--- title: Juniper description: Configure OpenLM Broker in OpenLM Version 26 to read the remote-access VPN licenses and VPN users of a Juniper device over SSH, and approve it in EasyAdmin. product: OpenLM Version 26 (legacy) --- > **OpenLM Version 26 (legacy).** This page documents the legacy product, not OpenLM Platform. Follow these steps to monitor the remote-access VPN licenses of a Juniper device with OpenLM. OpenLM Broker connects to the device over SSH, runs 2 Junos OS commands there, and reports to OpenLM SLM the licenses installed on the device and the VPN users who are connected to it. Each VPN connection of a user counts as 1 license in use of the feature `remote-access-ipsec-vpn-client`, unless you name another feature in Broker. ## Requirements Before starting, make sure you have: - OpenLM SLM installed on a machine in your organization, or a [Software License Management Cloud (SLMC)](https://www.openlm.com/documentation/legacy/slmc/index) account. - OpenLM Broker v22.2.7.1557 or higher, installed on a Windows or Linux machine that reaches the Juniper device over SSH, and reporting to OpenLM SLM. Broker runs the SSH client on that machine, not on the device. Broker v21.11.18.730 added **Juniper**, and v22.2.7.1557 added the settings on the **Advanced** tab that these steps use. - On a Windows Broker machine, `plink.exe`, the command-line SSH client of PuTTY. Download it alone, or with the PuTTY installer, from the [PuTTY download page](https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html). - On a Linux Broker machine, `ssh` and `sshpass`. Install `sshpass` with the package manager of your distribution, for example `sudo apt-get install sshpass`. - An account on the Juniper device for Broker, with the `view` permission. [Prepare the Juniper device](#prepare-the-juniper-device) creates one. - The host name or IP address of the Juniper device. ## Monitoring capabilities The current monitoring capabilities for Juniper through OpenLM Broker are: | LM Type in the Broker | Commands | Logs | Quantity | Expiration date | Denied | Borrowing | Allocations | Report resolution | | --- | --- | --- | --- | --- | --- | --- | --- | --- | | Juniper | Yes | No | Yes | No | No | No | No | 55 seconds | For each feature and each connected VPN user, Broker reports: - **Feature name**: each feature in the `License usage` table of `show system license`, for example `remote-access-ipsec-vpn-client` or `dynamic-vpn`. - **Total**: the `Licenses installed` count of the feature. When the VPN feature has more connections than licenses, Broker raises its total to the number in use. - **In use**: for the VPN feature, the number of connections in the `show security ike active-peer` output that have a username. Broker does not read the `Licenses used` column, so it reports every other feature with 0 in use. - **Username**: the `AAA username` of the connection. - **Workstation**: the `Remote Address` of the connection, which is the IP address that the user connects from. The output holds no computer names. - **Start time**: none. The output holds no connection times. - **License type**: Broker reports every feature as **Floating**. - **Vendor**: `Juniper`, unless you add a vendor on the **Vendors** tab. Broker then reports the first vendor on that tab. Expiration dates, denied connections, borrowed licenses, and license allocations are not available. [Known limitations](#known-limitations) lists the features that Broker skips. ## How OpenLM interfaces with Juniper *How OpenLM collects Juniper license usage* Broker runs on a Windows or Linux machine and sends the license data to OpenLM SLM. Its **Data Inquiry** command connects to the Juniper device over SSH and runs 2 Junos OS commands: `show system license`, which lists the licenses on the device, and `show security ike active-peer`, which lists the users who are connected to its IPsec VPN. - **Commands:** The license manager has 1 command, **Data Inquiry**, which runs every 55 seconds by default. Broker uses the command for the operating system of its machine. On Windows, the command runs `plink`: ```text plink -hostkey {$hostkey} -ssh -pw {$password} -batch {$user}@ "show system license;show security ike active-peer" ``` On Linux, the command runs `ssh` through `sshpass`: ```text sshpass -p {$password} ssh -o StrictHostKeyChecking=no {$user}@ show system license;show security ike active-peer ``` When you add the license manager, Broker puts the **Host** of the **License Managers** page in place of ``. Broker does not fill in `{$user}`, `{$password}`, or `{$hostkey}`. You replace them, and the host, with the values of your device in [OpenLM Broker configuration](#openlm-broker-configuration). - **Output:** The output holds the license table of `show system license`, the installed license keys, and then 1 row for each connection, as