Description

This article explains how to configure the SecurID information on SRX devices, via the CLI for stand alone or cluster setups.
 

Symptoms

  • SecurID can be used to provide additional security for Web Authentication and Dynamic VPN.

  • Currently, SecurID cannot be used for authentication to manage the device.

  • For configuration of the SecurID Authentication server, refer to the RSA homepage .
     

Solution

The initial step is to setup an agent host on the SecurID authentication server, then generate the sdconf.rec file.

Create a directory on SRX, to which the sdconf.rec file will be copied.

> start shell
% mkdir /var/db/securid
% mkdir /var/db/securid/server1
% exit

Copy the sdconf.rec file via FTP or WinSCP to the /var/db/securid/server1/ directory in SRX.

Configure Junos to access the Authentication server by using the sdconf.rec file and reference it in any access profiles, which you can  the SecurID server to authenticate:

> configure
# set access securid-server server_name configuration-file /var/db/securid/server1/sdconf.rec
# set access profile profile_name authentication-order securid

For more information on how to setup the rest of the web authentication, refer to the following link:

http://www.juniper.net/techpubs/en_US/junos11.1/topics/example/firewall-user-authentication-web-authentication-configuring-cli.html

For more information on setting up SecurID for Dynamic VPN, refer to KB21898 - [SRX] Configuring Web-Authentication using secure ID in Dynamic VPN [juniper.net] .

Notes :

  • The authentication order must display the order, in which you want the device to authenticate a user. If the password is before the SecurID, the securid server will not be checked; until the local password database is checked.

  • The hostname on the SRX device must match the IP or name resolution, which is used on the SecurID server to reach the device.  For a cluster, this means that the IP for each fxp0 interface must be set as the host-name; or you must have an internal DNS server that resolves the host-name to the fxp0 IP.
     

Cluster setup

If you are setting up SecurID on chassis clusters, you must create separate agent hosts and generate sdconf.rec files for each device. Setup of the agent hosts will require unique IPs for communication from the chassis cluster devices. Based on this requirement, it is recommended to use fxp0 ports for communication to the SecurID server.

Verify setup

Once you have configured everything, you must have a successful login before the setup will be complete.  During the initial login, a secret file is generated, which is used to communicate with the SecurID server in addition to the sdconf.rec file.  If it is deleted, you must let the SecurID server know about it, before a new one can be generated. The following command will provide the details of the secret file on the SRX device.

> show network-access securid-node-secret-file
 

Modification History

2019-12-10: Removed wording of J-series due to EOS product.