Chapter 14 - Junos Pulse Access Control integration

IF-MAP transfers the session from the Secure Access
to the Access Control   seamlessly.
The same thing happens when you access items protected by another Access Control Device.
This is done with a single Login.
IF-MAP is part of the TNC. Trusted Network Connect.

Only the Junos Access Control Service can server as an IF-MAP server.
For that you would need a license.

IF-MAP is a repository of information about the sessions, roles etc.
Each device can connect to the server and get a subset of choice of the data and also update
the server.  So the Secure Access can put some data in and then the Access control can connect
use that data and apply it to its session.

Server IF-MAP license       MAGX600-iFMAP you need to buy the license for this.

Okay in system IF-MAP overview


Select the - system > IF-MAP federation
Select the server from the choices
Then add clients that will communicate with this server. They need a password or certificate.

(IF-MAP clients do not need a license)

On a client.
Select IF-MAP client
Then add a server URL   httsp://ac1.pulse.local/dana-ws/soap/dsifmap
Then add the user and password.

On the clients you set up an Export-Policy.
They will export it to IF-MAP data to the Server

On the clients you set up an Import-policy.
This will interpret the IF-MAP data from the server into roles.

On the IF-MAP client you can see the Active Users TAB
This will give you the data that is being IF-MAPed

On the IF-MAP server you can see the sessions that have been exported/published to it.
Same here.





NSM
Network Security Management.
This is basically an appliance currently that allows you to manage SRX and NetScreen.

You can buy it currently however they are phasing it out for the Junos SPACE

The Firewall has three ways of getting configuration data.

1. This is the CLI or webmanagement of the device itself (obvious)
2. Junos Pulse Access Control service   - because we linked them.
3. NSM - NSM centrally manages the firewalls.

It is best practice to make the NSM the authorative one.

Update the Pulse   - you can click   refresh policies
Avoid CLI changes to the devices that are under the NSM.

Now, we can add the Pulse to the NSM to make life easier.
Procedure is.

1. Install the Junos Pulse Access Control device (MAG)
2. As Junos Pulse Access Control Service on the NSM
3. Configure and Activate the DMI agent on the Pulse Access Control
4. Confirm connectivity and import the configuration into the NSM.

Let's see how its done.

DMI is a set of protocols that run on TCP.
Netconf , XML alarms and structured syslog.
One DMI agent is per device.

Under the TAB DMI Agent.

{} Inbound if you are using SSH to manage the device.

{} outbound enabled    if you are talking to the NSM

Set up the port to accept on  which is 22 ssh

Set up the "outbound connections"   primary, backup ports , device and HMAC key   7804

Admin Realm
{} DMI logging 

STRM

STRM Security Threat response Manager

is basically an event collection and correlation point for collecting all the logs from the security
devices, this way you can view them centrally.

This helps associate security breaches with a user and not only an IP.

This is what it looks like

It has hardDrives to store the data of the logging.

Let's configure it.

This is done under

System > log/monitoring    you add syslog servers
you can also filter what to log.

IDP
Juniper has IDP sensors either as dedicated devices.

or on the SRX family.

*If the IDP is a stand alone IDP like the ones above.
Then you need to manually configure the list of IPs for the device to monitor

*If the IDP is a module on the Enforcer (SRX/SSG)  then the module
will get the IPs to monitor from the Dynamic Auth table.

The IDP detects malicious traffic.
It notifies the Junos Pulse Secure Access Control Service. 

Which will take an action on the user session.

{They will send the IP ports the attack, time and the severity}

Actions - So the actions you can take can be Manual (by looking at the Active USers)

Automatic - Drop him, disable the user, remediate the user to another role.

The Junos Pulse will display an error message to the disabled user.



Configuration

Adding a standalone IDP sensor:
-System > configuration > SensorsAdd the sensor - The port on which to listen

the password 

Manually enter the addresses to monitor and the severity that you want. 1 to 5   5 is critical.

