junos提供了基于本地数据库的认证 和基于外部认证服务器的认证两种方式。
一.local 的认证方式, 需要admin在firewall上添加用户和密码
set access profile profile1 client user1 firewall-user password user1
set access firewall-authentication pass-through default-profile profile1
set security policies from-zone trust to-zone trust policy auth_policy1 match source-address any
set security policies from-zone trust to-zone trust policy auth_policy1 match destination-address any
set security policies from-zone trust to-zone trust policy auth_policy1 match application junos-ftp
set security policies from-zone trust to-zone trust policy auth_policy1 then permit firewall-authentication pass-through client-match user1
二.external authentication server
2.1 ldap 先配置好ldap server 在device上做如下配置
set access profile ldap_pf authentication-order ldap
set access profile ldap_pf authentication-order password
set access profile ldap_pf ldap-options base-distinguished-name CN=users,DC=screenos,DC=spg,DC=juniper,DC=net <--------------------------需与server配置一致
set access profile ldap_pf ldap-server $ldap_server_ip
set security policies from-zone trust to-zone trust policy auth_policy1 match source-address any
set security policies from-zone trust to-zone trust policy auth_policy1 match destination-address any
set security policies from-zone trust to-zone trust policy auth_policy1 match application junos-ftp
set security policies from-zone trust to-zone trust policy auth_policy1 then permit firewall-authentication pass-through profile ldap_pf
2.2 Radius:
set access profile radius_pf authentication-order radius
set access profile radius_pf authentication-order password
set access profile radius_pf radius-server $radius_server_ip secret xxxx
set security policies from-zone trust to-zone trust policy auth_policy1 match source-address any
set security policies from-zone trust to-zone trust policy auth_policy1 match destination-address any
set security policies from-zone trust to-zone trust policy auth_policy1 match application junos-ftp
set security policies from-zone trust to-zone trust policy auth_policy1 then permit firewall-authentication pass-through profile rasius_pf
免责声明:本站发布的内容(图片、视频和文字)以原创、转载和分享为主,文章观点不代表本网站立场,如果涉及侵权请联系站长邮箱:is@yisu.com进行举报,并提供相关证据,一经查实,将立刻删除涉嫌侵权内容。