FYI we did open a case with JTAC. It turns out that this is known issue and was addressed under 7.2. Unfortunately the bug was not documented in the release notes. I have tested using a test 4500 and a production 6500 cluster and can confirm that the issue was resolved once we moved from 7.1R6 to 7.2R2. ... View more

Hi Ricardo, I know that this was an old post of yours, but I was curious if you ever found a resolution to this issue. I recently upgraded my IVEs from 6.5R2 to 7.1R6. I have a realm configured to allow two concurrent users sessions and I have enabled the multiple user session waring. Users with Windows 7 and IE9 or FF 12/13 are all seeing this incomplete session warning box just as you describe. (see attached screenshots) Any information that you can provide would be appreciated. ... View more

Thanks, Ken. I appreciate the information. It has been very helpful. ... View more

Hi Robert, I have a user with the exact same symptom that you reported. I cannot remove the JuniperSetupClientControl object from IE for some reason. He is getting the "JuniperSetupClientControI is currently in use..." error. I am hoping that you can expand on the solution that you posted. Specifically, what do you mean by "Exit the browser and connect to SSLVPN, then the Citrix site." ? I'm curious how Citrix factors into the equation. Any details that you can provide would be greatly appreciated. I've spent about two hours trying to get this machine working. Thanks! ... View more

We currently have compression and no-replay protection enabled in the Network Connect profile. Do you think that is the issue? ... View more

Did you ever find a solution to this issue? I'm troubleshooting a very similar issue with Outlook / Exchange over our VPN (6500 active / passive cluster). All roads keep leading me back to packet fragmentation, but the fix to configure XP's Kerbersos authentication to use TCP instead of UDP has no effect. I was stumped, but then it occurred to me that we're using ESP (UDP) as the transport mechanism for Network Connect. I'm curious if switching to SSL as the transport mode (formerly oNCP / NCP) would resolve the issue. ... View more

FYI, this one is hitting my company pretty hard. We have a tiered VPN access model and provide some VPN functionality to employees' home PCs and and to the PCs of our numberous vendors. MS released this updated version of Security Essentials as an important update and as such it automatically went out to users who have automatic updates enabled in Windows Update. ... View more

Thanks for the info. ___kevpeterson.com was a great resource. I wish I would have known about this site a year ago. Anyway, the info on his blog gave me a few different ideas on how to determining our licensing strategy. Thanks! ... View more

Hi MRK, Juniper does have virtual machines available for testing and demonstration purposes. The VM can be loaded in VMware ESXi and I would presume in VMware Workstation / Player. My company has access to the IVE VM as part of our maintenance plan for our 6500's and 4500's. I can't say for sure whether or not a non-customer would be allowed to download it. I'll grab a link to the EULA and you can have a look. http://www.juniper.net/techpubs/software/software-license.html ... View more

Vijesh, We are using a 6500 with IVE OS 6.5R2. Our corporate laptop users use the Cisco IP communicator over Net Connect. We have found that there are certain versions of the Cisco Soft Phone that perform poorly. In particular 7.0.6. seems to be a huge improvement over 7.0.3 in terms of voice quality. Our users were reporting hissing noises in addition to dropped calls. I hope this helps. ... View more

I agree completely. The Hoblink client is much better in terms of performance and features when compared with the ProperJava RDP, but it is a major let down to not be able to use it for user-created bookmarks. I've opened a case with Juniper to validate that there is no way to do this. ... View more

Here are a couple of ideas for you. First, check the date and time on the virtual machine. If he is using a non-persistent VM, it will revert to the date and time the machine was turned into a templace or when the VM "snapshot" was made. If this is the issue, you should be able to get around it by configuring the VMware tools within the VM to sync their time with the host (his Mac) - assuming that the time / date is correct on the Mac. Secondly, I'd try a non-avg product just to rule out an issue with a particular product. MS security essentials is free and a very quick install. I know it's been in at least the last three ESAP updates. Good luck. ... View more

