Description

This article provides information on how to configure multiple authentication mechanisms on a SRX device for dynamic VPN.

Symptoms

To configure redundancy for the authentication of dynamic VPN users, so that if one mechanism does not function, users can get authenticated from the other mechanism.

Solution

At times, the authentication servers are disconnected and not reachable.

In this example, the following authentication mechanisms are being used:
 

  • Radius --> primary
  • Local ---- > redundant

All users will get authenticated via the Radius server; if by any chance, the Radius server is not reachable or unable to respond to the auth request, then after 3 attempts, it will opt for local authentication. For more information about the configuration, refer to the Configuring Dynamic VPN v2.1 Application Note.

Use the following configuration for the [edit access] hierarchy: 
root# show access
profile remote_access_profile {
    authentication-order [ radius password ];
        client user1 {
            firewall-user {
                password “$ABC123"; ## SECRET-DATA
            }
        }
client user2 {
    firewall-user {
        password “$ABC123"; ## SECRET-DATA
    }
}
address-assignment {
    pool dyn-vpn-address-pool;
}
radius-server {
    172.27.186.24 secret “$ABC123"; ## SECRET-DATA
}
}
address-assignment {
    pool dyn-vpn-address-pool {
        family inet {
            network 10.10.0.0/24;
            xauth-attributes {
                primary-dns 192.168.2.2/32;
                secondary-dns 192.168.2.3/32;
            }
        }
    }
}
firewall-authentication {
    web-authentication {
        default-profile remote_access_profile;
    }
}
The set commands: 
set access profile remote_access_profile authentication-order radius
set access profile remote_access_profile authentication-order password
set access profile remote_access_profile client user1 firewall-user password “$ABC123"
set access profile remote_access_profile client user2 firewall-user password “$ABC123"
set access profile remote_access_profile address-assignment pool dyn-vpn-address-pool
set access profile remote_access_profile radius-server 172.27.186.24 secret “$ABC123"
set access address-assignment pool dyn-vpn-address-pool family inet network 10.10.0.0/24
set access address-assignment pool dyn-vpn-address-pool family inet xauth-attributes primary-dns 192.168.2.2/32
set access address-assignment pool dyn-vpn-address-pool family inet xauth-attributes secondary-dns 192.168.2.3/32
set access firewall-authentication web-authentication default-profile remote_access_profile
 
Note : It is not be possible to use both of the authentication orders at the same time. If any user is configured on Radius, but not locally, and the connectivity with Radius is terminated, then authentication failure will occur.

Modification History

2020-02-21: Changed encrypted password to “$ABC123".

Related Information