Hi, If you have 2 boxes in cluster, you can backup and restored the configutaion from one node itself since cluster configurations are synched. First you can backup the configuration from one node of the cluster, The cluster is disabled until all cluster members have updated their settings using the backup configuration. Then, they restart and re-enable the cluster. Please find the steps and explanation : The SA Series Appliance provides different ways to backup and restore configuration files containing user and system data. The SA Series Appliance utilities you can use to backup and restore data preserve the configuration data in two different formats: binary and XML. The method you choose to use depends on your requirements. SA Series Appliances enable you to save backups of your current system configuration and user accounts directly to the SA Series Appliance in binary format. You may then use these configurations to restore the SA Series Appliance or a cluster of SA Series Appliances to the state contained in the encrypted file. Note that these files only contain configuration informationÑthey do not include logs. You may save up to 5 system configuration backups and 5 user account backups on the SA Series Appliance. If you try to exceed this limit, the SA Series Appliance overwrites the oldest backup with the new backup. If you do not want to overwrite the oldest backup, choose another backup to delete instead, before saving the most current one. Steps tyo save system configuration: To save your current system configuration: 1. In the admin console, choose Maintenance > Archiving > Local Backups. 2. Click Save Configuration or Save User Accounts. The SA Series Appliance adds a new backup to the list, naming it with the current date and time. You may use system and user backups to update a single SA Series Appliance or a cluster. If you choose to restore an SA Series Appliance that is enabled as part of a cluster, that SA Series Appliance automatically pushes the configuration to all other cluster members. The cluster is disabled until all cluster members have updated their settings using the backup configuration. Then, they restart and re-enable the cluster. To override your configuration with settings from a backup file: 1. In the admin console, choose Maintenance > Archiving > Local Backups. 2. Select the checkbox next to the system configuration or user account backup file that you want to use to restore your system. 3. If you are restoring from a system configuration, indicate whether or not you want to use the certificate, IP address, and network settings contained in the configuration file. NOTE: If you are upgrading an entire cluster, you should use caution when including network settings. Since IP addresses and other settings may not apply to all members of the cluster, cluster members may not be able to communicate with one another if the settings are pushed out to all members. 4. Click Restore. The SA Series Appliance must restart before changes can take effect. After the SA Series Appliance restarts, you must sign back in to the SA Series Appliance in order to access the admin console. You can use Importing and Exporting options availble in SA Series Appliance to save and restore the Configuration Files: The SA Series Appliance enables you to import and export SA Series system and network settings using binary SA Series configuration files. To import a configuration file: 1. Select Maintenance > Import/Export > Import/Export > Configuration in the admin console. 2. Specify whether you want to import the SA Series Appliance certificate. The certificate is not imported unless you check the Import Device Certificate(s)? checkbox. 3. Choose one of the following import options. Import everything but the IP addressÑÑThis option excludes only the IP address from the imported configuration file. If you exclude the IP address, the serverÕs IP address does not change when you import the file. When you select this option, the SA Series Appliance also imports any SNMP settings that you have defined. In other words, choosing this option preserves the IP address, netmask, default gateway, VIPs, ARPs, and routes of the network interfaces on the target device. Import everything except network settings and licensesÑ 4. Browse to the configuration file, which is named system.cfg by default. 5. Enter the password you specified for the file. If you did not specify a password before exporting the file, then leave this field blank. 6. Click Import Config. You can also use Importing and Exporting XML Configuration Files options for backup and restore : The XML Import/Export feature enables you to make significant changes to your system configuration and provides a number of benefits, particularly when it comes to making a large number of repetitive changes, or when you want to add, update, and delete configuration data all at once. Hope the explanation steps clarifies your requirement on step by step backup and restore procedure for cluster. If you still need more information kindly open a technical case with JTAC support for more information and assistance. NOTE: Please mark this post as 'accepted solution' if this answers your question that way it might help others as well, a kudo would be a bonus thanks!! Regards, Kannan ... View more

Hi, Yes, You can use the custom expressions to match both the username and the hostchecker policy using custom expressions. Custom expressions usage is documented in UAC admin guide under host checker section, refer page#408, 432 , please aslo refer Writing Custom Expressions section under Cahpter 25 in UAC admin guide. http://www.juniper.net/techpubs/software/uac/4.1xguides/j-ic-uac-4.1-adminguide.pdf Dynamic policy evaluation should work, kindly check the interavl time configured, also ensure that you have enabled Refresh roles option under Dynamic policy evaluation. Also ensure that "Perform check every X minutes" field is enabled with appropriate time value under Authentication > Endpoint Security > Host Checker. Please refer Specifying General Host Checker Options in admin guide page 43 Please revert for any assistance. NOTE: Please mark this post as 'accepted solution' if this answers your question that way it might help others as well, a kudo would be a bonus thanks!! Regards, Kannan ... View more