The IVE will let you specify two auth servers. I'm 99% sure that they can both be RADIUS type servers. I set up a little test realm this way and the IVE did not complain. However, if you want to use one of the RADIUS servers for authorization in addition to authentication, it appears that you cannot specify the second RADIUS server. So if you plan on using one RADIUS server for authentication and authorization make sure it's configured as the first auth server and then choose the "Same as above" option in the "Directory/Attribute:" field. By the way, I'm using the 6.5R1 IVE OS. Good luck. ... View more

rswinter, a few years ago JTAC provided a deep clean procedure for the Juniper SSL VPN components. I reworked it a bit into a step by step process for our help desk and they've been using it with great success. The following process assumes Win 7 and a recent version of IE. Navigate to Control Panel > Programs > Programs and Features > Uninstall a Program. Remove all Juniper applications listed in this section. Close all Internet Explorer windows. Navigate to the Control Panel > Internet Options. On the General tab, under Browsing History, click the Delete button. Check ALL boxes except “Preserve Favorites website data”.  This one must be unchecked.  Click the Delete button. Click on the Programs tab and under Manage Browser add-ons, click on the Manage Browser add-ons button. On the Left side, under Show, click the down arrow and choose All add-ons. If a Juniper add-on is present, remove it by selecting it, then click on More Information and click on the Remove button.  When complete, click Close.  Click on the Advanced tab.  Click on the Reset button to reset IE to its default settings.  Close Internet Properties and the Control Panel.  Navigate to c:\Users\[username]\AppData\Roaming  (Note that the AppData folder is a hidden folder.)  Delete the Juniper Networks folder and its contents.  Delete all files and folders from %systemroot%\prefetch .  Delete all file and folders from %temp% .  Reboot the computer.  Reinstall the Juniper software / log into the VPN. For XP change step 13 to "Browse to C:\Documents and Settings\[username]\Application Data " Note that the original procedure from JTAC also included the removal of Juniper registry keys. Their location can be found in the client side changes guide: http://www.juniper.net/techpubs/software/ive/admin /j-sa-sslvpn-7.4-clientsidechanges.pdf. I've only found it necessary to delete the registry keys once in three years so I don't have it in our procedure any longer. Use this procedure with care. It resets a user's browser to the defaults which can have unintended consequences. Good luck. ... View more

Lancelot, can these users install Java? I believe if the Active X delivery method for the Juniper components is not available the Java delivery method will kick in and attempt to install them. ... View more

Jitender K, I just want to let you know that I have an ER open with Juniper to allow user defined Terminal Services bookmarks to work with Java RDP clients like Hoblink. The number is 29755. I've been asking other customers to have their company names added to the ER to get some movement going. ... View more

You are right and wrong  Under IVE 6.2 there was no correlation between the browsing toolbar and the option to allow users to create their own terminal services sessions. That changed when we upgraded to 7.1 and has remained in 7.2 and 7.3. So far I have found that any 7.x version will display the browsing toolbar if the option to allow users to add their own terminal sessions is checked. ... View more

Layzie0ne, I feel your pain. I can't say whether what you're asking for is possible, but I can say that Juniper specifically does not enable the Premier Java RDP client for use with user created RDP bookmarks. Thus, crafting a dynamic Terminal Services Bookmark URL may be challenging. Here are some suggestions and alternatives.   1. Create a role for your Mac users that enabled the Juniper Terminal Services launcher. The launcher can make use of the Premier (Hob) Java RDP client. The down side here is that you mush provide the user a way to look up their host name or IP. Also, all users are stuck with the same RDP settings unless you let the users tinker with the Hob client.   2. Store the hostname of the user's RDP destinations in LDAP/AD and use the LDAP variable in the terminal services bookmark. I haven't done this myself, but it should work with the Premier Java RDP client since the bookmark is assigned from the IVE/MAG and not user created. (Perhaps someone else in the forum can confirm if this works). Reference: http://kb.pulsesecure.net/InfoCenter/index?page=conten t&id=KB22556&actp=search&viewlocale=en_US&searchid ... You can also reference pages 1139 through 1141 in the Pulse SA 7.3 admin guide.   3. You could have an external webserver craft a URL that calls the Hob Java RDP applet directly. Again, I haven't done this myself, but it might be possible. This options would require some development work on your end though. The web server would have to maintain a database of the various users' RDP assignments and craft the URL based on that data. See the " Creating HTML Pages That Reference Uploaded Java Applets" section on page 434 of the Pulse SA 7.3 admin guide. (Although the Hob RDP applet is not actually uploaded by you, it is located in the uploaded java applets section of the SA and should be accessible via this method).   I hope one of these ideas is helpful to you. Let us know what you end up doing. I've just recently rolled out support for Macs on my organization's VPN and we opted for the Terminal Services launcher for our initial configuration. ... View more

