I doubt if thats possible. The URL parameter only can hold only one value into it as in one URL. ... View more

Please check KB9245 Hope this helps. ... View more

When you say "during a reserved time grant access to additional resources" does this mean 1) User is already logged into IVE and will get more resources during the reserved time? 2) Or is it grant access to the IVE login itself? ... View more

1) Does this mean that other computers on the same network connecting to the SSL-VPN device do not face this issues? 2) When you say disconnect is it SSL-VPN user session / network connect / SAM session? 3) Do you get any pop-up warning before / after the disconnect? ... View more

You wont exactly get a pop-up window rather you should get a web page which lets you enter username/password. This is called the IVE intermediation page, if the https server is requesting for authentication, the IVE should send you the intermediation page. Ensure that you have ACL's configured on the IVE for the backend web server. ... View more

riccobene: You can try the following: 1) Take backup of system.cfg, user.cfg and ivs.cfg from the active node which is still functioning. 2) Delete cluster on the active node. 3) Goto the license page on the active node and ensure that licenses for the defective device no longer exists. 4) Re create the cluster on the active node. 5) Now join the new device back into cluster. 6) Ensure that cluster license / versions and configs are synched once the devices form the cluster. < please mark this post as 'accepted solution' if this answers your question that way it might help others as well, a kudo would be a bonus J thanks > ... View more

You may not be able to insert the SA6000 drive into a SA6500 device or vice versa, as the Form factor of an SA6000 HDD is different from that of a SA6500. < please mark this post as 'accepted solution' if this answers your question that way it might help others as well, a kudo would be a bonus J thanks > ... View more

SA by design does reverse proxy. For your requirement you can use the 'Authorization only access' type. For 'authorization server' select a Netegrity Siteminder server instance which is to be created on the SA device. In case you dont have a siteminder server you can chose the 'authorization server' as [No Authorization]. Ref to "Defining authorization-only access policies" section under Admin guide for more detailed info. < please mark this post as 'accepted solution' if this answers your question that way it might help others as well, a kudo would be a bonus J thanks > ... View more

Hi Mazhar, I dont think you need any extra configs on the SA4500 to handle a failover situation on the J-series routers. As long as the the user requests can hit the SA device it will continue to function seemlessly without having any info about the upstream routers. You may need to post this query in the router forums to confirm if you need any extra configs on the router for the failover to occur between them. ... View more

Also have a look at KB15686. You may want to isolate any DNS related problems for this user when accessing the specific application. ... View more

Yes, you will need to use IVS for this requirement. Role based source-ip address will not help as authentication occurs first and then role-mapping. ... View more

6.4 still has no support for WSAM on 64-bit computers. 6.5 is qualified for WSAM on 64-bit computers. ... View more

Dave, Heres how SA device will differentiate client requests. ADUserA ADUserB Realm1 - for employees Realm2 - for survey only Role1 - Contains bookmarks and other access components. Role2 - No bookmarks will only redirect automatically to a custom start page. Employees will normally use Realm1 and will get mapped to Role1 for their day to day operations. When a survey email is received and when employees click on the link to survey, they will be hitting Realm2 and will get mapped to Role2. This can be the only way to differentiate a normal employee access and a survey driven access. Note: If a user tries to access a survey link from the internet without clicking on the survey email, they will still be able to connect as long as they can authenticate to the AD server. Let me know if this makes clear to your current deployment requirement. ... View more

Hi, When you say 64-bit activex version, are you looking for any specific SA component? Please check if you can find your answer in the latest supported platforms document: http://www.juniper.net/techpubs/software/ive/releasenotes/SA-SupportedPlatforms-65.pdf ... View more

@irfanhussain wrote: I have configured SSL VPN ( SA4500 ) users are connecting from External interface and accessing web access and Telnet session successfully. Now i want to allow my users to get the WIFI connected when they will get the secure vpn. ? Is there any way to allow WIFI facilities to remote users. ? I have aruba controller inside my Network. and its configured seccussfully. thanks Irfan, Could you explain more in detail on what you are trying to achieve when you say "Now i want to allow my users to get the WIFI connected when they will get the secure vpn. ? Is there any way to allow WIFI facilities to remote users." This will help forum answer to your deployment requirements. ... View more

Dave, "We have a customer survey link that we send out via e-mail... the survey page is just a page on the same server as our Intranet and we would like for the user to be able to click the link, get prompted for the SSL-VPN login" The above statement tells that the email will contain a link, when accessed this link they get prompted for login. If they login at this stage then my previous comment is valid. ... View more

Hi Suro, It would be better to track this problem via a JTAC case. Since you say you have used session recording and still could not find why SSO does not work, JTAC would be the better approach at this stage. Challenge is to confirm what SSO mechanism applies to this resoruce (Basicauth, NTLM, kerberos, POST). ... View more

Hi Dave, "but when the user logs in he still just get the menu and isn't being redirected." When you say the above I think you are referring to the bookmarks page that comes up right after you sign-in to SSL-VPN page. Correct me if that is not the case. What you could do is, create a seperate role for the survey activities. On this new role goto general -> UI options. On this page see the 'start page', here select "custom page" as the option and you can add your survey URL here. This way when a user from the outside clicks on the survey link, he will authenticate to SSL- VPN get assigned to this role and automatically get redirected to the survey URL that you way. This will avoid users seeing the bookmark page. < please mark this post as 'accepted solution' if this answers your question that way it might help other as well, thanks > ... View more

Hi, What IVE OS version are you running? Is this something that you observed only after updating the IE patches or was there any change at all on the SA device. If its an issue triggered by a IE update its easier to track by removing the update and see if the problem still exist. If you dont see the problem then its likely that the new IE update is causing the problem. You can then follow this up with JTAC. ... View more

Along with a split tunneling poilcy you will also need to have a network connect ACL. So when your adding a subnet under the split tunneling policy ensure that you have a correspoding network connect ACL for this subnet. It looks like there is an issue when modifying your clients route table which could be one of the reason why you are seeing the 23712 error. Ensure that there are no conflicting routes already on the client and if the subnet is not already part of the clients local network. ... View more

Under role -> SAM -> options check if "Automatic Host Mapping" is enabled. Use automatic host mapping to automatically map application servers to the user's workstation for secure port forwarding. This requires editing the local hosts file, which generally requires that the user have administrative privileges on their workstation. If you do not enable this, you will need to add the appropriate entries to your external DNS. This needs to be enabled if the clients host file is to be modified. < please mark this post as 'accepted solution' if this answers your question that way it might help other as well, thanks > ... View more