topic Re: Tacacs+ Authentication on Juniper Screen OS using ACS 5.3 in Network Access Control

Tacacs+ Authentication on Juniper Screen OS using ACS 5.3

Mon, 11 Mar 2019 03:36:06 GMT

Tacacs Authentication and Authorization were passed on ACS5.3, but Entering username and password in the security device (Juniper SSG5) gives Access denied, attached is Tacacs cfg.

set auth-server TACACS+ id 1

set auth-server TACACS+ server-name 10.10.xx.yy

set auth-server TACACS+ account-type admin

set auth-server TACACS+ type tacacs

set auth-server TACACS+ tacacs secret xxxx

set auth-server TACACS+ tacacs port 49

set admin auth server TACACS+

set admin auth remote primary

set admin auth remote root

set admin privilege get-external set auth-server TACACS+ id 1
set auth-server TACACS+ server-name 10.10.xx.yy
set auth-server TACACS+ account-type admin
set auth-server TACACS+ type tacacs
set auth-server TACACS+ tacacs secret xxxx
set auth-server TACACS+ tacacs port 49
set admin auth server TACACS+
set admin auth remote primary
set admin auth remote root
set admin privilege get-external

Please Advice

Tacacs+ Authentication on Juniper Screen OS using ACS 5.3

Jatin Katyal — Sun, 30 Jun 2013 13:06:51 GMT

Could you please post the screen shot of attributes you've defined under:

Policy Elements > Authorization and Permissions > Device Administration > Shell Profiles > Edit the profile > custom attributes

Also, you may go through this:

https://supportforums.cisco.com/message/3954494#3954494

~BR
Jatin Katyal

**Do rate helpful posts**

Tacacs+ Authentication on Juniper Screen OS using ACS 5.3

Sun, 30 Jun 2013 14:39:38 GMT

By the way link:

https://supportforums.cisco.com/message/3954494#3954494

For SRX not Screen OS.

Tacacs+ Authentication on Juniper Screen OS using ACS 5.3

Mon, 01 Jul 2013 08:01:49 GMT

Below screen shot for Authentication and Authorization on ACS:

Tacacs+ Authentication on Juniper Screen OS using ACS 5.3

Tue, 02 Jul 2013 08:01:22 GMT

Any upgates, ideas .......

Tacacs+ Authentication on Juniper Screen OS using ACS 5.3

Jatin Katyal — Tue, 02 Jul 2013 09:16:46 GMT

Since, ACS shows passed authentication and authorization. We should now look at the packet capture to see TACACS+ Query and Response to further investigate this issue. I worked with a CSC member few weeks ago where we found that Juniper in authorization QUERY only sending Arg[0] value: service=shell and didn't send "cmd=" arg. This is known issue with Juniper device so we ended up upgrading the device to WX OS 5.7.7 (WXC-3400). You may want to look at the same discussion: https://supportforums.cisco.com/thread/2215574

~BR
Jatin Katyal

**Do rate helpful posts**

Tacacs+ Authentication on Juniper Screen OS using ACS 5.3

Tue, 02 Jul 2013 14:33:59 GMT

I went through https://supportforums.cisco.com/thread/2215574 which is for WXC-3400 wan optmaization, the Juniper device I am using is SSG5 firewall Firmware Version:6.2.0r5.0 which support T+, as per the link should I upgrade the exisiting IOS or there is a solution ?

Tacacs+ Authentication on Juniper Screen OS using ACS 5.3

Jatin Katyal — Tue, 02 Jul 2013 14:49:12 GMT

Can you first provide the packet capture b/w the Juniper and ACS (along with tacacs+ key).

~BR
Jatin Katyal

**Do rate helpful posts**

Tacacs+ Authentication on Juniper Screen OS using ACS 5.3

Wed, 03 Jul 2013 14:45:27 GMT

please find below:

Tacacs+ Authentication on Juniper Screen OS using ACS 5.3

Thu, 04 Jul 2013 11:13:18 GMT

Any updates !!!

Tacacs+ Authentication on Juniper Screen OS using ACS 5.3

Jatin Katyal — Thu, 04 Jul 2013 11:21:27 GMT

Could you please attach the pcap file with tacacs shared secret key.

~BR
Jatin Katyal

**Do rate helpful posts**

Tacacs+ Authentication on Juniper Screen OS using ACS 5.3

Thu, 04 Jul 2013 11:54:12 GMT

Please find below:

Tacacs+ Authentication on Juniper Screen OS using ACS 5.3

huangedmc — Thu, 04 Jul 2013 15:25:01 GMT

We too, have Juniper firewalls running ScreenOS.

In our ACS Shell Profile, the Privilege value is set to "root" instead of "read-write", which seems to work for us.

Perhaps you can give that a try?

Re: Tacacs+ Authentication on Juniper Screen OS using ACS 5.3

Thu, 04 Jul 2013 19:30:50 GMT

I try the same, but it dose not work, however I upgrade the firewall frimware today to the latest version, nothing changes. I appreciate if you share me your firewall + ACS configurations.

Tacacs+ Authentication on Juniper Screen OS using ACS 5.3

Jatin Katyal — Thu, 04 Jul 2013 20:12:35 GMT

You can send me the packet capture file, tacacs key that you have defined on Juniper and ACS and ip address in private.

~BR
Jatin Katyal

**Do rate helpful posts**

Re: Tacacs+ Authentication on Juniper Screen OS using ACS 5.3

Thu, 04 Jul 2013 20:24:13 GMT

Paket capture is already attached, I am using the same key in ACS and the firewall, the firewall IP:10.10.218.17 ACS IP: 10.10.36.37

Re: Tacacs+ Authentication on Juniper Screen OS using ACS 5.3

Jatin Katyal — Thu, 04 Jul 2013 20:28:16 GMT

I guess you have posted a screen shot. I am looking forward to have the file that can be downloaded for analysis.

~BR
Jatin Katyal

**Do rate helpful posts**

Re: Tacacs+ Authentication on Juniper Screen OS using ACS 5.3

Thu, 04 Jul 2013 20:34:48 GMT

There is no option to attched .pcap file, so I try to post the screen shot.

Re: Tacacs+ Authentication on Juniper Screen OS using ACS 5.3

Jatin Katyal — Thu, 04 Jul 2013 20:40:11 GMT

When you hit reply next time, you'll see an option "advanced editor" click on that, at bottom you will then see an option to browse and attach file.

~BR

Jatin Katyal

**Do rate helpful posts**

Re: Tacacs+ Authentication on Juniper Screen OS using ACS 5.3

Sun, 07 Jul 2013 05:53:11 GMT

Please find attached pcap file.