Adding a Sensor on an Enforcer:

You can also configure a Sensor on the INFRANET ENFORCER (firewall) by
-UAC  > Infranet Enforcer > connection > enforcer
{} USE IDP module as sensor.

This will use the DYN auth table for the choice of IPs to monitor.
Both have Severity filters that determine what level is reported to the Secure Access.
1-5 

Policies will be in the Configuration > Sensors > Sensor event policies
You create a RULE based on the IDP signals that come in .

So EVENT 

then action    ignore/terminate/disable user/replace his role

Then you select on which ROLES to apply this rule.

On System>> Status>> Active Users

you can see the users and run manual actions on them or reenable them if you want.

So IF-MAP Advantages are

single Sign on
You can get service from any AC in the federation
You can move the Session from the SSL to AC seamlessly .

Chapter 13 - High Availability

In Junos Pulse.
A cluster pair is two unit
A cluster multiunit is more than two which means 4.

Cluster can be an Active/Active or an Active/Passive.

Active Passive
Always uses VIP
they sync the state
The Active device sends ARP to the VIP.
When it fails the Passive device will send ARP to the VIP.


Active/Active
Can be done with a
1. Load Balancer
2. DNS round robin- the negative about this is that in case of failure you lose 50% of traffic.

This also gives you more throughput but the same licensing.

Must be the same LAN IP SUBNET in order for that to work.
State synchronization is done using the internal NIC
Must be the same hardware the same OS version
All of the resources must be accessible to all of the devices.


Alright.
When to use VIP Virtual IP.

If you have Pulse and Odyssey they download a list of cluster members and will switch to the next one.
Agentless must use the VIP.

This is another case of using VIP.
This time for the enforcer.
You can either use the VIP address for it.
Or create many instances of the MAG for it. Because they are all in sync it does not matter.



Synchronizing the information from device to device.
Information is synched using the internal interface.
There is a cluster password.
New member will send a message to the existing server asking for a synchronization.
After that you must reconfigure node-specific settings.

Transient information can be synched using.
Unicast, Brocadcast or Multicast
Session data and enforcer status

Nodes will have the service pack, so when you update one it will update the others.

Doing this
A cluster license is not required on the first node
Only on the nodes that join the cluster.

So
System > Clustering > Join Cluster      then add a cluster name password and name of the member.

You can click PROPERTIES on the cluster and switch it from Active/Active to Active/Passive
You can also set up an EXTERNAL VIP and an INTERNAL VIP.

For ACTIVE/ACTIVE to have a VIP you must use a loadbalancer.

You can set up Synchronization.
{}Logs
{} user sessions
{} last time access time for the user sessions

You can change the number of ARP ping failures before the interface is disabled from 3
{} disable the external interface when the internal one fails.

{} advanced settings will change the number of timeouts for the underlying cluster.


OK.

Adding cluster members and checking the status.


You can add a load balancer from the
system > Network > Load Balancer.

You can go to the next device
System>Clustering > Join Cluster


on the
system > Status
you can see a member status window
or you can go to the CLUSTER Tab to see their status.



Configuring the Cluster on the Firewalls.
For the Firewalls you can have Active/Active  or Active/Passive
Active/Active does not support IPSEC


In the INfranet Enforcer
You can add two serial numbers to the Platform.

In the Firewall you simply replace the AC1 with the VIP address
or you create a number of infranet-controller

Ok.
So Active / Active does NOT need a VIP it will use the Load balancer

Active/passive  if you have an internal IP use the internal VIP
If you have an external IP too then you need to create an External VIP too.

Synchronize the users is an options
So is the synchronize the log messages.

{}disable external when internal fails, this is for the active/passive.

Clustering STATUS
will show you who is set.

_system > clustering > load balancer
is where you define the load balancer and if it is between endpoints or the Enforcer.

