05-31-2013 12:47 PM - edited 03-10-2019 08:29 PM
I am trying to get the TACACS+ work on SRX 11.4R7.5. However during my packet capture on SRX. I found the SRX sent authorzation request with service=junos-exec but ACS returns no value. that cause the SRX to use the "remote" as local-user-name and take the class setting for it.
On ACS, I found the "Group Mapping" policy matched to "Default Rule" and Authorization" policy matched the "Default Rule" as well.
Please help to provide me some document link about how to configure the Group Mapping and Authorization policy properly.
Solved! Go to Solution.
06-01-2013 01:48 PM
Hi Joseph
Great guide, I am the other person that Jatin is helping. Unfortunately I still can not get jweb to work unless its via my root
My shell is local-user-name mandatory JWEBADMIN
I log in as my Tacas jweb user, via ssh and I get the correct class
> show cli authorization
Current user: 'JWEBADMIN' login: 'jweb' class 'RW-CLASS'
I try and connect via https (jweb) and it fails.
Jun 2 08:02:49 Juniper-Firewall checklogin[7419]: WEB_AUTH_FAIL: Unable to authenticate httpd client (username jweb)
I can only assume this is some kind of junos OS issue (I have been working with junos for a couple of weeks only)
Here is my SRX configuration.
version 9.6R1.13;
system {
host-name Juniper-Firewall;
authentication-order [ tacplus password ];
root-authentication {
encrypted-password "$1$1tRuy9o2$LwSPxNwe4XGNMOMIMo1pd1"; ## SECRET-DATA
}
tacplus-server {
10.251.200.25 {
secret "$9$zaUL6/AtuOIRS5QF/CuEhws2"; ## SECRET-DATA
timeout 10;
single-connection;
}
}
accounting {
events [ login change-log interactive-commands ];
destination {
tacplus;
}
}
login {
class RO-CLASS {
permissions [ view view-configuration ];
}
class RW-CLASS {
permissions all;
}
user JWEBADMIN {
uid 2028;
class RW-CLASS;
}
user remote {
full-name "Remote User";
uid 2025;
class operator;
}
user remoteadmin {
full-name "Remote Admin";
uid 2026;
class super-user;
}
}
06-02-2013 07:57 PM
Simon,
Your configuration looks fine and your show cli authorization showing the correct "local-user-name" replied from ACS. So the only thing I can think of could be a software bug, since you are running old 9.6R1.13. I will suggest you try to upgrade to 11.4 if possible (My lab was running on current 11.4R7.5)
04-12-2015 05:13 PM
allow-commands | Optional |
"(request system) | (show rip neighbor)" |
allow-configuration | Optional | |
local-user-name | Optional |
sales |
deny-commands | Optional |
"<^clear" |
deny-configuration | Optional |
06-02-2013 09:36 PM
That could only be a problem. I think the response sent by acs is not getting applied correctly. Last time Simon captured the traffic btw acs and juniper shows no tacacs response. Since then we have made some changes and I think its worth looking at the packet capture again if you still wish to troubleshoot.
Upgrade would be a solution for sure.
Jatin
Do rate helpful posts
Sent from Cisco Technical Support Android App
06-03-2013 05:20 AM
I upgraded the junos and it works
Your guide is very useful and I will be retaining a copy
Thanks
Simon
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide