Juniper Secure Connect will authenticate the user and its password two times by default, and both requests need to be accepted. This will most likely not be noticed if the authentication method is Local but if configured with LDAP/RADIUS/TACACS+ it may cause undesired effects.

This behavior is by design and seen in all SRX platforms, there's a workaround for it.

When trying to establish a VPN using Juniper Secure Connect the SRX will authenticate the user two times, one for the HTTP authentication, one for IKE authentication.

For example: If the authentication method is RADIUS the SRX will send an Access-Request with the username and password, once it receives the Access-Accept and will send a second Access-Request.

Depending on the setup the consequences of this may be:

• Authentication Failure.
• Longer than expected tunnel establishment, which can lead to IKE timeout.
• On MFA setups, two MFA prompts.

The access profile, where the authentication method and details are configured, will be referenced two times in a JSC configuration.

See the following example config:

https://www.juniper.net/documentation/us/en/software/secure-connect/secure-connect-administrator-guide/topics/task/secure-connect-vpn-IKEv1-radius-cli-procedure.html

Method #1:

As we can see the access profile is referenced:

1- In IKE Gateway config:

set security ike gateway JUNIPER_SECURE_CONNECT aaa access-profile Juniper_Secure_Connect

2- In Remote-Access config:

set security remote-access profile ra.example.com access-profile Juniper_Secure_Connect

This is why JSC does two authentication requests.

Therefore a solution is to configure an extra access profile with authentication method as "none" (this will bypass authentication therefore will not send a request) and configure it in one of the two instances of the JSC config that refers to an access profile, leaving the real access profile to the other instance.

Example:

set access profile No-Auth authentication-order none

set access profile No-Auth address-assignment pool Juniper_Secure_Connect_Addr-Pool <---- a pool needs to be added to the "none" profile, otherwise it will not work, any pool will make the job done.

delete security ike gateway JUNIPER_SECURE_CONNECT aaa access-profile Juniper_Secure_Connect

set security ike gateway JUNIPER_SECURE_CONNECT aaa access-profile No-Auth





Method #2:

This is for when the issue is simply IKE timeout due to authentication taking long (which can happen on MFA scenario and on any slow response authentication), on 25.2R1 onward you can use:

set security ike session half-open timeout 60

What this does instead of bypassing the second, IKE, authentication, we are increasing its timeout value, this means the SRX still authenticates two times. Method one, hence, is for when you only want 1 authentication request.

See KB107675 [juniper.net]

KB73465 [juniper.net]/PR1592757: The option to set authentication-order as 'none' in an access profile is not available on SRX300, SRX320, SRX340, SRX345, SRX380, and SRX550M SRX platforms that run:

Pre-20.3R3

20.4R1

20.4R2

21.1R1.