Chapter 11 authentication

authentication >> auth servers
select the type
local - we used this
ldap   -
NIS
ACE
RADIUS
AD     -    windows LDAP
anonymous Server
SiteMinder
Certificate
MAC address authentication which we used before.

So when the user SIGNS in  he will specify which REALM to use
a REALM is associated with an Authentication Server
The Authentication server will very the user exists and give approval
The Authentication server will also send group attributes.
The Junos Pulse Access Control will evaluate role-mapping rules to see what role to apply to the group.



LDAP
NAME :                   # Give this server a name
LDAP server              # give it an IP
LDAP port             #give it a port       389 usually  or 636 ssl
Backup Ldap1
Backup LDap2        #backup servers
LDAP server type
connection of Unencrypted/ LDAPS / TLS
Connection timeout
Search timeout

Active Directory is annoying in that it requires a username with permissions to search the ActiveDirectory.
So for AD mark the check box for Authentication and provide  a user and password.

If you want to allow users to change their LDAP/AD passwords from the MAG you must
provide an Administrator account in this too.


You will specify a Base DN to start from
dc=sales,dc=bobcat,dc=com

You will specify a Filter like   cn-user
Strip domain from users  so users can use   bobcat/David   format.
It will remove the Bobcat and use it as the Domain.


You can determine group membership by setting up the
BASE DN
Filter
member attribute
query and 2 nested levels is the best practice.
Static or Dynamic.



RADIUS 1812 183
In this scenario the MAG is a client of the BIG radius
Name
NAS_identifier        - is the name that the MAG will use when courting the RADIUS
Server IP
Port 1812
backup server if you want.

Radius Accounting
RADIUS authntication can be enhanced by using RADIUS accounting.
This is when you tell the RADIUS the user just logged in
You do this by sending a Start message after success singing in
and a STOP message after logging out/denied/tiemout/admin intervention.

This is the template you send that data as

You set up a template for returning the data
<USER>(<REALM>)|<ROLE SEP=
so user    domain    then the roles separated by a comma.

Active Directoy and NY authentication 
Name
Primary Active Directory
backup
Domain
administrator
password for  administrator to the AD.


Authentication using
Kerberos   NTLM v2  NTLMv1
only Active Groups.

anonymous authentication
This is for guests.
You use this to limit resources for them.
only define the NAME

users >> user realm  > new user realm
assign a server to it.


You can have different ones for each item.
authentication    let's say Radius
directory/attribute:  let's say AD
accounting :  let's say Radius.
refresh the roles if you want every 60 minutes to see if there was any change.
{}So refresh role will be for new sessions
{}refresh resource policies might kill current sessions.

Create a policy
ip limit

user realms> AD realm >> authentication policy >:>>SSO
single sign on a checkbox.
Stations must be members of the domain.
You sign in to the workstation and your credentials will be used for the Junos Pulse.




Creating Role-mapping RULES
First one is Username so you can manually map usernames to roles.
like fred, bob, muhammad  role IT engineers.
User Attribute is from the LDAP or Radius   - Click update to see the attributes you can select
Certificate - map them based on scertificate attributes.
Group Membership  -  this is only for LDAP or AD.

o= organization
cn=container
ou=organizational unit
Try remembering AD and LDAP from Microsoft.


also o   can be used for organization
C for country


The Rules are.   IF user has any of the following attribute values.
The value can be IS or ISNOT

THEN assign him the role.
(select a role)

Chapter 10 - Endpoint defense

Chapter 10 Endpoint defense.
Basically the Host Checker feature

Host Checker is a client side agent that performs checks by collecting IMC  integrity measurements   then sends thos measurements to the   IMV  which is teh MAG.
It can also check software,signatures, third party DLL certificates or similar.

It is compliant with the TNC trusted network connect.

