The need to set up Juniper Secure Connect with rsa-signatures is becoming more common as IKEv2 is becoming more common, especially with Mist managed deployments. The purpose of this KB is to provide a working configuration.

When trying to set up JSC with rsa-signatures, one may run into a several different problems. The JSC client may repeatedly ask for a certificate PIN, or authentication may fail for several different reasons.

You may also be coming to this article because when you first attempted to deploy a standard JSC configuration you were faced with the error "Dynamic Main Mode or IKEv2 gateway with same ike external interface must use same set of IKE proposals".

This article will review the different parts of the JSC configuration in order to tailor them for use in your environment.

If you are landing on this article because you ran into the commit error "Dynamic Main Mode or IKEv2 gateway with same ike external interface must use same set of IKE proposals", please also refer to KB74419 [juniper.net] to see if the workaround might fit your situation.

Overview

JSC makes an HTTPS connection first to the SRX in order to download the VPN profile parameters. The authentication for this first step is specified under the remote-access profile.

Once this is downloaded, JSC configured itself and connects the VPN using the authentication profile specified under the IKE gateway aaa configuration.

Certificates

A web certificate is required for the initial HTTPS connection. A self signed certificate can be used, but the JSC client will show a warning. For any web certificate signed by a certificate authority, that certificate must be included in the JSC install on the client PCs.

Windows: C:\ProgramData\Juniper\SecureConnect\cacerts ProgramData is hidden by default and not to be confused with Program Files.

MAC: /Library/Application Support/Juniper/SecureConnect/cacerts

The second certificate is the one to be used for the IKE negotiations. This can be a self signed certificate. If this is a certificate signed by an external certificate authority, it will be necessary to add a CA profile.

Configuration breakdown:

In this example, we are configuring JSC to work alongside a Mist deployed certificate based VPN.

The HTTPS web services:

set system services web-management https pki-local-certificate jsc_web
set system services web-management https interface ge-0/0/0.0

The IKE proposal is from Mist:

set security ike proposal OrgOverlay authentication-method rsa-signatures
set security ike proposal OrgOverlay dh-group group19
set security ike proposal OrgOverlay encryption-algorithm aes-256-gcm
set security ike proposal OrgOverlay lifetime-seconds 3600

Then the IKE policy uses the same certificate as the Mist policy

set security ike policy JSC-RSA proposals OrgOverlay
set security ike policy JSC-RSA certificate local-certificate mist-cert

The IKE gateway must use a RADIUS access profile. No other type is supported. IKEv2 is required. The dynamic hostname can be anything.

set security ike gateway Juniper-Secure-Connect ike-policy JSC-RSA
set security ike gateway Juniper-Secure-Connect dynamic hostname jsc.juniper.net
set security ike gateway Juniper-Secure-Connect dynamic ike-user-type shared-ike-id
set security ike gateway Juniper-Secure-Connect dead-peer-detection optimized
set security ike gateway Juniper-Secure-Connect dead-peer-detection interval 10
set security ike gateway Juniper-Secure-Connect dead-peer-detection threshold 5
set security ike gateway Juniper-Secure-Connect external-interface ge-0/0/0.0
set security ike gateway Juniper-Secure-Connect aaa access-profile JSC-RADIUS
set security ike gateway Juniper-Secure-Connect version v2-only
set security ike gateway Juniper-Secure-Connect tcp-encap-profile JSC

The IPSEC proposal

set security ipsec proposal Juniper-Secure-Connect protocol esp
set security ipsec proposal Juniper-Secure-Connect encryption-algorithm aes-256-gcm
set security ipsec proposal Juniper-Secure-Connect lifetime-seconds 3600

The IPSEC policy

set security ipsec policy Juniper-Secure-Connect perfect-forward-secrecy keys group19
set security ipsec policy Juniper-Secure-Connect proposals Juniper-Secure-Connect

The IPSEC VPN

set security ipsec vpn Juniper-Secure-Connect bind-interface st0.100
set security ipsec vpn Juniper-Secure-Connect df-bit clear
set security ipsec vpn Juniper-Secure-Connect copy-outer-dscp
set security ipsec vpn Juniper-Secure-Connect ike gateway Juniper-Secure-Connect
set security ipsec vpn Juniper-Secure-Connect ike ipsec-policy Juniper-Secure-Connect
set security ipsec vpn Juniper-Secure-Connect traffic-selector ts-0 local-ip 0.0.0.0/0
set security ipsec vpn Juniper-Secure-Connect traffic-selector ts-0 remote-ip 0.0.0.0/0

The remote-access profile

Note: The authentication in the remote-access profile will send in PAP only if a RADIUS profile is selected. If your RADIUS server or internal practices disallow PAP, you may use an LDAP profile (Junos 21.4 or later only) or local authentication. This example uses local authentication where the same user/pass is configured on the SRX the same as it exists in RADIUS.

set security remote-access profile Juniper-Secure-Connect ipsec-vpn Juniper-Secure-Connect
set security remote-access profile Juniper-Secure-Connect access-profile JSC-LOCAL
set security remote-access profile Juniper-Secure-Connect client-config Juniper-Secure-Connect
set security remote-access client-config Juniper-Secure-Connect connection-mode manual
set security remote-access client-config Juniper-Secure-Connect dead-peer-detection interval 60
set security remote-access client-config Juniper-Secure-Connect dead-peer-detection threshold 5
set security remote-access client-config Juniper-Secure-Connect no-eap-tls
set security remote-access client-config Juniper-Secure-Connect certificate no-pin-request-per-connection
set security remote-access client-config Juniper-Secure-Connect certificate warn-before-expiry 60
set security remote-access client-config Juniper-Secure-Connect credentials password
set security remote-access default-profile Juniper-Secure-Connect

Access profiles. The RADIUS server used for this example is FreeRADIUS that is configured to not allow PAP.

set access profile JSC-LOCAL authentication-order password
set access profile JSC-LOCAL client jscuser firewall-user password "$9$6sD0CpBcyKxNbIENbs2GU/CtuIESreWX7"
set access profile JSC-LOCAL address-assignment pool JSC-pool
set access profile JSC-RADIUS authentication-order radius
set access profile JSC-RADIUS address-assignment pool JSC-pool
set access profile JSC-RADIUS radius-server 10.20.254.254 port 1812
set access profile JSC-RADIUS radius-server 10.20.254.254 secret "$9$.fQntu1ylM/ClM8XbwmfTz/Cp0BESr"
set access profile JSC-RADIUS radius-server 10.20.254.254 timeout 5
set access profile JSC-RADIUS radius-server 10.20.254.254 retry 2

Address pool

set access address-assignment pool JSC-pool family inet network 10.99.198.0/24
set access address-assignment pool JSC-pool family inet range 10-99-198-0 low 10.99.198.100
set access address-assignment pool JSC-pool family inet range 10-99-198-0 high 10.99.198.120
set access address-assignment pool JSC-pool family inet xauth-attributes primary-dns 10.20.24.53/32

Other

set security tcp-encap profile JSC
set interfaces st0 unit 100 family inet address 10.99.198.1/24
set access firewall-authentication web-authentication default-profile JSC-LOCAL