Juniper Secure Access SSL VPN - LDAPS

These instructions are for the Juniper-branded SA SSL VPN. If you have updated to Pulse firmware or devices, please see the Pulse Connect Secure SSL VPN instructions.

See our alternate RADIUS instructions if you'd like to control the "failmode" (how the system will act if network communication with Duo is interrupted) or integrate Duo into a single Juniper sign-in URL with multiple authentication realms.

Walkthrough Video

First Steps

Before starting to add two-factor authentication to your Juniper, make sure that Duo is compatible with your Juniper Networks Secure Access SSL VPN. Log on to your SA, IVE or MAG administrator interface and verify that your firmware is version 6.x, 7.x, or 8.x (up to 8.2).

You should already have a working primary authentication configuration for your SSL VPN users before you begin to deploy Duo, e.g. LDAP authentication to Active Directory.

Then you'll need to:

1. Sign up for a Duo account.
2. Log in to the Duo Admin Panel and navigate to Applications.
3. Click Protect an Application and locate Juniper SSL VPN in the applications list. Click Protect this Application to get your integration key, secret key, and API hostname. (See Getting Started for help.)
4. Download the appropriate Duo Juniper package zip file for your device's firmware version from the Duo Admin Panel. This file is customized for your account and has your Duo account ID appended to the file name (after the version).

Modify the Sign-In Page

1. Log on to your Juniper SSL VPN administrator web interface.

2. In the left menu, navigate to Authentication → Signing In → Sign-in Pages, click Upload Custom Pages..., and fill in the form:

   Field	Value
   Name	Duo-Juniper
   Page type	Access
   Templates file	Upload the Duo Juniper package zip file downloaded from the Duo Admin Panel earlier.

3. Check the Skip validation checks during upload box.

   

4. Click Upload Custom Pages.

Add the Duo LDAP Server

1. In the left menu, navigate to Authentication → Auth. Servers.

   Select LDAP Server from the Auth Server Type list, click New Server, and fill out the form:

   Field	Value
   Name	Duo-LDAP
   LDAP Server	Your API hostname (i.e. api-XXXXXXXX.duosecurity.com)
   LDAP Port	636
   LDAP Server Type	Generic
   Connection	LDAPS

   

2. In the "Authentication required?" section, check the Authentication required to search LDAP box and fill in the form (replacing INTEGRATION_KEY and SECRET_KEY with your application-specific keys).

   Field	Value
   Admin DN	dc=INTEGRATION_KEY,dc=duosecurity,dc=com
   Password	SECRET_KEY

3. In the "Finding user entries" section:

   Field	Value
   Base DN	dc=INTEGRATION_KEY,dc=duosecurity,dc=com
   Filter	cn=<USER>

   

4. Click Save. (After you click Save you might receive a message indicating that the LDAP server is unreachable. You can disregard this message.)

Configure a User Realm

To configure a user realm for the Duo LDAP server, you can do one or more of the following:

• Create a new realm for testing
• Create a realm to gradually migrate users to the new system (for instance, by duplicating an existing realm)
• Use the default Users realm

If you create a new realm as part of deploying Duo, be sure to create role mapping rules to add users to the new realm.

To add 2FA to a user realm:

1. In the left menu, navigate to Users → User Realms and click the link for the user realm to which you want to add secondary authentication.

2. On the Users realm configuration page, select the Additional authentication server check box and fill out the form:

   Field	Value
   Authentication #2	Duo-LDAP
   Username is	predefined as <USERNAME>
   Password is	specified by user on sign-in page

3. Check the End session if authentication against this server fails box.

   

4. Click Save Changes.

5. In the top menu, navigate to Authentication Policy → Password.

6. In the "Options for additional authentication server" section, select Allow all users.

   

7. Click Save Changes.

Configure the Sign-In Policy for Secondary Authentication

To finish setting up your integration, configure a sign-in policy for secondary authentication. In this example we'll use the default */ URL policy, but you can set up a new sign-in policy at a custom URL (like */Duo-testing/) for testing.

1. In the left menu, navigate to Authentication → Signing In → Sign-in Policies tab.
2. Click the link for the sign-in policy that you want to modify.
3. Select Duo-Juniper from the Sign-in page list.
4. In the "Authentication realm" section, choose User picks from a list of authentication realms....

5. Choose the user realm you configured earlier, and click Add to move it to the Selected realms box on the right. Make sure this is the only selected realm for this sign-in page.

   

6. Click Save Changes.

Test Your Setup

To test your Juniper two-factor authentication setup, go to the URL that you defined for your sign-in policy. After you complete primary authentication, the Duo enrollment/login prompt appears.

Troubleshooting

Need some help? Take a look at the Juniper Frequently Asked Questions (FAQ) page or try searching our Juniper Knowledge Base articles or Community discussions. For further assistance, contact Support.

Network Diagram

1. SSL VPN connection initiated
2. Primary authentication
3. Juniper MAG/SA connection established to Duo Security over TCP port 636
4. Secondary authentication via Duo Security’s service
5. Juniper MAG/SA receives authentication response
6. SSL VPN connection established