Pulse Secure

This guide explains how to configure Pulse Secure (now Ivanti Connect Secure) to authenticate users against Ironchip over RADIUS.

Requirements

• A RADIUS server: an NPS server protected by Ironchip or the Ironchip RADIUS server.
• The IP, port and shared secret of that RADIUS server.
• Administrator access to Pulse Secure.

Configure Pulse Secure

Create the authentication server

1. Sign in to Pulse Secure as an administrator.
2. Go to Authentication > Authentication Servers > New. Create a new server to perform authentication and enter the RADIUS server values.
3. If required, create a backup server. Ignore the RADIUS accounting section.
4. In the Custom RADIUS Rules section, click New RADIUS Rule and enter the rule data in the window that appears.
5. Click Save Changes and ignore any warnings that appear.
6. Click Save Changes again to save the authentication server.

Create the user realm

1. Go to Users > User Realms > New.
2. Define a new authentication realm and enter the values.
3. Click Save Changes.

Optionally, you can configure Role Mapping to assign roles based on user attributes. You can also rely on the advanced RADIUS configuration for dynamic roles.

Configure the sign-in policies

1. Go to Authentication > Signing In > Sign-in Policies.
2. Identify the policy and click its URL to confirm or edit the selected realms.
3. Open the Authentication realm section of the policy details page.

Verify the integration

Give users access to the Ironchip application that your RADIUS server uses (the NPS one, or the API key one for the Ironchip RADIUS server) in the Ironchip admin console. Sign in to the VPN as one of them: after you enter your username and password, you are asked to authenticate with Ironchip.

Troubleshooting

• The RADIUS server rejects the connection: check that the shared secret is the same in Pulse Secure and in your RADIUS server (radius_key in the Ironchip RADIUS server) and, if you use NPS, that the Pulse Secure IP is configured as a RADIUS client.