How to disable automatic upgrade for Network Connect?

[ColonelSarge]

We have a PSA 3000 (8.2R1 build 41241) that we will use to replace an old SA 2000 appliance. Our users have Network Connect 7.1.13 for connecting to the SA 2000. When we use the NC 7.1.13 client to connect to the PSA 3000, Network Connect automatically installs Pulse Network Connect 8.2, and then users cannot connect, because the client gives the following error:

"Cannot start the Network Connect service. Please re-install Network Connect. (nc.windows.app.23787)."

The Pulse Secure Network Connect Service can start, but it stops immediately. Re-installing Network Connect 7.1.13 causes another automatic upgrade. Re-installing Pulse Secure Network Connect does not fix the error. I found one KB article about this (https://forums.pulsesecure.net/topic/pulse-connect-secure/89002-ncwindowsapp23787), but we do not redirect any folders in the Public profile, so this does not apply to us.

Can we disable the automatic upgrade of the Network Connect client? The setting "Enable web installation and automatic upgrade of Pulse Secure clients" is unchecked in Maintenance > System > Options, but Network Connect still automatically upgrades itself.

We will install the Pulse Secure 5.2 client for our users in the near future, but until then we want them to be able to use the existing Network Connect client.

Thank you.

[zanyterp]

Network Connect cannot be on a different version from the server; it must upgrade in order to be used with a newer version
The Pulse Secure client is the only option if you need client & server version disparity

[ColonelSarge]

Do you have a KB link that verifies this?

Multiple representatives from Pulse Secure told me that the PSA 3000 is backwards-compatible with previous versions of Network Connect. Before I purchased the PSA 3000, I set up a demo VM appliance for testing, and I was able to connect the 7.1 NC client to the demo PSA 3000, as long as the automatic install was unchecked.

[zanyterp]

I am sorry to hear that you were given misinformation about the Network Connect client; I am not sure how you saw the behavior you experienced as it is not expected. The only client that can be independent of the server is the Pulse Secure desktop client; all other clients (Network Connect, WSAM, Host Checker, Terminal Services, etc) are upgraded/downgraded to match the server version.

There is no KB stating that Network Connect upgrades when the server is upgraded; however, it is noted in the admin guide:
If the client machine has an earlier version of VPN tunneling software, upgrade the shared VPN tunneling components to the newer version and install the most current UI version.

[marc]

My experience matches with what Zanyterp stated. The PCS appliance will always push down the Net Connect client that corresponds to the version of the PCS appliance OS. Are you sure it wasn't the auto update of the Pulse desktop client that you disabled in your demo? That can be contolled under Maintenance > System > Options.

To resolve your issue, I'd suggest a full manual uninstall of all Juniper / Pulse components on the affected computers. You can reference the client side changes guide for your version of NetConnect for this. Then reboot and try another login.

Also be aware that if you are using any elevation management tools like AppSense or PowerBroker you may need to adjust your rules for the VPN software components. I believe the digital signatures on the clients changed from Juniper Networks Inc. to something with the name Pulse Secure in it.