- Pulse Secure Community
- :
- About jspanitz_
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
since
10-29-2017
10-29-2017
jspanitz_
Frequent Contributor
138
Posts
0
Kudos
2
Solutions
04-04-2012
08:02:PM
Lets see if I can answer all the questions: We upgraded to ESAP 2.1.3 (which is now released) at the request of JTAC for this issue. We've tested this with Trend Micro Officescan 10.6 on WIndows 7, Avast 6 on Windows 7, various flavors of McAfee and Microsoft Security Essentials (contractors) and Trend Micro AV 1.5 for OS X 10.7. All fail the AV Check. We've tested a single AV policy (checking trend), a larger policy with lots of products and a policy with all the products in the ESAP. All failed. Trend was not upgraded at all, except for the normal signatures. We are working with JTAC, although it's taking a bit longer than we expected to resolve. Hopefully ghuber can join in on the caes and help solve the problem. I will pm tbehrens to test against his lab system too. Thanks!
... View more
04-03-2012
03:10:PM
Once I get the client on Lync by connecting it internally first, we can successfully use lync externally through the MAG. It's just the initial connection that keeps failing through the MAG.
... View more
04-03-2012
03:06:PM
We've tried a policy with just Trend and we've tried a policy with all AV both fail. We've tried logging in via web portal and via NC. We've tried this on WinXP, Win7 and OS X. Support had us upgrade ESAP to a newer, unpublished release. That was this past Saturday. We still do not have a solution, so we've had to modify our host checks in order to allow people to connect.
... View more
04-02-2012
05:45:AM
So far WIndows 7 64 bit clients running Trendmicro Officescan and Mac OS X 10.7 clients running Trendmicro as well. Other host check policies work fine, only the AV policies are having issues. We built two new AV policies, one containing everything and another only trendmicro and both still fail.
... View more
03-30-2012
09:45:PM
Upgraded MAG 4610s from 7.1r7 to 7.2r1. Since then we are having constant host checker problems. Clients are Windows 7 Sp1 64bit. The only host check policies that fail seems to be the ones dealing with AV. These policies functioned correctly right up until we upgraded. We are using ESAP 2.1.2. In the Admin UI, Active Users shows "Partially Compliant" and the logs on the appliances show "Host Checker policy 'All_Allowed_AV_Check' failed on host xxx.xxx.xxx.xxx . Reason: ''." Have uninstaller host checker and removed %username%\AppData\Roaming\Juniper Networks\Host Checker folder. The reinstall did not solve the problem. Opened a support case as well. Anyone else seeing the issue?
... View more
03-30-2012
01:57:PM
Using release 7.1R7 with SAP 7.2 C3. Basic rewriting seems to be working fine. Now we want to do SSO. Our users current log in with AD credentials. Was hoping someone had done this already (I saw references but no details) and could share the settings to make it work. Is there a KB article on this or whitepaper published by Juniper? Didn't see those either, but if they exist and you could point them out, would be much appreciated.
... View more
03-30-2012
12:44:PM
How about just a lightweight client that we could use to deploy activesync settings and point them at the web interface of the SA / MAG? I'm thinking something along the lines of the Managed Pulse platform you offer. I'll try and use my "pull" to get MS to move on this :P But seriously, I can't believe that if Juniper went to MS and said "Let's build a VPN into WP7 using our tech" that MS would turn them down. Thanks for taking the time to reply, it's good to see Juniper is listening.
... View more
03-29-2012
10:16:AM
I changed the rewriting policies to "Rewrite content (auto-detect content type)" but the results are the same.
... View more
03-28-2012
04:21:PM
You want me to remove the auth only sign policy? What type of sign in policy would we use then?
... View more
03-27-2012
12:05:PM
zanyterp - thanks for the info. i would suggest that the web gui and documentaiton be updated since the current set does not indicate that signing-in pages with virtual hostnames are only for ActiveSync. Actually, they seem to indicate the later: Required: Protocol, hostname and port of the server (example: http://www.domain.com:8080). Server paths are not supported. Either way, I hope we can get this working. Otherwise we will need to look at another reverse proxy solution. To try and answer your questions, this is being set up for lync mobile (phones) clients. The client is making the connection and gettting the 401 from the server. Strangely, we've somehow gotten 1 and only 1 client working through a mix of internal and external testing. The web resource profiles have Autopolicy enabled with no rewriting. By doing that it looks like a selective rewriting resource policy was created. The automatically created selective rewriting policies defined have an action of "Don't rewrite (with Redirect)"
... View more
03-24-2012
01:23:PM
When will pulse be available on Mac OS X? It's been asked for and talked about for over a year. It's also been alluded to that it's coming soon. Is there any roadmap as to when soon is? Having to roll out different clients for Windows and mac for VPN, UAC, etc is a major pain, as is supporting them all.
