Network drive access lookups

[aweise_]

Strange problem - we have an SA4500 (6.5R5) with two roles configured. One is used for our internal company users, then other is used for a partner. Access into the VPN works great with both, except for drive mappings.

For the remote users using the "company" role, everything works great - apps, drive access, etc.

For PCs using the "partner" role, there is no problem with connectivity. However, when they map a drive (either through Windows explorer or a home-built script that uses 'net use' commands), they have problems with accessing all of the folders underneath the root of that drive. This share is actually a DFS share, so all it's doing is referring them to clusters where the actual data is stored.

After doing a Wireshark capture, I found that some SMB and NBNS lookups are actually being sent out the physical adapter of the PC and not the Network Connect adapter. I think this is the reason why they can't access the shares referred to them by the DFS, but how can I tell the client to use the NC adapter so that I can eliminate that as the problem??

I have some split tunneling set up, but all that is doing is sending traffic for two specific subnets (neither of which contain the cluster hosts or the WINS/DNS servers) out the physical adapter. In fact, the capture shows me that the SMB and NBNS lookups are being sent to the physical adapter's broadcast address. ?????

I'm a network guy (routers, switches, firewalls) with minimal knowledge of netbios, DFS, etc, so I don't know...is that supposed to happen? Why wouldn't these lookups be sent out the Network Connect adapter like all other traffic destined for the internal company network? The client PCs are NOT in the same Active Directory domain as our company servers, but does that even matter in this case?

TIA

[SonicBoom_]

two things to check for, make sure the clients dont have the same ip scheme as your network, ( this happened to one of our vendors, when they connected to our vpn, they lost access to their files and directories)

two, for the partner user role, make sure you added Netbios file browsing which allows drives to be mapped.

EDIT: sorry just noticed your using NC, and my second option is for WSAM

[aweise_]

We're using a 10-dot address scheme for the VPN addresses. So far, none of the clients that have tested this remotely have been able to get the file browsing to work and they all have different IP address schemes - they can actually be coming from anywhere on the internet, as opposed to an additional site-to-site VPN.

I've looked into WSAM a little bit, but since that requires a client (like Network Connect), I'm a little sketchy on using it - we already have enough logistical issues getting NC installed on the remote clients.

[SonicBoom_]

we actually started with NC and had too many issues and switched to WSAM.
have you setup the drive under resource profiles/files then set a role to assign the drive to a certain groups start page?

[aweise_]

No, we're doing everything manually. All we've set up on the remote clients is the Host Checker and Network Connect installers. The IVE is providing no more than layer 3 connectivity. We're manually mapping the drives through Tools...Map Network Drive or using a home-grown script with net use commands.

[sugeeb]

Hi Guys,
Is there any workaround found for this issue? I am running 9.1.3 Pulse secure client version and facing very similar issue which you were facing in 2011.
Unfortunately, I am a system engineer and having control of Pulse secure VPN client only and my parent company managing the Pulse secure server.
This issue is not a permanent and its intermittent which is a real pain. Your advice is much appreciated to over come this issue.

Your advise is much appreciated. 

Regards,
Sugee