Pulse Secure Client Issues and Licensing

[Mario]

Hi,

I maintain a Clustered PSA3000 environment. Lately it has been nagging about Network Connect.

So I used my Test PSA-V machine to try to make it work on that system first.

It allready has a working setup for testpurposes in which way I can connect using Google TOTP and the AD, to take over control (Terminal Services) of another pc. This all works fine.

So then I took some config of the production environment about Network Connect and enabled Pulse Secure Client in the Role Overview. I included Access Control,Split Tunnel, Connection Profiles as well off course.

Anyway. Thing gets installed on testpc and testlaptop. After installation and connectionattempts, they both have lost connection to internet... In fact even after a reboot it doesn't work. I need to deinstall the Pulse Secure Client.

Also on a sidenote. For the love of god. I don't seem to find the licensing tab in my PCS 9.0R4 testinstallation. It should be in configuration just before Pulse One. But it isn't... is this normal. Maybe I have licensing issues with this system, and it isn't a config/bug issue?

Thoughts?

[[email protected]]

Hi @Mario,

When you say the test machines (PC & Laptop) are not having Internet connection after connecting to VPN, does that mean you have tried to access some sites on the internet and noticed that it didn't work or noticed "No Internet Access" - Yellow warning exclamation sign appearing on the network icon?

(if latter is true, then probably the Internet might work (if split tunneling is enabled), it's a behavior of Windows OS when VPN connection is used).

Does the behaviour (No internet) stays true for both Wi-Fi and LAN (wired) connection? What is the Pulse Client version?

Regarding the missing licensing tab, I bet you're using the DTE (Demo & Training) flavor of our VMs. Please download and deploy the SPE (Service Provider) edition.

SPE : PSA-V

DTE : PSA-V DTE

[Mario]

I have that exclamation mark, but also and not limited to.

My browser no longer works to any website.

My nslookup in command prompt no longer work.

Even trying to ping the interface gateway does not work...

The problem is the same for wired/wireless clients.

Rebooting doesn't help.

After removing the client, everything works again.

I seem to be using a DTE version indeed. The original version was apparently a 8.2R5 DTE Edition. Which has been upgraded through time. It is only now, while searching for the vpn issues, that I found this. Can I keep using this or should I go to SPE version? And if so, do I still get 2 free users or will I need to buy a license for this testsystem?

[Mario]

I have some interesting new info.

I noticed in the Windows Event Viewer Logs that when the Client gets installed a lot of continuous message of Hyper-V of what seems to be a flapping address. This stream seems to end when removing the Client. So I think these are related...

Also, I used another laptop without Hyper-V (Build Win 1703) and thath one works. My testlaptop has build 1709. So it seems related to Hyper-V.

[Mario]

Seems like KB43614 was the important one here.

I removed this from the Network Bridge and it works now.

This does seem problematic for Uncontrolled Systems with Hyper-V. Their system becomes unusable then without intervention...

[zanyterp]

Thank you for the updates, @Mario; I am sorry to hear you have experienced connectivity failure with the upgrade. Yes, the SPE edition still provides 2 free users for testing.

[Mario]

Connectivity issues with upgrade? What do you mean?

I just told you that Pulse Secure Client does not work well with Hyper-V Switch Manager. The user needs to manually disable the JUNIPER Network Service in the Network Bridge in order to restore network connectivity otherwise there is no Internet. This is a serious issue, as it cannot be done remote. (No more Internet)