... View more
03-23-2012
07:24:AM
So we've put this request in quite a few times and haven''t heard a thing. Has there been any movement on this? If we could get a oulse client in the market place to do automatic provisioning that would be a great first step. VPN tunneling would be even better.
... View more
03-07-2012
08:01:PM
Can you elaborate any more on your configuration. Are your Mags external and internal nics both behind firewalls? What about your DNS, is your internal and external namespace the same or different? It's a shame Juniper doesn't do a better job with communicating out supported configurations for well known apps. It makes us question our move from Cisco.
... View more
03-02-2012
07:55:AM
Below are the logs from the MAG on a connection attempt from a mobile client: Info WEB20174 2012-03-02 10:37:28 - mag1-vpn-pabth - [166.147.111.131] 80eabf0()[PROXY Lync] - WebRequest completed, GET to https://lyncwebext.domain.local:4443//Autodiscover/AutodiscoverService.svc/root/user from 172.28.2.110 result=401 sent=0 received=1293 in 1 seconds Info WEB20169 2012-03-02 10:37:28 - mag1-vpn-pabth - [166.147.111.131] 80eabf0()[PROXY Lync] - WebRequest ok : Host: lyncwebext.domain.local, Request: /Autodiscover/AutodiscoverService.svc/root/user Info WEB20174 2012-03-02 10:37:27 - mag1-vpn-pabth - [166.147.111.131] 80eabf0()[PROXY Lync] - WebRequest completed, POST to https://lyncwebext.domain.local:4443//WebTicket/WebTicketService.svc/Auth from 172.28.2.110 result=200 sent=1353 received=5144 in 1 seconds Info WEB20169 2012-03-02 10:37:27 - mag1-vpn-pabth - [166.147.111.131] 80eabf0()[PROXY Lync] - WebRequest ok : Host: lyncwebext.domain.local, Request: /WebTicket/WebTicketService.svc/Auth Info WEB20174 2012-03-02 10:37:27 - mag1-vpn-pabth - [166.147.111.131] 80eabf0()[PROXY Lync] - WebRequest completed, GET to https://lyncwebext.domain.local:4443//Autodiscover/AutodiscoverService.svc/root/user from 172.28.2.110 result=401 sent=0 received=1293 in 0 seconds Info WEB20169 2012-03-02 10:37:27 - mag1-vpn-pabth - [166.147.111.131] 80eabf0()[PROXY Lync] - WebRequest ok : Host: lyncwebext.domain.local, Request: /Autodiscover/AutodiscoverService.svc/root/user Info WEB20174 2012-03-02 10:37:26 - mag1-vpn-pabth - [166.147.111.131] 80eabf0()[PROXY Lync] - WebRequest completed, POST to https://lyncwebext.domain.local:4443//WebTicket/WebTicketService.svc/Auth from 172.28.2.110 result=200 sent=1353 received=5144 in 1 seconds Info WEB20169 2012-03-02 10:37:26 - mag1-vpn-pabth - [166.147.111.131] 80eabf0()[PROXY Lync] - WebRequest ok : Host: lyncwebext.domain.local, Request: /WebTicket/WebTicketService.svc/Auth Info WEB20174 2012-03-02 10:37:25 - mag1-vpn-pabth - [166.147.111.131] 80eabf0()[PROXY Lync] - WebRequest completed, POST to https://lyncwebext.domain.local:4443//WebTicket/WebTicketService.svc/mex from 172.28.2.110 result=200 sent=348 received=18461 in 1 seconds Info WEB20169 2012-03-02 10:37:25 - mag1-vpn-pabth - [166.147.111.131] 80eabf0()[PROXY Lync] - WebRequest ok : Host: lyncwebext.domain.local, Request: /WebTicket/WebTicketService.svc/mex Info WEB20174 2012-03-02 10:37:25 - mag1-vpn-pabth - [166.147.111.131] 80eabf0()[PROXY Lync] - WebRequest completed, GET to https://lyncwebext.domain.local:4443//Autodiscover/AutodiscoverService.svc/root/user from 172.28.2.110 result=401 sent=0 received=1293 in 0 seconds Info WEB20169 2012-03-02 10:37:25 - mag1-vpn-pabth - [166.147.111.131] 80eabf0()[PROXY Lync] - WebRequest ok : Host: lyncwebext.domain.local, Request: /Autodiscover/AutodiscoverService.svc/root/user Info WEB20174 2012-03-02 10:37:24 - mag1-vpn-pabth - [166.147.111.131] 80b4938()[PROXY Lync] - WebRequest completed, GET to https://lyncdiscover.domain.local:4443//[email protected] from 172.28.2.110 result=200 sent=0 received=437 in 0 seconds Info WEB20169 2012-03-02 10:37:24 - mag1-vpn-pabth - [166.147.111.131] 80b4938()[PROXY Lync] - WebRequest ok : Host: lyncdiscover.domain.local, Request: /[email protected]
