These instructions are for the Juniper-branded SA SSL VPN. If you have updated to Pulse firmware or devices, please see the Pulse Connect Secure SSL VPN instructions.
See our alternate RADIUS instructions if you'd like to control the "failmode" (how the system will act if network communication with Duo is interrupted) or integrate Duo into a single Juniper sign-in URL with multiple authentication realms.
This application communicates with Duo's service on TCP port 636. Firewall configurations that restrict outbound access to Duo's service with rules using destination IP addresses or IP address ranges aren't recommended, since these may change over time to maintain our service's high availability. If your organization requires IP-based rules, please review this Duo KB article.
Before moving on to the deployment steps, it's a good idea to familiarize yourself with Duo administration concepts and features like options for applications, available methods for enrolling Duo users, and Duo policy settings and how to apply them. See all Duo Administrator documentation.
Make sure that Duo is compatible with your Juniper Networks Secure Access SSL VPN. Log on to your SA, IVE or MAG administrator interface and verify that your firmware is version 6.x, 7.x, or 8.x (up to 8.2).
You should already have a working primary authentication configuration for your SSL VPN users before you begin to deploy Duo, e.g. LDAP authentication to Active Directory.
Then you'll need to:
The security of your Duo application is tied to the security of your secret key (skey). Secure it as you would any sensitive credential. Don't share it with unauthorized individuals or email it to anyone under any circumstances!
In the left menu, navigate to Authentication → Signing In → Sign-in Pages, click Upload Custom Pages..., and fill in the form:
|Templates file||Upload the customized Duo Juniper package zip file downloaded from the Duo Admin Panel earlier. Your file name will differ from the example image below, reflecting the actual version of the Duo Juniper/Pulse package and your organization's Duo Account ID (visible on the Settings tab of the Duo Admin Panel) as the accountid i.e. Duo-Juniper-8.x-v5-1234-5678-90.zip.You must use the Duo package customized for your account. Uploading the Duo package for the wrong account can cause authentication failures.|
Check the Skip validation checks during upload box. If you don't you'll see some warnings after uploading the file, which you can ignore.
Click Upload Custom Pages.
Duo's cloud service secures SSL traffic with certificates issued by DigiCert. You'll need to install the DigiCert CA certificate on your SSL VPN so that it can establish the secure LDAP connection to Duo using certificate validation.
To install the DigiCert intermediate CA certificate used by Duo's service:
If you did not already do so, download the DigiCert SHA2 High Assurance Server CA certificate from the DigiCert site for installation on your SSL VPN device.
Navigate to System → Configuration → Certificates → Trusted Server CAs in the Pulse Secure SSL VPN administrative interface.
Click Import Trusted Server CA... then click the Browse button on the "Import Trusted Server CA" page.
Select the DigiCert SHA2 High Assurance Server CA file you downloaded from DigiCert (
DigiCertSHA2HighAssuranceServerCA.crt) and click Import Certificate.
After successful import of the DigiCert CA certificate, click Done.
In the left menu, navigate to Authentication → Auth. Servers.
Select LDAP Server from the Auth Server Type list, click New Server, and fill out the form:
|LDAP Server||Your API hostname (i.e.
|LDAP Server Type||Generic|
|Validate Server Certificate||Check this box|
In the "Authentication required?" section, check the Authentication required to search LDAP box and fill in the form (replacing INTEGRATION_KEY and SECRET_KEY with your application-specific keys).
In the "Finding user entries" section:
Click Save. (After you click Save you might receive a message indicating that the LDAP server is unreachable. You can disregard this message.)
To configure a user realm for the Duo LDAP server, you can do one or more of the following:
If you create a new realm as part of deploying Duo, be sure to create role mapping rules to add users to the new realm.
To add 2FA to a user realm:
On the Users realm configuration page, select the Additional authentication server check box and fill out the form:
|Username is||predefined as <USERNAME>|
|Password is||specified by user on sign-in page|
Check the End session if authentication against this server fails box.
Click Save Changes.
In the "Options for additional authentication server" section, select Allow all users.
Click Save Changes.
To finish setting up your integration, configure a sign-in policy for secondary authentication. In this example we'll use the default
*/ URL policy, but you can set up a new sign-in policy at a custom URL (like
*/Duo-testing/) for testing.
Choose the user realm you configured earlier, and click Add to move it to the Selected realms box on the right. Make sure this is the only selected realm for this sign-in page.
Click Save Changes.
To test your Juniper two-factor authentication setup, go to the URL that you defined for your sign-in policy. After you complete primary authentication, the Duo enrollment/login prompt appears.
If you're using the Pulse VPN client, you’ll see a “Secondary Password” field when using the Juniper Pulse or Pulse Connect client.
Enter a Duo factor option as the second password. Choose from:
Perform Duo Push authentication
You can use Duo Push if you've installed and activated Duo Mobile on your device.
|phone||Perform phone callback authentication.|
Send a new batch of SMS passcodes.
Your authentication attempt will be denied. You can then authenticate with one of the newly-delivered passcodes.
|A numeric passcode||Log in using a passcode, either generated with Duo Mobile, sent via SMS, generated by your hardware token, or provided by an administrator. Examples: "123456" or "2345678"|
If you plan to permit use of WebAuthn authentication methods (security keys, U2F tokens, or Touch ID), Duo recommends configuring allowed hostnames for this application and any others that show the inline Duo Prompt before onboarding your end-users.
Need some help? Take a look at the Juniper Frequently Asked Questions (FAQ) page or try searching our Juniper Knowledge Base articles or Community discussions. For further assistance, contact Support.