{"id":10420,"date":"2014-11-25T11:12:59","date_gmt":"2014-11-25T16:12:59","guid":{"rendered":"http:\/\/jianmingli.com\/wp\/?p=10420"},"modified":"2015-03-23T19:00:00","modified_gmt":"2015-03-24T00:00:00","slug":"juniper-ssl-vpn-and-duo-security-integration","status":"publish","type":"post","link":"https:\/\/jianmingli.com\/wp\/?p=10420","title":{"rendered":"Juniper SSL VPN and Duo Security Integration"},"content":{"rendered":"
\n

Contents<\/h2>\n
    \n\t
  1. \n\t\tSign up for a Duo Account<\/a>\n\t<\/li>\n\t
  2. \n\t\tCreate a new Juniper SSL VPN Integration<\/a>\n\t<\/li>\n\t
  3. \n\t\tConfigure Juniper SSL VPN<\/a>\n\t\t
      \n\t\t\t
    1. \n\t\t\t\tModify Sign-In Page<\/a>\n\t\t\t<\/li>\n\t\t\t
    2. \n\t\t\t\tAdd Duo LDAP Auth Server<\/a>\n\t\t\t<\/li>\n\t\t\t
    3. \n\t\t\t\tConfigure Secondary Auth Server for a User Realm<\/a>\n\t\t\t<\/li>\n\t\t\t
    4. \n\t\t\t\tConfigure Sign-In Policy for Secondary Auth<\/a>\n\t\t\t<\/li>\n\t\t<\/ol>\n\t
    5. \n\t\tTest<\/a>\n\t\t
        \n\t\t\t
      1. \n\t\t\t\tCreate Duo User<\/a>\n\t\t\t<\/li>\n\t\t\t
      2. \n\t\t\t\tTest Juniper VPN<\/a>\n\t\t\t<\/li>\n\t\t<\/ol>\n\t
      3. \n\t\tReferences<\/a>\n\t<\/li>\n<\/ol>\n<\/ol>\n<\/div>\n
         <\/div>\n

        Sign up for a Duo Account<\/h2><\/span>\n

        * Sign up for a Duo account here<\/a><\/p>\n

        Create a new Juniper SSL VPN Integration<\/h2><\/span>\n

        * Login Duo Admin Panel<\/a>
        \n* Select Integration > New Integration<\/em> to bring up New Integration<\/em> page
        \n* Select:
        \n– Integration type: Juniper SSL VPN<\/strong>
        \n– Integration name: Duo Demo<\/strong>
        \n* Click Create Integration<\/em> button<\/p>\n

        \"juniperDuoIntegration_newIntegration_1_create\"<\/a><\/h6><\/span>\n

        * Download Duo Juniper for 7.x firmware<\/em>, e.g. Duo-Juniper-7.x-v7-2932-6069-68.zip<\/em><\/p>\n

        \"juniperDuoIntegration_newIntegration_2_download\"<\/a><\/h6><\/span>\n

        Configure Juniper SSL VPN<\/h2><\/span>\n

        * Login Juniper admin console<\/p>\n

        Modify Sign-In Page<\/h3><\/span>\n

        * Select Authentication > Signing In > Sign-In Pages<\/em>
        \n* Click Upload Custom Pages…<\/em><\/p>\n

        \"juniperDuoIntegration_juniper_customSignInPage_1\"<\/a><\/h6><\/span>\n

        * Enter:
        \n– Name: Duo Demo<\/strong>
        \n– Page Type: Access<\/strong>
        \n– Templates File: browse to Duo-Juniper-7.x-v7-2932-6069-68.zip<\/em>
        \n– Skip validation checks during upload: checked<\/strong><\/p>\n

        \"juniperDuoIntegration_juniper_customSignInPage_2\"<\/a><\/h6><\/span>\n

        * Click Update Custom Pages<\/em><\/p>\n

        Add Duo LDAP Auth Server<\/h3><\/span>\n

        * Select Authentication > Auth. Servers<\/em>
        \n* Select New: LDAP Server<\/em>
        \n* Click New Server…<\/em><\/p>\n

        \"juniperDuoIntegration_juniper_ldapSvr_1\"<\/a><\/h6><\/span>\n

        * Enter:
        \n– Name: Duo LDAP<\/strong>
        \n– LDAP Server: replace_with_APIHostname<\/strong>
        \n– LDAP Port: 636<\/strong>
        \n– LDAP Server Type: Generic<\/strong>
        \n– Connection: LDAPS<\/strong><\/p>\n