Hi Ucup, I understand that you are looking for Backup and restore procedure for Active/Active Cluster Clustering backup and restore procedure is explained in detail under Chapter 30: System Archiving section of SA admin guide: Refer page#765: you can also look for: ¥ Creating Local Backups of SA Series Appliance Configuration Files on page 768 ¥ Importing and Exporting SA Series Appliance Configuration Files on page 770 Admin guide access url: http://www.juniper.net/techpubs/software/ive/admin/j-sa-sslvpn-7.1-adminguide.pdf You may use system and user backups to update a single SA Series Appliance or a cluster.If you choose to restore an SA Series Appliance that is enabled as part of a cluster, that SA Series Appliance automatically pushes the configuration to all other cluster members.The cluster is disabled until all cluster members have updated their settings using the backup configuration. Then, they restart and re-enable the cluster. You can save a backup of your current configuration or to restore your system or user account state from a backup. Hope the above explanation clarifies your query. NOTE: Please mark this post as 'accepted solution' if this answers your question that way it might help others as well, a kudo would be a bonus thanks!! ... View more

Hi, Thanks for your response. SA 700 supports only core access and network connect even with Feature license installed. Without license installed there will no features supported on this device. 1000, 3000 and RA 500 can be upgraded only till 6.0X version , the advanced fetaures available on these devices are based on licenses installed. If there is no license installed only basic features available for 2 users. Yes SA 2000,4000, 6000, x500 models and the virtual DTE: is it fully featured for up to 2 concurrent users. Hope this calrifies your question, Please revert for any calrifications. NOTE: Please mark this post as 'accepted solution' if this answers your question that way it might help others as well, a kudo would be a bonus thanks!! Regards, Kannan ... View more

Hi, SA 700 is the basis SA platofrm which requires license for advanced features, The information provided is not applicable for all platforms. SA 1000/3000/RA 500 is not supported now. The information provided is applicable for SA 2000/4000//6000 , SA 2500/4500/6500 models and as updated before this is limited to 2 users. Hope this helps, please revert for any calrifications. Regards, Kannan ... View more

Hi, Without License instaleld on SA 2000 you can test the basic functionality of SA including secure meeting for 2 users. This is possible, however if you need complete functionality testing and also securemmeting feature for maorethan 2 users you can contact Juniper Customer care for Evaluation license. NOTE: Please mark this post as 'accepted solution' if this answers your question that way it might help others as well, a kudo would be a bonus thanks!! Regards, Kannan ... View more

Hi, Does my previous update answered your query or you still need clarifications on my update? NOTE: Please mark this post as 'accepted solution' if this answers your question that way it might help others as well, a kudo would be a bonus thanks!! Regards, Kannan ... View more

Hi , I understand that you have a SA2000 running with 5.1R2 and you need the upgrade path. If you want to upgrade to major releases like 6.0 /6.1/6.2/6.3 and its corresponding maintenance release like 6.3R3, 6.2R4, 6.1R2 etc you can do a direct upgrade from 5.1R2 to the above releases. Howver if you want to upgrade the SA 2000 to SA 6.4 or later releases then you may need to first upgrade the SA to any of the 6.0 /6.1/6.2/6.3 SA versions and then try upgrading to 6.4 and above versions. The latest SA release is 7.1R5, you can upgrade the SA 2000 with 7.1R5 by follwing the below steps: 1. FIrst upgrade the SA from 5.1R2 to 6.3R4 2. Upgrade the SA now from 6.3R4 to 7.1R5 The upgrade path is available in first release notes of every major releases, refer "Upgrading to thios Release"section by accessing the beloe mentioned release notes URl: http://www.juniper.net/techpubs/software/ive/releasenotes/Juniper_Secure_Access_6.3_GA_Release_Notes.pdf http://www.juniper.net/techpubs/software/ive/releasenotes/j-sa-sslvpn-7.1R1-releasenotes.pdf NOTE: Please mark this post as 'accepted solution' if this answers your question that way it might help others as well, a kudo would be a bonus thanks!! Regards, Kannan ... View more