in this example: ```text License usage: Licenses Licenses Licenses Expiry Feature name used installed needed dynamic-vpn 0 2 0 permanent remote-access-ipsec-vpn-client 0 10 0 permanent Licenses installed: License identifier: JUNOS000000001 License version: 4 Valid for device: AB0000AA0000 Features: remote-access-ipsec-vpn-client-10 - remote-access-ipsec-vpn-client 10 users permanent Remote Address Port Peer IKE-ID AAA username Assigned IP 198.51.100.7 500 198.51.100.7 not available 0.0.0.0 203.0.113.10 51034 vpn.example.com jdoe 172.16.0.11 203.0.113.25 49812 vpn.example.com asmith 172.16.0.12 ``` From this output, Broker reports `remote-access-ipsec-vpn-client` with a total of 10 and 2 licenses in use, held by `jdoe` and `asmith`, and `dynamic-vpn` with a total of 2 and none in use. It skips the connection from `198.51.100.7`, a site-to-site VPN peer that has no username (`not available`). - **Sessions:** Each data inquiry reports every connection that it lists, and OpenLM SLM turns the consecutive reports into sessions. Broker groups the connections by username and remote address. 2 connections of one user from one address count as 1 session that holds 2 licenses, and connections of one user from 2 addresses count as 2 sessions. - **Server status:** Broker reports the license server as up whenever it reads the output, even when the output lists no feature. - **Log files:** None. Broker reads no log file for Juniper. ## Prepare the Juniper device Broker signs in to the device with an account of its own. Both commands need only the `view` permission, which the predefined `read-only` login class gives, so create the account in that class. 1. On the Juniper device, enter configuration mode and create the account, for example `openlm-broker`, in the `read-only` class: ```text set system login user openlm-broker class read-only ``` 2. Set the password of the account: ```text set system login user openlm-broker authentication plain-text-password ``` Junos OS asks for the password twice. 3. Commit the configuration: ```text commit ``` For the login classes and their permissions, see [Login Classes Overview](https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/junos-os-login-class-overview.html) in the Junos OS documentation. ## Check the connection from the Broker machine Broker sees only what the SSH client prints, so run the command by hand on the Broker machine first. On Windows, this check also gives you the host key of the device, which the Windows command needs. ### On Windows 1. Open a command prompt on the Broker machine. 2. Run `plink` without `-hostkey`, with the password of the account and the address of the device: ```batch "C:\Program Files\PuTTY\plink.exe" -ssh -pw -batch openlm-broker@juniper01.example.com "show system license;show security ike active-peer" ``` Use the path of your `plink.exe`. Plink does not know the host key of the device yet, so it shows the key fingerprint and abandons the connection. 3. Copy the fingerprint from the line after `key fingerprint is:`, the part that starts with `SHA256:`. 4. Run the command again with `-hostkey` and the fingerprint: ```batch "C:\Program Files\PuTTY\plink.exe" -hostkey SHA256: -ssh -pw -batch openlm-broker@juniper01.example.com "show system license;show security ike active-peer" ``` 5. Confirm that the output shows the `License usage` table and a row for each connected user, as in the example in [How OpenLM interfaces with Juniper](#how-openlm-interfaces-with-juniper). ### On Linux 1. On the Broker machine, connect to the device as `root`, the account that runs the Broker service by default: ```bash sudo ssh openlm-broker@juniper01.example.com "show system license;show security ike active-peer" ``` Keep the quotes in a terminal. Without them, the shell runs `show security ike active-peer` on the Broker machine. 2. When `ssh` shows the key fingerprint of the device and asks whether to continue, enter `yes`. `ssh` saves the key in the known hosts of `root`, and checks it on every later connection. 3. Enter the password of the account. 4. Confirm that the output shows the `License usage` table and a row for each connected user. ## OpenLM Broker configuration :::note Install OpenLM Broker on the Broker machine and confirm that it reports to OpenLM SLM before starting these steps. ::: 1. Open a browser on the Broker machine and go to the [Broker web UI](https://www.openlm.com/documentation/legacy/openlm-broker/openlm-broker-webui) at [http://localhost:5090/](http://localhost:5090/). 2. On the **License Managers** page, check **Host**. OpenLM lists the license server under this host name, and the field holds the host for every license manager on the page, not for Juniper alone. Broker also writes it into the Juniper command as the address to connect to, which you replace in a later step. 3. Go to **License Managers** → **Add License Manager**. 