Copyright
Copyright © 2006, CRYPTOCard Corp. All Rights Reserved. No part of this publication may be
reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of CRYPTOCard Corp.
Juniper SSL VPN Overview
This documentation presents an overview and necessary steps to configure a Juniper SSL VPN for use with CRYPTO-MAS and CRYPTOCard tokens. The Juniper SSL VPN is used to create an encrypted tunnel between hosts. CRYPTO-MAS works in conjunction with the Juniper SSL VPN to replace static passwords with strong two-factor authentication that prevents the use of lost, stolen, shared, or easily guessed passwords when establishing a connection to gain access to protected resources.
With CRYPTO-MAS acting as the authentication server for a VPN enabled resource, an authenticated connection sequence would be as follows:
1. The administrator configures the Juniper SSL VPN to use RADIUS Authentication.
4. Once the PIN + One-time password is verified against the user’s token and it is valid, it will then send an access accepted. This is illustrated in Figure 2 below.
If the user does not exist, or the PIN + One-time password is incorrect it will send the user an access reject message.
Compatibility
For security reasons, and compatibility with CRYPTOCard Authentication, the version of the Juniper SSL VPN must be release 4.2 or higher.
Prerequisites
The following systems must be verified operational prior to configuring the VPN concentrator to use CRYPTOCard authentication:
1. Verify end users can authenticate through the Juniper SSL VPN with a static password before configuring the concentrator to use CRYPTOCard authentication.
2. Ensure an initialized CRYPTOCard token has been assigned to a CRYPTOCard user. The following CRYPTO-MAS server information is also required:
Primary CRYPTO-MAS RADIUS Server Fully Qualified Hostname or IP Address:
Secondary CRYPTO-MAS RADIUS Server Fully Qualified Hostname or IP Address (OPTIONAL):
CRYPTO-MAS RADIUS Authentication port number: CRYPTO-MAS RADIUS Accounting port number (OPTIONAL):
Configuring Juniper SSL VPN
In order for the SSL VPN to authenticate CRYPTOCard token users, RADIUS authentication must be enabled.
Adding a RADIUS Server
Choose Signing In > AAA ServersFrom the dropdown box next to the New: heading, choose "Radius Server", and click on the "New Server..." button.
Fill in the information for the CRYPTO-MAS RADIUS server obtained from the prerequisites section in the New Radius Server page.
Fill in information for the Backup CRYPTO-MAS RADIUS Server, if one exists.
Under Users > Authentication > 1.Users > General
In this setup page set Authentication to the CRYPTO-MAS RADIUS Server.
In the Servers section of the General Tab, set Authentication to the CRYPTO-MAS RADIUS Server, and click on "Save Changes".
Mapping CRYPTOCard Users to Realms SSL VPN
Once the MAS Server has been added to the SSL VPN setup, you may configure the CRYPTO-Server to map the user to a realm on the IVE.
Under User -> Authentication, click local.
Choose the role to assign the user to.
Check off “Stop processing rules when this rule matches”, and click on “Save Changes”. CRYPTOCard must be notified of the Filter-Id name in order to map the user to the realm.
Connect using the SSL VPN client
Once the SSL VPN has been configured correctly with correct RADIUS server information, the end-users should be able to connect via browser to access network resources using their CRYPTOCard token.
• Enter the CRYPTOCard username
• Generate a One-Time-Password from the CRYPTOCard token
• Enter the PIN and One-Time-Password together in the password field, and click OK
Solution Overview
Summary
Product Name Juniper SSL VPN
Vendor Site http://www.juniper.net/ Supported Client Software Internet Explorer 6+
Mozilla Firefox 1.5+ Authentication Method RADIUS Authentication
Supported RADIUS Functionality for Juniper SSL VPN Connection
RADIUS Authentication Encryption PAP MSCHAPv2
Authentication Method One-time password Challenge-response Static Password
New PIN Mode User changeable Alphanumeric 4-8 digit PIN User changeable Numeric 4-8 digit PIN
Server changeable Alphanumeric 4-8 digit PIN Server changeable Numeric 4-8 digit PIN
Trademarks
CRYPTOCard, CRYPTO-Server, CRYPTO-Web, CRYPTO-Kit, CRYPTO-Logon, CRYPTO-VPN, CRYPTO-MAS are either registered trademarks or trademarks of CRYPTOCard Corp.
Microsoft Windows and Windows XP/2000/2003/NT are registered trademarks of Microsoft