Hi, I belive that you are trying to access the SA access through hotsname URL ( signin URL), also understand that there is no routing issues. What is your IP address that is mapped in DNS server for SA hostname, make sure you have mapped SA's external VIP and external port for the host A record of your DNS server since you have enabled SA external and internal port. After this try pinging the SA hostname or the URL from the internet, if its still failing, please provide the traceroute information and the also provide the device information where it fails. Regards, Kannan ... View more

Hi, I understand that you are looking config steps on implementing Cisco ACS authentication for EX switches. Please post your query to Ethernet swicthing forum , please find the URL http://forums.juniper.net/t5/Ethernet-Switching/bd-p/switch Regards, Kannan ... View more

Hi, VLAN ports can be mapped to the device certificate. Once you create a VLAN port, the port will be displayed under VLAN ports option available in the Device certifcate under COnfiguration>Certficates>Device Ceryificatesof SA admin GUI. There is no Virtual port option for a VLAN port. A virtual port activates an IP alias on a physical port and shares all of the network settings (except IP address) with the internal or external port that hosts the virtual port. An IP alias is an IP address that is bound to a virtual port. To create a virtual port for a standalone IC Series device: In the admin console, select System > Network > Port Tab > Virtual Ports. The Port Tab could be for the internal or external port.To associate the virtual port with a device certificate, select System > Configuration > Certificates > Device Certificates. Hope this clarifies your query. Please revert for any calrifications. NOTE: Please mark this post as 'accepted solution' if this answers your question that way it might help others as well Regards, Kannan ... View more

Hi Chris, As per my understanding hostchecker will be supported in mobile device including IOS and android devices from pulse 3.0 version , this is not yet released. In pulse 2.0 this is not supported. Host Checker is supported only with Junos Pulse client 3.0 for mobile devices , Supported Policies are OS version check, MSS check, Rooting/Jail Breaking check however I am not sure whether this matches your requirement. Hope this helps. Regards, Kannan ... View more

Hi, Please find the update: MAG 6611 needs MAG-SM160 or MAG-SM360 to run as SA. We can configure Active /passive cluster setup with sincle MAG 6611 itself . For MAG6611, you can cluster two service modules in a pair, either using the MAG-SM160 or MAG-SM360. 1. In active/passive setup external interfaces of the and its corresponding external VIp should be in same subnet 2. Internal Interfaces of the 2 MAG modules with in MAG 6611 should be in same subnet . However I understand that you have 2 MAG 6611 , if these MAG 6611's are placed in WAN then cluster will not be possible since WAN clustering in MAG is not supported. Since this is a new deployment and its impact is high I would recommends you to create a case with JTAC Technical Support Team to give the confirmed information. Regards, Kannan ... View more

Hi, We cannot do a direct SSH to the SSL moduel on MAG device,SSH CLI connection and Jweb access is possibel only if you have CMC moduke installed in the MAG device. Even if you have CMC, SSH is possible only to CMC module, SSH to the SSL VPN blade is not possible. Regards, Kannan ... View more

Hi , For a standalone IC 4500, the maximum number of end points supported is 5000. IC 6500 can support a maximum of 35000 end points in a mutinode node IC cluster enviorment , I am researching on the maximum endpoints supported on a stanadlone 6500 IC. I will update you with my findings. Regards, Kannan ... View more

Hi Maung Tan, Identity and policy forum is for Infranet controller and AAA .1X I understand that your query is regarding SRX650 cluster, for this the query needs to be posted in JNET SRX forum, I have provided the below link for JNET SRX forum, please use the same and get clarifications on the query http://forums.juniper.net/t5/SRX-Services-Gateway/bd-p/srx Regards, Kannan ... View more

Hi Ucup, I tried finding the registry path however we are unable to retrive the edition from the bewlow mentioned path in registry: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion So If you are able to find the regitry path information which has the edition of the windows machine, then we can try assisting you on this Regards, Kannan ... View more

Hi Ucup, We can only check host checker Windows XP- 32/64 bit , windows 7 etc only with Minimum Service Pack/Version: like SP1 and SP2. We can't check the specific edition using the this option, however you can try this by using Add Custom Rule : Registry Setting option where you need to specify the path where it shows the current edition or version of windows OS like home/professional etc. Hope this helps. Regards, Kannan ... View more

Hi Vincent, 1. Were you able to access the netwwork drive before establishing OAC. 2. If the Script id defined to access Network drive along with OAC, then netwro drive mapping will work only when OAC is connected. Hope this clarifies your query Regards, Kannan ... View more