Critical problem with SSL VPN cluster with users switching between SA devices

[GiantYank_]

Juniper believes that this is a configuration issue. We have the user IP pools separated via the Network Connect Connection Profiles for each device in the cluster. However, they say that because it is a cluster one device can and does use the user pool from the other device unless we set up Network Connect IP Address filters per device. That way the only IP Pool used for the member of the cluster will be what you set in the filter.

Implementation Steps:

To add filters, perform the following steps on the primary cluster member:

1) Login
2) Click "Network" in left-navigation pane
3) Click "Network Connect" tab
4) Pick a cluster member from the drop-down "Settings for:" and click update.
5) Set the filter you would like to apply for this particular cluster member.

We just implemented this and will check going forward if it has the desired affect.

[GiantYank_]

My last post did not take... Trying again...

Juniper says that we have to set Network Connect IP Address filters per device.

Currently the cluster is set with each device having its own Network Connect Connection Profile and separate users pools are assigned to each device via the NC Connection Profile. Juniper says that because this is a cluster, one member can and does grab IP pools from another member and that is what is causing the changing of IP address and "moving" of users from one box to another.

Implementation Steps:

To add filters, perform the following steps on the primary cluster member:

1) Login
2) Click "Network" in left-navigation pane
3) Click "Network Connect" tab
4) Pick a cluster member from the drop-down "Settings for:" and click update.
5) Set the filter below you would like to apply for this particular cluster member.

We just implemented this and will monitor.