Kita, has anyone come up with a set of custom process and file rules as a temporary work around? ... View more

Flip_pipe's method is a good one. If you want to manage the users yourself, I'd go with his approach. It's fast and clean.   If you want another person in your company to be able to manage who has remote access without giving him or her access to the IVE console you may want to do the following.   1. Create an AD group for users who can have remote access: "VPNusers" 2. Add only the users who are allowed to use the VPN to that AD group. 3. Change the role mappings on your default role to an AD group membership for the "VPNusers" group. 4. Use the role merging option on the Realm   This method is a bit more granular and would potentially allow you to selectively block or allow VPN Tunneling, OWA, Terminal Services and any other remote access methods you're using. ... View more

Just got another report of this. This one for Kaspersky Internet Security 13.0.1.4190. ... View more

Dcvers, your solution worked! Thank you.   There was a caveat though, which is why it took so long to confirm.   We found that the filter didn't actually take affect until it was disabled once and then re-enabled in the GUI. JTAC is investigating this quirk right now.   For anyone else out there that implements this fix be aware that JTAC recommended to modify the default filter URL to be more specific to our URL as opposed to the *.* that it contains. ... View more

This looks very promising.   Thanks, dcvers. I'll give this a shot. ... View more

Hmm. HC for Mac is limited to port, process, and file checks and predefined AV, FW and antispyware so I suspect that directly checking for Domain membership on a Mac will be challenging.   As an alternative, you could use client side certificates. You can generate client side certs using an internal MS certificate server on your domain and then reqire that the Mac have the Cert installed locally for access to the realm or to particular roles.     ... View more

Andy, we've set up Citrix access through the SA in a couple different scenarios. I think this may be helpful.   Scenario One: Corporate PC needs to connect to Xen Desktop resources. In this scenario, we validate that the user has a corp PC and auto launch Network Connect. We apply a VPN tunneling policy that allows the Citrix traffic to pass through Network Connect. Once the user is logged into the VPN, they simply open their locally installed Citrix client or log into the Citrix Web Interface server and connect to their CItrix resources just as if they were in the office.   Scenario Two: Non corporate PC needs to connect to Xen Desktop resources. In this scenario we do not allow the PC to use Network Connect or Pulse. Instead we have a Web Application Resource Profile that points users to our internal Citrix Web Interface page. The page appears as a bookmark on the VPN welcome page. The resource profile is configured to use "Non-Java ICA client with Web Interface (NFuse)" and the ICA client access is set for "ICA client connects over CTS client".   In scenario two, we had to create a separate NFuse page for our non-corporate PCs so that it could be configured not to automatically push down the Citrix client to the endpoint. We also had to configure the MIME type settings in IIS on the Citrix server so that the Juniper CTS client would recognize and intercept the CItrix traffic betweent the endpoint and the back end Citrix infrastructure.   Let me know if you have questions    ... View more

That's a good question. I would assume that JCARE customrer support could put you in touch with your regional Juniper rep.   Perhaps one of the forum moderators can confirm? ... View more

FYI, my local rep just got back to me with the Enhancement Request number for NLA in RDP. It is ER37466. Anyone else who would like this feature added can contact their local Juniper rep and have their company name added to the ER I believe. ... View more

Thanks, OCDune.   I'm experimenting with that option. ... View more

Steve, thanks for your input!  We do use the Hob client, but we limit it to Mac's who obviously cannot use the Juniper Win32 RDP client. In general it perfoms very well, but even if it supported NLA it would not be a good replacement due to a few key differences. 1. It does not work with user defined Juniper RDP bookmarks ( this is huge for us ). 2. Licenses for Hob are expensive and they cannot be clustered or shared on a license server - every MAG / SA must have its own concurrent licenses. 3. Most settings for the Hob Applet are defined in the HTML for the app and thus must be shared across all users. I was never able to give my users the ability to define their own screen resolution, color depth, etc. 4. Java is required. Today, our Windows users only have to install Java if they require FireFox with the our VPN. I'd hate to change that.   I admit that I haven't gone back and revisited the third issue in a couple years. So there may be a way to accomplish individual RDP settings that I just haven't discovered. ... View more

Kita, I too would like an update on this issue.  I'd also like to point out some key pieces of information regarding this problem.   First, the fix listed in KB19222 was to select an option found only in Server 2008. Server 2012 does not have an option to "Allow connections from computers running any version of Remote Desktop".  It does have an option to turn off the requirement for Network Level Authentication and doing so does resolve the issue. (See attachment.)   Unfortunately, the requirement to use NLA in RDP is defaulted to ON in Server 2012. Turning it off is seen as reducing the security posture of the operating system by my Information Security folks and I'm sure I'm not the only admin in this situation.   One last point. It appears that this is also the default setting for the RDP service in Windows 8. If so it's likely that this issue is going to be reported more frequently. ... View more

