junos提供了基于本地数据库的认证 和基于外部认证服务器的认证两种方式。
一.local 的认证方式， 需要admin在firewall上添加用户和密码
set access profile profile1 client user1 firewall-user password user1
set access firewall-authentication pass-through default-profile profile1
set security policies from-zone trust to-zone trust policy auth_policy1 match source-address any
set security policies from-zone trust to-zone trust policy auth_policy1 match destination-address any
set security policies from-zone trust to-zone trust policy auth_policy1 match application junos-ftp
set security policies from-zone trust to-zone trust policy auth_policy1 then permit firewall-authentication pass-through client-match user1
二.external authentication server
2.1 ldap 先配置好ldap server 在device上做如下配置
set access profile ldap_pf authentication-order ldap
set access profile ldap_pf authentication-order password
set access profile ldap_pf ldap-options base-distinguished-name CN=users,DC=screenos,DC=spg,DC=juniper,DC=net <--------------------------需与server配置一致
set access profile ldap_pf ldap-server $ldap_server_ip
set security policies from-zone trust to-zone trust policy auth_policy1 match source-address any
set security policies from-zone trust to-zone trust policy auth_policy1 match destination-address any
set security policies from-zone trust to-zone trust policy auth_policy1 match application junos-ftp
set security policies from-zone trust to-zone trust policy auth_policy1 then permit firewall-authentication pass-through profile ldap_pf
2.2 Radius:
set access profile radius_pf authentication-order radius
set access profile radius_pf authentication-order password
set access profile radius_pf radius-server $radius_server_ip secret xxxx
set security policies from-zone trust to-zone trust policy auth_policy1 match source-address any
set security policies from-zone trust to-zone trust policy auth_policy1 match destination-address any
set security policies from-zone trust to-zone trust policy auth_policy1 match application junos-ftp
set security policies from-zone trust to-zone trust policy auth_policy1 then permit firewall-authentication pass-through profile rasius_pf
创新互联公司专注于企业
全网整合营销推广、网站重做改版、白云网站定制设计、自适应品牌网站建设、
成都h5网站建设、
商城系统网站开发、集团公司官网建设、
成都外贸网站制作、高端网站制作、响应式网页设计等建站业务，价格优惠性价比高，为白云等各大城市提供网站开发制作服务。
另外有需要云服务器可以了解下创新互联scvps.cn，海内外云服务器15元起步，三天无理由+7*72小时售后在线，公司持有idc许可证，提供“云服务器、裸金属服务器、高防服务器、香港服务器、美国服务器、虚拟主机、免备案服务器”等云主机租用服务以及企业上云的综合解决方案，具有“安全稳定、简单易用、服务可用性高、性价比高”等特点与优势，专为企业上云打造定制，能够满足用户丰富、多元化的应用场景需求。
网站栏目：JuniperLDAP和RADIUS-创新互联
本文来源：
http://cdkjz.cn/article/docohs.html