... View more
03-02-2012
07:54:AM
We are trying to set up our MAG 4610's as a reverse proxy for MS Lync 2010. We've read through quite a few of the forum threads, specifically https://forums.pulsesecure.net/topic/pulse-connect-secure/109348-configuring-ssl-vpn-as-reverse-proxy-for-lync#M12221 and are having very strange results. Our first question is, is the MAG officially supported by Juniper as a reverse proxy for Lync? We opened a support request and while they worked on the case they seemed to indicate that the MAGs can not reverse proxy from port 443 to port 4443 which is required by Lync. Our testing showed otherwise, but an official stance would be nice. Second, after setting up Lync and pointing the external urls to a VIP on the MAG, we configured the MAG as such: Signing In Policies Virtual Host Names: lyncdiscover.domain.com/ lyncwebext.domain.com/ meet.domain.com/ All are Auth Only All have a virtual host name that matches our external DNS entries: lyncdiscover.domain.com lyncwebext.domain.com meet.domain.com All have a backend URL of https:4443 https://lyncdiscover.domain.local:4443/* https://lyncwebext.domain.local:4443/* https://meet.domain.local:4443/* Authorization Server is set to No Authorization Role Option is set to a role created for Lync. ActiveSync is NOT checked User Roles Lync Proxy Role: General | Overview - Only Web is checked Web | Bookmarks - 3 bookmarks are mapped from Resource Profiles, one for each URL / Signing In Page Web | Options - Under Advanced Options | Allow browsing untrusted SSL websites is checked Resource Profiles 3 Resource Profiles, one for each bookmark / signing in page Resource Type - Custom Base URL - each set to backend URLs https://lyncdiscover.domain.local:4443 https://lyncwebext.domain.local:4443 https://meet.domain.local:4443 Autopolicies: Web Access Control - Each set to backend URLs https://lyncdiscover.domain.local:4443/* Allow https://lyncwebext.domain.local:4443/* Allow https://meet.domain.local:4443/* Allow Autopolicies: Rewriting Options All set to - No rewriting Roles All mapped to Lync Proxy Role Bookmarks All created with URL matching backend URLs https://lyncdiscover.domain.local:4443 https://lyncwebext.domain.local:4443 https://meet.domain.local:4443 Resource Policies 3 Policies, one for each Resource Profile Web ACL Detailed Rules - Allow HTTPs to backend URLs Action - Allow Resources - *:*/* DNS External DNS is pointed to firewall which NATs to DMZ and external VIPs on MAG lyncdiscover.domain.com lyncwebext.domain.com meet.domain.com Internal DNS -Split Brain External FQDNs point to DMZ and External VIPs on MAG lyncdiscover.domain.com lyncwebext.domain.com meet.domain.com Internal FQDNs point to lync server lyncdiscoverinternal.domain.local lyncwebext.domain.local meet.domain.local Now the real fun part, we have exactly one mobile device that we were able to get working. We can not duplicate it on any other devices. Can anyone see a problem with our setup and why clients would not be able to connect? Then we had a different user try to sign in on the working device and it failed. Now the working device no longer works either. Microsoft is blaming the MAGs and I'm thinking this looks more like a Lync issue. Just need to confirm our setup is supported and correct.