This works in two ways.
If the device has Junos/OAC  it has IMCs
If the device is java or agentless MAG will send him the IMCs.
The IMCs collect data and send it to the IMV  (MAG)

There are two ways of using it.
One on the Authentication REALM as the device is entering the network.
The second is on the ROLE. so if it does not meet the IMV  it will not be given the role.

Deny or Fix(remediation)

Steps.
Create the Host Checker policies.
Apply the policies to the REALM or the ROLE
specify user access to the hostchecker client
set up loggin.

- authentication >> endpoint security >> host checker
autoupgrade option
and the package to use.
First ivs VIRUS it can check for the signatures of AV software. list is XML
Second is patch , you can get a patchdata.dat
Third you can update the ESAP.   Endpoint security assessment plug-in.

Create the POLICY. of what to check.
Yo uwill specify what happens on every operating system  and what checks will be done on it.
The checks will change based on the operating system
They are rule checks for example. Require latest AV
You can also set up Remediation options if those items are NOT met.
Ports
Process
Files.
Registry keys
MAC
MAchine certificate must have a CN of your domain for example.
Patch Assesment.

You can require ALL of the rules
ANY of the rules
or create rule-set combos.

REMEDIATION
you can offer manual or system.
Manual are instructions
Automatic are killing processes deleting files.
you can also send the reasons to the user.

After the user fails he will be given two options.
Try again or enter without a certain role.

Message
Your connection has failed and the remediation page.

EES is an additional scanning license Enhanced Endpoint security.
It protects against MALWARE and AV.


Setting up the policy on the realm.
user >Authentication Realms >   user_realm
First is source IP
Browse limit
Certificate limit
Pssword limit
host checker resutls

Last is you can apply restrictions based on the host check results
so if they did not pass they only get a limited ROLE>

Chapter 8 - 802.1x

802.1X  Layer 2   {key is to remember this is Layer 2}

802.1x
This is an IEEE standard for layer 2 Access Control and Authentication.
Defines a method of associating users with rights using   Filter or Vlan assignment

Time to memorize.
Memorize the Supplicant / Authenticator/ Authentication server.   You can use that for CCDA, or CISSP.

802.1x is based on the EAP Extensible Authentication protocol. This is a framework.
EAP(method)  is the actual authentication mechanism used.

The Supplicant 
will have some software installed on it
802.1x Junos Pulse or OAC or third party.
It cannot send any layer 3 till the 802.1x authorization has been completed.
The negotiation of 802.1x is done using EAP messages.

The Authenticator.Blocks all traffic till he has finished negotiating their access.
The request he receives is an  EAP over LAN.
It extracts the identity of the user and credentials and sends them to the RADIUS
or authenticating server using a standard format.

The Authenticating server Will evaluate the credentials and can also return additional information
Like which VLAN to put him on  or other instructions.


What is EAP
It is an enhancement to PPP

In layman terms.
You arrive at the gate.
You say Hell    (EAP Start)
The guard says show me ID   (EAP request identity)
You give him ID  (EAP response)
The guard calls Security Room and asks if he can come in. (Radius request)
The Security Room says to the guard ask him a challenge (Radius Access Challenge)
The Security guard relays that to you.
You respond
The guard relays your response to the Security Room.
They say,  let him in and give him this ID (optional)
The guard says success and gives you an ID  (vlan)


Supported EAP.
EAP- TTLS  this stands for Tunneled Transport Layer Security.
This is the default for OAC.
It has two phases.
The first one is where the Authenticating server presents a certificate X509 to the supplicant.
This will create a Secure Tunnel.
The second is the supplicant can go back to presenting its credentials.

EAP-JUAC is Juniper
and allows the OAC software to take advantage of the full set of features like host enforcer.
EAP-JUAC is the default protocol for the INNER protocol.

Junos pulse can support using the NAP for the 802.1x

Third party
EAP-TLS enables non-juniper supplicants to authenticate using the PKI

EAP-SoH is a statement of health, this works with windows.
To use EAP-SOH you must use EAP-PEAP as the outer protocol   OAC/Pulse.