4. From **LM Type**, select **Juniper**. 5. In **Port**, enter `22`, and select **Add**. Broker does not pass this port to the SSH client, and OpenLM identifies the license server by the host name and the port together. If another license manager on this Broker uses 22, Broker shows `Port already exists`. Enter any free number instead. *Add Juniper as a license manager* 6. On the **Commands** tab, select **Data Inquiry** under **Periodic commands**. Broker filled in the command for the operating system of its machine, with the **Host** of the **License Managers** page after the `@`. It runs the command every 55 seconds (**Watch interval (sec)**), and stops a run that takes longer than 60 seconds (**Timeout (sec)**). Leave **Use the operating system start/stop commands** off. *The Data Inquiry command as Broker fills it in* 7. Replace the placeholders and the host in the command with the values of your device. On Windows, replace `{$hostkey}` with the fingerprint from [Check the connection from the Broker machine](#check-the-connection-from-the-broker-machine), `{$password}` with the password of the account, `{$user}` with the account name, and the host after the `@` with the address of the device. Unless the folder of `plink.exe` is on the system PATH, replace `plink` with its full path in quotes: ```text "C:\Program Files\PuTTY\plink.exe" -hostkey SHA256: -ssh -pw -batch openlm-broker@juniper01.example.com "show system license;show security ike active-peer" ``` On Linux, replace `{$password}`, `{$user}`, and the host. Once `root` has the host key of the device, remove `-o StrictHostKeyChecking=no`, so that `ssh` refuses a device whose key changed. Leave the 2 Junos commands without quotes: Broker runs the command without a shell, and the command fails with them. ```text sshpass -p ssh openlm-broker@juniper01.example.com show system license;show security ike active-peer ``` :::danger[Broker sends the command to OpenLM SLM] Broker keeps the command, with the password in it, in plain text in its configuration, and sends it with every data report to OpenLM SLM. To keep the password out of the command, follow [Keep the password out of the command](#keep-the-password-out-of-the-command). ::: 8. On the **Advanced** tab, check the feature that Broker counts the connections against. The option `consumable.license` names it, `remote-access-ipsec-vpn-client` by default. If your remote-access VPN licenses show under another feature name in the `License usage` table, select the edit icon of the option, enter that name in **Value**, and select **Continue**. Broker keeps the option in `juniper@.properties` in the Broker folder, for example `juniper@22.properties`. *The feature that the connected VPN users count against* 9. Leave the **Vendors** and **Log Files** tabs as they are, and select **Save**. With no vendor on the **Vendors** tab, Broker reports the vendor as `Juniper`. ## Keep the password out of the command To keep the password out of the command that Broker stores and sends, read the password from a file, or sign in with an SSH key. Broker runs as Local System on Windows, and as `root` on Linux by default, so that account must be able to read the file or the key. - **Password file:** Save the password on the first line of a text file that the account of the Broker service can read. On Windows, replace `-pw ` with `-pwfile `, for example `-pwfile C:\ProgramData\OpenLM\juniper-pw.txt`. On Linux, replace `-p ` with `-f `, for example `-f /root/juniper-pw.txt`. - **SSH key:** Create a key pair without a passphrase, because Broker cannot type one, and add the public key to the account on the device: ```text set system login user openlm-broker authentication ssh-ed25519 "" commit ``` On Windows, create the key with PuTTYgen, which comes with PuTTY, save the private key as a `.ppk` file, and replace `-pw ` with `-i `. On Linux, create the key as `root` with `ssh-keygen`, and remove `sshpass -p ` from the command. `ssh` then signs in with the default key of `root`, such as `/root/.ssh/id_ed25519`. For the options, see [Using the command-line options](https://the.earth.li/~sgtatham/putty/latest/htmldoc/Chapter3.html) in the PuTTY documentation, and [User Accounts](https://www.juniper.net/documentation/us/en/software/junos/user-access/topics/topic-map/junos-os-user-accounts.html) in the Junos OS documentation. ## OpenLM SLM configuration ### Automatic configuration through EasyAdmin If the preceding steps are complete, Broker runs the **Data Inquiry** command and reports Juniper to OpenLM SLM. Approve the license server in EasyAdmin: 1. Open EasyAdmin (`http://:5015`) and go to **Start → Widgets → License Manager - Servers**. 