        – Authentication required to search LDAP: checked<\/strong>
        \n– Admin DN: dc=replace_with_integration_key,dc=duosecurity,dc=com<\/strong>
        \n– Password: secret_key<\/strong><\/p>\n

        – Base DN: dc=replace_with_integration_key,dc=duosecurity,dc=com<\/strong>
        \n– Filter: cn=<USER><\/strong><\/p>\n

        \"juniperDuoIntegration_juniper_ldapSvr_2\"<\/a><\/h6><\/span>\n

        * Click Save<\/em> and ignore warning message:<\/p>\n

        \"juniperDuoIntegration_juniper_ldapSvr_3\"<\/a><\/h6><\/span>\n

        Configure Secondary Auth Server for a User Realm<\/h3><\/span>\n

        * Select Users > User Realms > Select Realm<\/em>
        \n* Check Additional authentication server<\/em> checkbox
        \n* Select or enter:
        \n– Authentication #2: Duo LDAP<\/strong>
        \n– Username is: predefined as <USER><\/strong>
        \n– Password is: specified by user on sing-in page<\/strong>
        \n– End session if authentication against this server fails: checked<\/strong><\/p>\n

        \"juniperDuoIntegration_juniper_realm_1\"<\/a><\/h6><\/span>\n

        * Click Save Changes<\/em>
        \n* Select Authentication Policy > Password<\/em>
        \n* On Options for additional authentication server<\/em> panel, select:
        \nAllow all users (passwords of any length)<\/em>
        \n* Click Save Changes<\/em><\/p>\n

        Configure Sign-In Policy for Secondary Auth<\/h3><\/span>\n

        * Select Authentication > Signing In > Sign-in Policies<\/em>
        \n* Select sign-in policy that you want to add duo security, e.g. *\/rdp\/<\/em>
        \n* Select
        \n– Duo Demo<\/em> from the Sign-in page list
        \n– Selected realms: realm_configured_previously<\/em><\/p>\n

        \"juniperDuoIntegration_juniper_signInPolicy_1\"<\/a><\/h6><\/span>\n

        * Click Save Changes<\/em><\/p>\n

        Test<\/h2><\/span>\n

        Create Duo User<\/h3><\/span>\n

        * Login Duo Admin site
        \n* Select Users > +New User<\/em>
        \n* Add a new user with username matching<\/em> your Juniper user, e.g testrdp1<\/em><\/p>\n

        \"juniperDuoIntegration_duo_addUser_1\"<\/a><\/h6><\/span>\n

        * Add a phone for the newly created user<\/p>\n

        \"juniperDuoIntegration_duo_addUser_2_addPhone\"<\/a><\/h6><\/span>\n

        Test Juniper VPN<\/h3><\/span>\n

        * Login Juniper VPN as usual<\/p>\n

        \"juniperDuoIntegration_juniper_login_1\"<\/a><\/h6><\/span>\n

        * Click SMS to send text code
        \n* Enter received text code into Passcode<\/em> field<\/p>\n

        \"juniperDuoIntegration_juniper_login_2\"<\/a><\/h6><\/span>\n

        * Click Log in ><\/em> button
        \n* You should be logged in<\/p>\n

        References<\/h2><\/span>\n

        * Walkthrough Video<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

        Sign up for a Duo Account * Sign up for a Duo account here Create a new Juniper SSL VPN Integration * Login Duo Admin Panel * Select Integration > New Integration to bring up New Integration page * Select: … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[522,486],"tags":[523,644,577,480],"class_list":["post-10420","post","type-post","status-publish","format-standard","hentry","category-duosecurity","category-juniper-appliance","tag-duosecurity-2","tag-juniper","tag-ssl","tag-vpn"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p8cRUO-2I4","_links":{"self":[{"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=\/wp\/v2\/posts\/10420","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10420"}],"version-history":[{"count":10,"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=\/wp\/v2\/posts\/10420\/revisions"}],"predecessor-version":[{"id":10443,"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=\/wp\/v2\/posts\/10420\/revisions\/10443"}],"wp:attachment":[{"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10420"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10420"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10420"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}