EAP-GTC  for tokens
PAP  plaintext passwords.

CHap microsoft CHAP  EAP-MD5   EaP-MS-CHAPv2


Ok, the above mentioned an Inner Join   and an Outer Join.

Inner Authentication
Outer Authentication.
(I am thinking Access joins, sorry)

Example 1:
Assign the Users a VLAN based on their LDAP group membership.
The pulse will push the VLAN 20 to the switch (Authenticator) who will assign it to the client

Example 2:
When you daisy chain a PC to a Phone to a switch. Each item will need a different VLAN.
1. The switches must support the dual VLAN assignment this is usually done with CDP/LLDP
2. Either use the phones 802.1x
3. or you can use the phones MAC by using a MAC database as the authentication realm.


Radius elements in 802.1x
The Juniper Radius is based on their older product called  "Steel Belted Radius"
It is a license you can put on the MAG to enable the Radius on it or you can use an external RADIUS
server.
The RADIUS will receive the EAP messages from the supplicants.
It will perform authentication.
It will send out additional attributes (like the VLAN, enforcer settings)
The Switch 802.1x or AP will apply those setting to the supplicant session.

RADIUS servers include
Clients  - these are the Authenticators 802.1x who apply for supplicants.
Vendors - list of client manufacturers like 802.1x Juniper switches or Cisco802.1x.
Dictionary -   This is the list of attributes that we talked about that are available.

{{VSA vendor specific attributes}}}

Users - List of usernames and passwords. They can also query an external server for those like AD/Ldap

Radius Proxy allows the MAG to use an external Authenticating Server (RADIUS)
The MAG will "proxy" the request to it and then update the Authenticator.
The Data from the MAG to the AAA in the "inner tunnel"  is cleartext.
The Junos MAG will add the attributes based on the ROLE

MAC Authentication for client-less devices.
First problem with MAC authentication is user spoofing.
You can set up separate VLANs for the devices so they cannot cross into the corporate LAN.
You can also set up Packet Filters so they can only run specific protocols .
You must have a database with all the MACs required.

Great BAY BEacon Endpoint profiler - is a product that can analyze the endpoints
It identifies them and can tell if they can run the 802.1x or need MAC authentication.
It can mine data from those devices for the monitoring part.
It helps facilitate mobility of those devices.
Beacon can help with compliance in strict security settings.

set system radius-server x.x.x.x secret

set profile ac1
   authentication-order radius
radius { authentication server x.x.x.x.}

the radius is the MAG.


On the switch
set protocols dot1x authenticator authentication-profile-name AC1 interface ge-0/0/2
supplicant single
re-authentication 3600
guest-vlan  remediation
server-reject-vlan remediation


guest is for unauthenticated
server reject is for failed authentication.

Radius-dictionary   creates values that specific manufacturers can use.

802.1x  TTLS PEAP for clients
802.1x  MD5  TLS for phones.


Junos Pulse
Outer EAP-TTLS
inner EAP_juac

Chapter 7 - Firewall Enforcement

So on the last box.
Access Control Service Policy.
Firewall Enforcement
Host Enforcement.
802.1x (comes later on)

MAG Secure Acecss can send items to the
Firewall, like Set up the IPSEC VPN
Firewall,  set up a resource access
Client, Host Enforcer - Set up a rule on the host.  like block certain incoming TCP.

Enforcement
Source IP - Control Access based on source destination IP, protocol, ports
{no encryption}
Does not support third party ??

IPSEC
The Firewall uses IKE  and can use the XAUTH to validate the user credentials. Pulse.
ESP or AH  {AH does not do encryption}

So let's see a sample configuration on the SRX.
set security policy from-zone WAN to-zone LAN policy access_ac source any
set security policy from-zone WAN to-zone LAN policy access_ac destination ac1
then permit   


set security policy from-zone WAN to-zone LAN policy any_resource source any
set security policy from-zone WAN to-zone LAN policy access_ac destination any
then permit   application-services unified access control.