Perfect. That's exactly what I needed. Thank you! ... View more

Thanks, Kita. Is the plugin documented anywhere? ... View more

I just finished applying 7.4r9.1 to several production servers. It looks like the 7.4r9.2 code addresses issues with NC when run in FIPS mode. http://kb.pulsesecure.net/InfoCenter/index?page=content&id=JSA10623&smlogin=true ... View more

Wavetrain, I'm not seeing any negative issues so far. I have a few different realms configured as follows.   Corp PC - Uses NetConnect, rewriter, and Juniper TS client Home PC - Uses rewriter, Juniper TS client, and Citrix with the CTX client Mac - Uses rewriter and Hob Java RDP client   All three realms use HC to various degrees. No time outs or loops so far. ... View more

Has Juniper recommended to anyone that customers replace their existing SSL certificates once they are upgraded to 7.4r9.1 and no longer vulnerable? ... View more

Wavetrain2013, I did not see any HC issues in my testing, but I will re-test to be sure.     Also, Qualys / SSL Labs has updated their free SSL test engine to check for the Heartbleed vulnerability. I was able to confirm that 7.4r7 is vulnerable and that 7.4r9.1 is not.   https://www.ssllabs.com/ssltest/   ... View more

I am running 7.4r7 in production. This version of the IVE / Pulse should be vulnerable. However when scanned with http://filippo.io/Heartbleed it's indicating that our systems are not vulnerable.   I have 7.4r9.1 running in our lab and we're planning on upgrading tonight, but I was really hoping to be able to confirm that the issue has been patched.   Does anyone have another way to test for the vulnerability? ... View more

JTAC confirmed the error, but did not have a fix. They said to keep using the workaround of putting the VPN URLs into the Java trusted sites list.   Interestingly, I have not found a way to apply this workaround on a Windows system. On OS X you just open the Java control panel, navigate to security and click the manage sites button. From there you can add the URLs for your VPN / VPNs. Just be sure to preface the URL with https. ... View more

Yeah, JTAC just told me the same thing.   Can anyone else confirm that they don't see this issue in 7.4r7? ... View more

JTAC has provided an update on this issue. They confirmed that the method to determine the OS in Windows based computers has changed from an API to a WMI query.   From JTAC: "We have recently migrated from APIs to WMIs for detecting OS Version. This is because previous API which we were using (GetVersionEx) is deprecated in windows 8.1 onwards. Hence we started using WMI queries. (GetVersionEx API which is replaced with WMI query to support windows 8.1)".   In addition JTAC referenced this KB and Hotfix from MS regarding the WMI corruption that some of our users are seeing: http://support.microsoft.com/kb/2257980   ... View more

Kita, here are the steps my workstation team follows to repair a corrupt WMI database in Windows XP:   Step 1, try to repair it: 1. Open a command prompt window 2. Enter the following command: rundll32 wbemupgd, UpgradeRepository 3. Reboot   If that doesnÕt work, step 2 is rebuild 1.Open a command prompt window 2.Enter the following command: net stop winmgmt 3.With a Windows Explorer rename the directory %windir%\System32\wbem\repository on a 32bit Windows to %windir%\System32\wbem\repository_old (or %windir%\SysWOW64\wbem\repostiory respectively). 4.Enter at the command prompt: net start winmgmt 5. Reboot   For anyone reading this, please be aware that there is some risk in running this procedure. If the WMI database is severely corrup, I'm told that attempting a repair may cause further problems in some instances. ... View more

Kita, we run a program here called BGinfo on our corporate machines. It puts system information on the desktop background of our PCs so that users can provide IP addresses, OS, hostnames and such to our HD when they open tickets. This app relies on WMI data. The users who have reported this issue have all had "WMI Failed" listed in their BGinfo information.   Rebuilding the WMI database fixes both the OS detection for Juniper and the BGinfo application. I will try to get a screenshot of the BGinfo app and get some details on the WMI rebuild process. ... View more

Thanks, Kita. I'm thinking that this is a different issue. We have two two-node active-passive clusers. I've verified this issue on both actove-passive clusters and all four nodes appear to have the same ESAP and identical rules. Thanks for the information though. ... View more

It seems unlikely that the issue was caused by a particular browser, but I suppose anything is possible. I'd be more suspicious of a plug-in installed in IE rather that the browser itself.   When I'm doing a mission critical upgrade I monitor the upgrade process through a terminal app and the console port of the IVE. It can save your bacon if something goes wrong.     ... View more