When RADIUS authentication is used with Clear Pass in Juniper Secure Analytics (JSA), JSA tries to communicate with the default NAS IP-Address (127.0.0.1) for authentication with Clear Pass and authentication fails. This is because the default NAS IP-Address configured in JSA is 127.0.0.1.
This article explains how to change the default NAS IP-Address configuration and ensure that authentication succeeds.
When trying to log in to the GUI via the user-defined accounts (RADIUS authentication already configured), the login fails.
The NAS IP-Address under the RADIUS protocol in the packet capture shows the IP-Address as 127.0.0.1.
By default, the NAS IP-Address configured in JSA is 127.0.0.1 and that is why JSA is using the NAS IP-Address as 127.0.0.1.
The NAS IP-Address is configured in the /opt/qradar/conf/login.conf file in JSA.
/opt/qradar/conf/login.conf
To change the NAS IP-Address:
Execute the following: cd /opt/qradar/conf/ cp login.conf login.conf.old vi login.conf Modify the NAS IP-Address field with the IP-Address used for JSA management. Ensure that there is an "@" at the beginning of the IP-Address. After the file has been modified and saved, verify and confirm that the changes have been successfully incorporated. Execute a full deploy of the services from the WebUI. After the full deploy, the NAS IP-Address should use the JSA Management IP-Address (as specified in the login.conf file).
Execute the following:
cd /opt/qradar/conf/
cp login.conf login.conf.old
vi login.conf
Modify the NAS IP-Address field with the IP-Address used for JSA management. Ensure that there is an "@" at the beginning of the IP-Address.
After the file has been modified and saved, verify and confirm that the changes have been successfully incorporated.
Execute a full deploy of the services from the WebUI. After the full deploy, the NAS IP-Address should use the JSA Management IP-Address (as specified in the login.conf file).
login.conf