When the SRX attemped to communicate with the IC, the IC assumed it was a malformed NACN message because port 11124 is reserved for ScreenOS devices instead of JUNOS.

Solution

Make sure to specify port 11123 when configuring this connection. For additional instructions on configuring communications between an SRX device and an Infranet Controller, refer to KB14346 - Integrating an SRX (JUEP) device into Unified Access Control (UAC [juniper.net]).

Modification History

2025-06-25: Minor, non-technical update

2009-09-15: Article created