Pulse Connection Issue

[jspanitz_]

Strange problem most likely with an obvious answer. We have a SA rule set up for access via Pulse. When you go to the web page and click on start next to the Junos Pulse client application section, pulse launches and connects successfully. But if you completely disconnect and then try connecting by clicking COnnect on the connection in Pulse, it fails every time with "Connection Error - Authentication rejected by server (Error:1308)."

Any ideas of where to start? If we switch the same policy over to using Network Connect, it works just fine.

[srigelsford_]

Possibly you do not have all parts of pulse installed, only the minumum ones. You are probibly missing Host Checker which when you go in through the web will be performed before pulse is launched.

Try re-installing pulse on the machine from the .exe on the installers page.

Sam.

[jspanitz_]

So we uninstalled pulse and reinstalled using the full install, but are still having the same issue. Any other ideas?

[VVJ_]

Do you find anything in the SA User Access Logs for this failed connection attempt?

[jspanitz_ · Accepted solution]

I found some entries in the log and they are point us to the KB article:

https://forums.pulsesecure.net/topic/pulse-connect-secure/108916-pulse-connection-issue/highlight/fa...

Looks like host checker and pulse is the cause.

[NULL_]

Hi Jspanitz,

the solution for you is probably to limit the Supported Antivirus Solutions in the HostChecker Rule.

Have a Try and enable only 1-5 different Antivirus Vendors for Check.

If you then can connect without any problems try to evaluate which Antivirus Vendors do get used most by your Workforce/Customers/Partners. So you can enable Check only on those few really needed Antivirus Systems, and your problem should be solved.

regards

NULL

[zanyterp_]

what type of authentication are you using?

what version of pulse? SA?

[jspanitz_]

As per the KB article, limiting the number of AV vendors solved the problem.

As for the authentication type, we are using LDAP. The version of Pulse is 2.03.11013 and the MAG was 7.1R3 but is now 7.1R4.

[Toivo_]

---

@NULL wrote:

Hi Jspanitz,

the solution for you is probably to limit the Supported Antivirus Solutions in the HostChecker Rule.

Have a Try and enable only 1-5 different Antivirus Vendors for Check.

If you then can connect without any problems try to evaluate which Antivirus Vendors do get used most by your Workforce/Customers/Partners. So you can enable Check only on those few really needed Antivirus Systems, and your problem should be solved.

regards

NULL

---

Not sure why the KB article number doesn't show up above, but I'm assuming the reference was to KB21443?

Anyhow, do you know if it is necessary to have AV AND firewall selected, or will the issue appear when all AV are selected, but no firewalls?

If it affects AV checks even without the firewalls, that's yet another major problem for us...

[jspanitz_]

Yes, the KB was KB21443.

We have each host checker rule separated out, so for us it was just the AV rule. The firewall rule is separate as are a few others used to determine if the endpoint is a managed or unmanaged system.

As for the AV only check, we had ALL selected and that worked fine for Network Connect. We removed about 1/3 of them to get Pulse working. The approach we took, which was more time consuming for us but seems like a more secure solution, was to only allow the latest version and one version back of the AV solutions.

John