First rule, fine, get in, go to the ac1 and login.
Second rule. Nah, can't come in unless you went to the ac1

They recommend setting up
Junos Pulse AC service IPSEC first
General VPN second
Source IP third.

Associating a given user with a policy occurs during the role-mapping
Junos Pulse will build a table.
The table will match the user to the polcy rules.
It is merely creating the rules  and not enforcing them.

It evaluates the policies only.
When the user types in the sign-in page.
After the user authentication.
When the user requests a resource enforcer will check
when the host checker changes.

So when you make any changes to the MAG unless any of the above happens the
users will still have the same access.

Pulse OAC

At the start enforcer does not know if you are allowed it only knows to consult the MAG appliance.
There is an AUTH table where the data is cached.
This is called Dynamic Authentication table allocation.


Resource Access
Auth tables on the Enforcers match the User role with the resource access required.
The policies are distributed by the MAG to the enforcers.

Endpoint tries, he is dropped, the SRX tells the MAG about this.
The MAG sends a policy to the Auth Table
next retry the endpoint is allowed in.
{{If the DNS is behind the enforcer it might create DNS timeout issues.}}

So basically the SRX is set up as normal.
set security policies from zone wan to zone lan policy access_resource match source any
set security policies from zone wan to zone lan policy access_resource match destination any
set security policies from zone wan to zone lan policy access_resource match application any
set security policies from zone wan to zone lan policy access_resource then permit

permit
{ application-services
          uac-policy
}
So the uac-policy is the AUTH table.
It basically tells the traffic match to then match the AUTH table.

The AUTH table will have the permit to the resource   and the user role allowed.

IPSEC to resource.
Must have both an IPSEC policy and the resource policy for it to work.

Host Enforcer is on the MAG
when you connect with the OAC it will push it to you.

Auth Policy
Either Dynamic which will be for all.
or you can set up the enforcer to support certain roles so you can limit the size.

If the Devices Enforcer and client are in between NAT you can use the NAT IP Address pools.

Firewall Enforcer Configuration
Basically the usual first part.

set security policies from zone wan to zone lan policy access_resource match source any
set security policies from zone wan to zone lan policy access_resource match destination any
set security policies from zone wan to zone lan policy access_resource match application any
set security policies from zone wan to zone lan policy access_resource then permit

permit
{ application-services
          uac-policy

Set up the MAG as the Radius Server
set access profile Employees authentication-order radius
set access profile Employees radius-server 172.16.15.1 secret password

set up the IKE phase 1 parameters
set security ike proposal Employee authentication-method pre-shared-keys
set security ike proposal Employee authentication-method pre-shared-keys


set security ike policy Employee mode aggressive 
set security ike policy Employee pre-shared-key  ascii-text   passwordIPSEC

set security ike gateware Employee ike-policy Employee 
set security ike gateware Employee ike-policy hostname endpoint.pulse.local
set security ike gateware Employee ike-policy xauth access-profile Employees

set security ipsec proposal Employee protocol esp

set security ipsec policy Employee proposals Employee

set security ipsec vpn pulse ike gateway Employee
set security ipsec vpn pulse ike ipsec-policy   Employee
set security ipsec vpn pulse ike estblish-tunnels immediately 


NOW

Basically the usual first part but this time it leads to the tunnel

set security policies from zone wan to zone lan policy TUNNEL       match source any
set security policies from zone wan to zone lan policy TUNNEL       match destination any
set security policies from zone wan to zone lan policy TUNNEL       match application any
set security policies from zone wan to zone lan policy TUNNEL      then permit

permit
{tunnel ipsec-vpn pulse}
{application-services
        uac-policy}

the above was on the enforcer, pretty easy to tell today as it used JUNO.

Now on the MAG.
You need to configure this too.

