This article describes the issue of the authentication challenge not being sent to the client, when the required traffic hits the security policy; it is configured with the UAC policy.

 

• UAC is configured.
• The security policy is defined with the UAC policy in application-services.

services {
    unified-access-control {
        infranet-controller ic4500 {
            address 10.10.10.10;
            interface ge-0/0/1.0;
            password "$ABC123"; ## SECRET-DATA
        }
        test-only-mode;
    }
}

security {
    policies {
        from-zone trust to-zone untrust {
            policy out {
                match {                 
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit {
                        application-services {
                            uac-policy;
                        }
                    }
                }
            }
        }
    }
}

The set services unified-access-control test-only mode will bypass any authentication challenge and just allow traffic through.

When UAC is configured in the test-only mode, the device enables all UAC traffic to go through; regardless of the UAC policy settings. The device will log the UAC policy decisions, without enforcing them; so you can test this configuration, without impacting traffic. When the administrator verifies that the UAC policy logs are behaving as expected, the test-only-mode configuration can be removed.

2020-02-26: minor non-technical edits.