Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Customer Managed Devices (On-Premises) Deployment

Note:

“Configuration of Juniper Secure Edge Deployments” and “Add Directory Services” are mandatory for customers using both On-Premises and Secure Edge deployments.

Add JIMS Server

To add a new JIMS server:

  1. Click Add to add a new JIMS Server.
  2. Enter the IP address or the fully qualified domain name (FQDN) of the server.
  3. Give a description.
  4. Enter the username and password for authentication purposes.
  5. Select the type of identity server used.
  6. Deselect TLS only if you perform troubleshooting.
  7. The identity Server Port and Max Data Rate are automatically configured by JIMS. You can either change to a certificate signed by your organization or use the default certificate provided by JIMS.

Add Directory Services

You must configure at least one directory server for JIMS Collector to collect users, devices, and group memberships. Currently, only Active Directory is supported.

If you plan to use multiple Directory Server with the same credentials, you could create a template to reduce the input for each directory server.

To add a new Directory Server:

  1. Click Add to add a new Directory Server.
  2. Optionally use an already created template to pre-configure the credentials.
  3. Enter the IP-address or FQDN of the server.
  4. Give a description.
  5. Enter the username (Login ID) and password for authentication purposes.
  6. Choose SSL Connection if the Directory Server is on a different host.
    Select and configure your active directory for LDAPS or TLS communication.

Add Identity Producers

You can configure Identity Producers to gather user and device status events. JIMS uses this information to provide IP address-to-username mappings. JIMS also provides device names with domain names to the enforcement points (SRX Series devices).

The identity producers have 3 tabs and the configuration steps for each are listed below.

Add Event Source

To add a new event source:

  1. Click Add to add a new Event Sources.
  2. Use an already created template to pre-configure the credentials.
  3. Select the type of source (Domain Controller or Exchange Server).
  4. Provide an optional description.
  5. Enter the IP-address or FQDN of the server.
  6. Enter the username (Login ID) and password. This should be the newly created service account with limited privileges.
  7. Click Event History Catchup Time. This ensures JIMS has collected historical data before production usage.

Add PC Probe

To add a new PC probe:

  1. Click Add to add a new PC Probes.
  2. Enter the username (Login ID) and password. This is the newly created service account with limited privileges.
  3. Provide an optional description.
  4. After you provide the details, you can move the order of usernames in the sequence you want them executed.

Add Syslog Source

To add a new syslog source:

  1. Click Add to add a new Syslog Source.
  2. Optionally use an already created base config.
  3. Enter the IP-address or FQDN of the server (Syslog Client).
  4. Provide an optional description.
  5. Click Add to define your matching regular expressions.

Enforcement Points

You must configure the enforcement points, otherwise, the SRX Series devices cannot pull user, device, and group information to enforce identity-aware policies (user Firewall).

If you have many SRX Series devices with the same client id and client secret, you can create a template to reduce the input for each SRX Series device.

To add a new SRX Series device:

  1. Click Add to add a new SRX.
  2. Optionally use an already created template to pre-configure the credentials.
  3. Enter the IP-address or each SRX Series device. If you have several SRX Series device within a subnet, you can enter a matching subnet that covers all of them.
  4. Provide an optional description.
  5. Enable the IPv6 reporting as IPv6 as it is used in your organization. This adds duplicated records in the auth table on the SRX Series device.
  6. Enter the Client ID and Client Secret used for this device.
  7. The Token Lifetime is enforced. This lifetime can be changed/adjusted.