If you plan to deploy only the On-Demand password based authentication in your user base using Deepnet T-Pass, then you will configure your Juniper in such way that it will use your DualShield Radius server as the primary authentication server.
Your DualShield server will be responsible for verifying both users’ AD password and One-Time passwords. There should be no Secondary authentication servers.

Edit Logon Procedure

In the DualShield Administration Console, edit the Logon Procedure for your Juniper VPN application.
You will need to define Two Logon Steps: The first step requires users to enter their "Static Password" (AD password), which will also trigger the DualShield Server to send the user’s "On-Demand password". Hence the Second step will then prompt users to enter their "On-Demand Password".

Configure Juniper

To implement Radius Challenge & Response, you need to edit the Radius Server and add a new Radius Rule.

    1. Select "Auth Server" and select the DualShield Radius Server entry you have created, scroll down to the "Custom Radius Rules":



    2. Select "New Radius Rule", and populate the form below:



    3. Click "Save Changes"



    4. Use the DualShield Radius Server as the only authentication Server in the User Realm



    5. Set up a Role Mapping Rule 

 



f. Under Signing In → Sign-in Policies create a new Signing URL:

Test Logon

The user experience in the login process is shown below:

    1. Users will be first asked to enter their User Name and AD password



    2. The user name and password will be submitted to the DualShield Server to be verified. When the DualShield has successfully verified the user and its password, it will generate an time-time password and send it to the user by SMS or email. The user will then be asked to enter the one-time password:

Related Articles