Download 3.8 MB - Juniper Networks

Configuring the Juniper DX Appliance for RSA SecureID
RSA SecurID is one of the more popular token authentication systems. RSA
Security's ACE/Server and SecurID solutions provide centralized, two-factor
authentication services for enterprise networks and operating systems. This allows
only authorized users to gain access to network files, applications, and
communications. The DX Application Acceleration Platform supports Enterprise
topologies that have standardized on RSA’s SecurID.
A typical authentication configuration in the Enterprise configuration includes the
following components: the ACE/Server software, one DX appliance, and a remote
user, typically a browser connected to a network. The authenticating DX appliance
is a DX appliance that supports RADIUS authentication and allows token-based
authentication via RADIUS.
A sample configuration is shown Figure 64.
Figure 64: Sample RSA SecurID Configuration
Radius
Server
2
HTTP/S Request
Remote
User
1
Juniper DX
Appliance
(RADIUS Client)
3
ACE/Agent API
ACE/Server
(SecurID)
RADIUS
Authentication
4’
Authentication
Failure
4
Authentication
Success
Target
Hosts
RADIUS System Configuration Overview
Use these general steps to configure your topology for RADIUS authentication:
„
Configure the RSA ACE/Server as shown in the ACE/Server configuration guide.
„
Refer to RADIUS Server configuration guide to configure your RADIUS Server.
„
Configure the DX appliance for RADIUS authentication. Make sure that the
secret key matches the one configured on the RADIUS Server. These commands
show the configuration needed to enable the DX appliance to work with
RADIUS Server.
„
Perform a request to the secured Web or application server using the DX
appliance. The DX appliance will prompt for authentication information
through a popup window on the browser. Note that the RADIUS protocol does
not pass the syntax challenge from the authentication server. You will be
challenged for a password and not a passcode.
Configuring the Juniper DX Appliance for RSA SecureID „ 307