Different pulse users compete for connection on SA2500 cluster

[nurklik_]

I have a problem where Pulse users compete for access on SA2500 cluster.
Let me explain - it seem that there are some users (maybe because they more
frequent and thus stumble on this problem more often) that when they go online
then they make some other user to logout. Which in turn of course makes that logged out user
to login again which makes the previously logged in user to log out and to login again, etc.
Until one or both of the users give up.
There's nothing else in logs that indicates a problem other than this competing with
session started/ended events. No events indicating there's a problem - user experience and log
time stamps prove this happens.
Also there seem to be users that are not affected. I have tested this and also according to log
there can be multiple users simultaneously connected.
What makes this more strange is that there's no user specific role mapping on SA2500 -
users get their roles based on group memberships and as far I can say there's users that
get the same role but one of them has a competing problem and the other doesn't.
Also the realm is the same.

Can there be a licensing problem with cluster?
At the moment there's the old model in use - users on one SA and the same amount shared to other SA.
IVE version is 7.1r5.

Any info or help is appreciated.

BR,
Kalev

[firewall72_]

How many active users are on the box? What is your current license?

[thetimpearson_ · Accepted solution]

I have seen this problem before when an image was created from a machine that had connected to pulse already. Here is what worked for us

Open C:\Program Files\Common Files\Juniper Networks\ConnectionStore\constore.dat

Look at the guid value under machine "local" (it helps to view in notepad++ instead of the notepad built into windows)

If that value is the same for multiple machines the users will kick each other off.

If that is the case Just delete either the guid value or the whole machine "local" section, it will be recreated with a unique value when the user connects. You may also want to edit the constore.dat.bak file too

[zanyterp_]

are your users using the same credential? if yes, have you enabled multiple user sessions? if yes, how many users are you allowing per user? does this happen through the browser as well or just pulse?

[nurklik_]

This could be the case. I'll try this out and see if it helps. Most probably it does.

To add to the procedure for changing the guid for local machine I found out that You also have to restart the Juniper Unified Network service otherwise the new guid would not be created after deleting them from the previously metioned files.

BR,

Kalev

[zanyterp_]

Thank you for the update and testing

[nurklik_]

Hi again,

the constore.dat was the culprit - after letting client systems regenerate the local guid it seem that this problem went away.

Thanks for the tip!

BR,

Kalev