Configuring User Objects; Configuring Local Users - Juniper NETWORK AND SECURITY MANAGER 2010.3 - ADMINISTRATION GUIDE REV1 Administration Manual

Configuring User Objects

Configuring Local Users

Copyright © 2010, Juniper Networks, Inc.
Secret - The secret (password) shared between the security device and the TACACS
server. The device uses this secret to encrypt the user's password that it sends to the
TACACS server.
Port - The port number on the TACACS server to which the security device sends an
authentication request. The default port number is 49.
User objects represent the users of your managed devices. You can include user objects
or groups in security policies or VPNs to permit or deny access to individuals or groups.
NSM supports two types of user objects:
Local Users—Users with accounts that are managed by your security devices. You can
create local user groups that include multiple users simplify user administration and
make policies and VPNs easier to create.
External Users and External User Groups—Users with accounts that are managed by
external devices, such as RADIUS servers. You can use external users and groups to
create group expressions (for details, see "Configuring Group Expressions" on page 404).
Local user objects represent the user account on your security devices. To add a local
user object:
In the navigation tree, double-click the Object Manager, select User Objects, then
1.
select Local Users. In the main display area, click the Add icon and select New >
User to display the New Local User dialog box.
Enter a name, color, and comment for the local group.
2.
Select Enable to enable authentication for this user, then configure the authentication
3.
methods for the user:
XAuth. Enables XAuth authentication for this user. If you select this option, you must
also enter an XAuth password for the user.
NOTE: All passwords handled by NSM are case-sensitive.
IKE. Enables IKE authentication using one of the IKE proposals defined in the IKE
proposal objects. If you select this option, you must also configure the IKE Share limit
and authentication token.
Auth. Enables local authentication against a username and password stored in a
security device's local database. If you select this option, you must also enter an Auth
password for the user.
L2TP. Enables authentication in the L2TP tunnel that the user uses to connect to the
device. If you select this option, you must also enter an L2TP password for the user.
Chapter 8: Configuring Objects
399