UAC --> Infranet Enforcer  {This is where most of the SRX firewall items are} --> resource Access

resource --> new policy 

name

description

resources

Infranet Enforcers  --  map out which Infranet Enforcers will be enforcing this.

Which roles will have this policy applied to them.

Allow/Deny

You can add additional enforcer options   {web/anti-spam/av/logging/idp}

Next tab is IPSEC
you can set up the IPSEC tunnel which will be created when you want to access that resource.

Specify the enforcer

Specify the roles this will apply to .

AUTH table mapping allows you to map
specific items to specific user roles this way you can keep the table nice and short.

IP address pools.
For the above settings you can aslo force the enforcer to use an IP from the NAT pool.
Then again add that to the relevant enforcers

then add it to the relevant roles.

host Enforcer.

UAC >> host enforcer

You set it up,
you select the resources 

{{on this you set up the rules you want the enforcer to run.

<protocol>:<host>:<netmask:<destination ports>:<source ports>:

You apply it to the roles.

Verify

show services unified-access-control authentication-table

show security ipsec statistics

show security ike security-associations

User access logs
Pulse diagnostic viewer.
pdv.exe

from the OAC you can run diagnostics.


Captive portal is only for http
set services unified-access-control captive-portal guests
redirect-traffic-unauthenticated
redirect-rul httsp://x..xx.x./guest

set policty
then permit application-services uac-policy  captive-portal guests

Chapter 6 - Client access

How can the client access

Agent.
Agent basically means you install a piece of software on the endpoint and it will
connect. The disadvantage is the agent installation process.
802.1x supplicant.
Can test the endpoint for compliance to your policy like IPSEC
Compliance to host checker.



OK.
So location aware means it can determine that it is in the company LAN or at your home.
Multiservice so it can also do acceleration.
802.1x supplicant
windows only currently.



OAC
Odyssey access client
Does not support SECURE ACCESS Service
It also does not provide Application Acceleration.

So only 802.1x and host enforcer
This is the only client that can deliver the host enforcer.



Java we said was for every device that has Java
It will send the Ajax heartbeat which will determine you disconnected and clean up the session

Host Checker Agentless.
This is a dynamic download of a host checker.
It only runs host checker
It establishes a heart beat to the MAG

Agentless
Must run the Browser to keep connection.
Does not require administrator rights.

Third party using TNC trusted network Connect.

Access Control supports phones and other devices using
the MAC address authentication feature.



configuring this nonsense was in the User >>  ROLES >




Mark the check box. If you select more than one, he can choose when logging in.
You can also add specific scripts that will run on the device at the START or and Session END


Screenshot of connection set
new connection set
>Users > junos Pulse > new connection set
there are options here.
Saving logon to keep the data so you can reconnect within the session limits.
Dynamic certificate trust means the users can skip bad certificates.
Wireless supression will supress his wireless.

In the Junos Pulse Connection
You can establish the type of connection is
IC or SA
802.1x
Firewall
WX  for acceleration  WX was that product line.

{}  if the user can override it
{}    server   runs the connection back to this server
 or you can specify a URL which will send the client to that URL.

So for example I can set up the users to get a policy from one location and connect to another.

Connection radio button    if you want to connect manually, rules, automatically after logon.

new location awareness rule
Location aware rules.
When the DNS server is x.x.x.x then apply something.
Client must have certain IP range.

Components 
means the isntallation of the client and you specify the components to be installed


Last on the ROLE you will select which components SET will be applied on the
Roles Pulse.  (you select the one you created above)



User Experience.
Connect.
Username password


Same thing for the OAC Odyssey  ODyssey
Check box for install client and simply select the Install odyssey radio button.
You can add a preconfiguration file that will be installed for them. So you can customize the file.
You select to prompt the user for password
and the type of EAP for the outer join.
You can also configure his adapters.

Agentless
You can customize the UI.



So
Mark the Agent you want to install
Make a connection set
Then apply it to roles.