Problem with auth policy

[malekdannourah]

Hi,

I have a Netscreen-5GT ADSL and have a number of policies in place that are working fine. I have a website hosted on one of my machines that does not use authentication. Its not hosted using apache or IIS, etc.. but rather its own propietery type webserver, so adding authtication will not be trivial.

As such, I wanted to add authentication to the policy that permits the traffic from untrust to trust. The policy without auth works fine, but as soon as I enable auth, its as if the policy does not exist and the website is unavailable. I do not get the http logon banner that I was expecting.

I'm running ScreenOS 5.4.0r6.0 .

Any help/advice appreciated.

 

[Packet7]

Hello,

What type of Auth did you configure (Auth, WebAuth, etc)? Did you define a user in the local DB or are you trying to use RADIUS or SecurID? Let me know.

Rgds,

John

 

[malekdannourah]

Hi,

Just auth (dont have an extra public IP for webauth), using local DB. I have ceated a single user account no the device, and have tried explicity permitting that user in the policy, and also setting the policy to all users. On the user properties, the user is set as an Authentication User.

Cheers.

 

[Packet7]

Hello,

If you are looking for a Login Page, I think you need to use WebAuth.

Rgds,

John

 

[malekdannourah]

Thanks, although not according to the manual.

Auth is for run-time authentication (ie, the netscreen intercepts the SYN, buffers it and challenges the user with a banner. If successfull the buffered packet is released, and further traffic is permitted).

WebAuth is for pre-policy validation (ie, the netscreen redirects the session to the webauth IP, authenticates the user, then permits the traffic based on the policy).

http://www.juniper.net/techpubs/software/screenos/screenos5.4.0/CE_v9.pdf

I'm not a netscreen expert, but thats certainly how the manual reads!