... View more
02-28-2012
04:39:PM
We are running 7.1R5. To be honest, I haven't tested, but the GUI seems to indicate that timeout does not work in NC or Pulse.
... View more
02-28-2012
04:38:PM
Is there a way to change the icon of the gateway as show in the URL of the browser? Typically this is known as the favicon.ico. Would be nice so when a user bookmarks the site they can distinguish it from other links.
... View more
02-28-2012
06:27:AM
So I just checked our MAGs this morning for the option and I am seeing this: Note that this only applies to expiration messages displayed by the user's browser, not by other clients (W-SAM, Network Connect). To me this looks like it will not show a message when using Network Connect (Probably Pulse too), is that correct? If so then it appears there is no indication when using Network Connect or Pulse.
... View more
02-27-2012
07:44:PM
That's great info. Thank you both very much.
... View more
02-27-2012
02:03:PM
Is there any indication to the client that their session is about to expire (Max length or idle even) when using Network Connect? What about Pulse on Windows xp / 7? We'd like to at least warn the user that there session is about to drop.
... View more
02-08-2012
06:30:PM
There have been enough requests for this you'd think Juniper would have something by now. Of course, I'd have though Pulse would run on OS X by now too, so at least Juniper is consistently behind :P
... View more
01-28-2012
08:20:AM
Tmull60, we completely agree. We use secondary sign in pages as well (saml with secureauth) and pulse support hoes from nonexistent to sometimes existent. If I go back to our Cisco asa, anyconnect is pretty much the same across platforms. And, they actually have an os x version.
... View more
01-13-2012
08:37:PM
We had EAS working with Exchange 2007 with our Mag 4610s running 7.1. We did back it off due to other issues, but we had two devices that were syncing successfully.
... View more
01-07-2012
09:15:AM
Not sure of price, but check out SecureAuth tokenless - http://www.gosecureauth.com/ We moved from RSA and really wouldn't look back.
... View more
12-02-2011
02:56:PM
Ok spuluka - now I am completely on board with you. End users are completely confused by use web for this, wsam jsam for that or how about network connect or pulse. I agree, way to many options with two much of a disparate look and feel. And being mutually exclusive in use is a real pita too. I must admit that it would be real nice if Pulse could present some type of web interface that mimics the web interface itself. I think that's what I hear you saying.
... View more
12-01-2011
08:00:PM
We're interested as well. Perhaps instead of links we could just post pics?
... View more
12-01-2011
07:57:PM
I have to agree with df on this one. If you take an iphone or ipad and connect via wifi to your corporate network, can you somehow connect to the windows file shares? I can not do it from any of our iDevices. So I'm not sure how the pulse client would do this either, since it is just providing that layer 3 bridge and nothing more. The web portal can do it specifically because it translates the windows shares into html, which requires a web browser to access. I suppose they could build some type of micro browser into Pulse - which we would love because then we might be able to use our 2 factor SecureAuth tokenless solution - but that seems unlikely.
... View more
12-01-2011
07:47:PM
So the 4611 does not have the same VPN or NAC capability? It's strictly VPN?
... View more
11-30-2011
07:58:AM
Has anyone been able to use the SA / MAG to frontend their Sharepoint 2010 servers in place of Microsoft's Forefront UAG? We are trying to setup Windows Phone 7.5 access (Sharepoint Document Library Syncing) and it looks like Microsoft goes to great lengths to tell you how you need a reverse proxy, specifically their UAG. Configure Forefront UAG for SharePoint Workspace Mobile http://technet.microsoft.com/en-us/library/ff393835.aspx Hopefully someone from Juniper has a nice whitepaper how to on this as we really do not want to deploy UAG. Thanks! John
... View more
11-30-2011
07:52:AM
Regarding the 4610 vs 4611. We just bought the 4610s a few months ago. We were told they were they way to go, as new features were released they would be brought to the mags. Now I am seeing a new model that supports app acceleration. Is there a way to upgrade a 4610 to have app acceleration? Or did we just buy last years model?
... View more
Latest Tags
No tags yet
© 2017 Pulse Secure, LLC. Use of this website assumes acceptance of our Legal Notices and Privacy Policy.
Pulse Secure has updated its Privacy Policy effective June 28, 2017.