2. Select the **There are N servers pending approval** link at the top of the widget. The **Administration - License Manager Servers** window opens, with the pending entries at the top of the list. 3. Find the entry whose **Host Name** and **Port** match the license manager in Broker, and select the edit icon at the end of its row. Broker reports the LM type name with the OpenLM Generic protocol, so the **Type** of the entry is **Juniper**. 4. Optionally rename the connection in **Display name**, confirm the **Host Name** and **Port**, and select **APPROVE**. ### Manual configuration through EasyAdmin If automatic configuration fails: 1. Go to **Start → Administration → License Manager Servers**. 2. Select **Add LM**. 3. In **Display name**, enter a name for the connection, for example `Juniper VPN`. 4. From **Type**, select **Juniper**. **Use Broker** turns on. 5. In the row under **Host Name**, **Port**, and **Time Zone**, enter the host name and the port of the license manager in Broker, and select a time zone. 6. Select **SAVE**. ## Verify your configuration 1. Open EasyAdmin in your browser. 2. Go to **Start → Widgets → License Manager - Servers**. 3. Confirm that the Juniper license server shows the **Status** **Up to date**. 4. Go to **Start → Widgets → Feature Usage Status** and confirm that **Used** for `remote-access-ipsec-vpn-client` matches the number of connections that have a username in the `show security ike active-peer` output. 5. Go to **Start → Reports → License Activity**, select **Include Current Activity**, and select **Apply**. Each connected user appears with the remote address in **Workstation**. ## Troubleshooting If Juniper never appears as pending in EasyAdmin, confirm that the Broker reports to OpenLM SLM: other license managers on the same Broker update in EasyAdmin. If the license server is approved but shows no features or no usage, run the command by hand, as described in [Check the connection from the Broker machine](#check-the-connection-from-the-broker-machine). Then compare the result and the Broker log with these cases: - **`Command could not be launched`**, followed by the command and the cause, in Broker v26.9.16.1403 or higher. Broker cannot start `plink` or `sshpass`, and the end of the message gives the cause. On Windows, give the full path of `plink.exe` in the command. Earlier Broker versions log `Command execution failed` with the exit value `-559038737` instead. - **`Command execution failed`**, followed by the command, its exit value, and its output. The SSH client ended with an error, and the end of the message holds what it printed. - **`Command result transformation failed`**. Broker cannot read the output, for example because a feature has a single word other than `permanent` in **Expiry**, such as `invalid` or `expired`. See [Known limitations](#known-limitations). - **`No feature to associate users too`**, followed by the configured name. The `License usage` table has no feature of that name, so Broker counts no users. Set `consumable.license` on the **Advanced** tab to the name of your VPN feature. The Broker log is in the `logs` folder of the Broker installation, and the Juniper license manager writes to `port--Juniper.log`, for example `port-22-Juniper.log`. Broker logs these messages at its default level, `ERROR`. A failed command appears in the log with the full command, password included. ## Known limitations These limits apply to Juniper monitoring: - Broker does not report expiration dates, denied connections, borrowed licenses, or license allocations. It reads only the current output of the commands, so usage in OpenLM starts when you configure the license manager. - Only the feature that `consumable.license` names gets usage. Broker reports every other feature with its total and 0 in use, whatever its `Licenses used` count. - A feature that has a date in **Expiry**, such as `2027-03-30 01:00:00 UTC`, is missing from OpenLM, and so is a feature whose name has spaces. - A feature that has a single word other than `permanent` in **Expiry**, such as `invalid` or `expired`, stops Broker from reading the output. OpenLM then receives no license data from the device while the device lists that feature. - Connections without a username, such as site-to-site VPN peers, do not count. - The workstation is the IP address that the connection comes from, not a computer name. - The output holds no connection times, and Broker reports a connection only when a data inquiry lists it. A connection that opens and closes between 2 data inquiries, 55 seconds apart by default, is not reported. - When the VPN feature has more connections than licenses, Broker raises its total to the number in use, so the total in OpenLM can be higher than the number of licenses on the device. - Each Juniper license manager reads 1 device. To monitor several devices, add a Juniper license manager for each, with its own port number and the address of that device in its command.