Events are logged locally and can be sent to one or many syslog servers. Navigate to  System > Log/Monitoring > (Events or User Access or Admin Access) > Settings to configure your syslog servers and what you want to log. I'm going to make the assumption that you're referring to VPN tunneling clients like Network Connect and Pulse when you say "policy permits and allows". I've troubleshot ACLs on cisco gear in the past and I don't think that you're going to find analogous packet drop list on the IVE or MAGs. If you're allowing or blocking network ports and subnets that a user can reach with the VPN tunneling cliends based on Host Checker policies, I'd suggest using the User  Access logs to see what roles and thus what policies are being assigned to a user once they're logged in. If your configuration is such that you have many VPN tunneling access policies assigned to a small number of roles, it may be easier to collect a policy trace for a user's session instead. Does this help? ... View more

I just got off the phone with JTAC on this issue. They have confirmed that the "unsafe mode" work around is still necessary. The engineer was not able to confirm when this issue will be resolved. ... View more

I guess I don't understand where the web server comes into play. You can configure the IVE Network Connect settings to allow the user's local network routes to take precedence over the tunnel routes, which will allow them to reach local network resources like printers. This assumes that the print server is also local to the user or that the user is printing directly to the local printer. This configuration works well as long as you do not have duplicate subnets on either side of the VPN. In your scenario it sounds like you want a user to initiate a print job on a remote web server and have that web server send the print job to a printer that is local to the user. Is that correct? This sounds like unnecessary complication to me, but I'm sure you have some kind of business requirement that you're trying to meet. ... View more

Thanks for confirming! ... View more

netdefilr, can you explain where the printer and print server are in your scenario? I'm not understanding what you're trying to do. Thanks. ... View more

I would also like an answer to this question. In addition, I'd like to know whether this applied to virus defs revision minimums based on number of days, revision count or both. Thanks! ... View more

Michael, unless Juniper has had a recent change in heart I do not believe that an SSL Virtual Appliance can act as a license server. However, multiple types of MAGs, SAs, ICs and the VA-SPE can be license clients. If I recall correctly, the LICENSE-MBR licenses are only needed if you wish to surrender existing client licenses up to your license server so that they can be shared. Check out the license management guide here: http://www.juniper.net/techpubs/software/ive/guide s/j-sa-sslvpn-7.4-licensemgmt.pdf Also, I'm attaching a screenshot of the various client options that I see on my license server. I hope this helps. Attachments: JuniperLS.JPG ‏34 KB ... View more

aeroplane, there are a number of ways to allow remote desktop through the SSL VPN. If you are allowing it through VPN Tunneling (TCP port 3389) then you lose the ability to lock it down RDP features through the SA / MAG. You would have to manage it through group policy. However you can control the RDP destinations that users are allowed to connect to through VPN Tunneling Access Control policies. To control RDP features like file copies and drive mappings you can instead have your users use the Juniper Terminal Services Client. To do this, set up a role or a resource profile that allows Terminal Services access. You can then set up Terminal Services options and access lists to restrict the features and RDP destinations that you don't want your users to have access to. ... View more