- Pulse Secure Community
- :
- About -red-_
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
since
10-29-2017
10-29-2017
-red-_
Frequent Contributor
97
Posts
0
Kudos
8
Solutions
06-05-2013
09:27:AM
I think I jinxed myself after the last post. Updated ESAP this morning then started getting a ton of Host Checker policy XXX failed on host... "Reason Internal error while evaluating rule XXXX" What I had noticed is that issue was isolated to a single cluster member. The remaining 3 appliances seemed to have no problems after the update, and all the errors were coming from one box. I disabled him on the ltm and will see about rebooting him later. May open a ticket with Juniper to dee what happened, this is a new one by me.
... View more
06-04-2013
10:54:AM
I have seen this before as well immediately following ESAP update. One thing I noticed when these failures occur is that if you review your rules, and you look at the listing of AV/FW products you check for, the lists are blank. Reverting and re-ugrading esap seems to have fixed the problem. We never found the root cause, but ever since then, I always check the product drop-down list as soon as the new ESAP plug in goes active.
... View more
05-10-2013
09:08:PM
Have you been able to correlate any other connectivity issues to the time frame your users experience problems? This may be a long shot but., what about the firewalls at each of the 2 or 3 locations you had mentioned? Having dealt with Checkpoints for some time, have seen scenarios where they can occasionally drop traffic if you happen to push policy to them while they are under a heavy load. If multiple firewalls are managed using the same policy package, that could account for simultaneous drops at 2 locations. Again, this is a bit of a stretch, but just something to consider..
... View more
02-15-2013
07:18:AM
@hutchingsp wrote: The way it works now it's a two-step process to start NC, but I only have to update one set of TS bookmarks in one location and everyone is good to go. Hopefully that's a little clearer? Any reason you dont have Pulse/NC set to autostart when the users log in?
... View more
02-15-2013
06:37:AM
I am still having a hard time thinking through this :) I assume your RDP bookmarks are configured to use the IVE as a broker, so even with the Pulse session established, RDP traffic takes a different path. I wonder if there are performance implications here. Just thinking through the path in this scenario. User established VPN session via Pulse terminated at the IVE Using an established Pulse session, user opens a new session to the IVE, presumably via internal interface? User clicks the RDP bookmark and uses the IVE broker functionality on the IVE to connect to the resource. If I am not mistaken, (and I would encourage one of the Juniper guys to speak to this) enabling multiple user sessions would also consume additional user licenses. It may be a whorthwhile effort to figure out which of the RDP users actually need the full Pulse client, and who would be content just using the RDP bookmarks. Let them have a choice in how they establish a session. Allow your RDP users, and users to continue logging in via a browser, and encourage those who dont to use Pulse.
... View more
02-15-2013
06:06:AM
With the Pulse session already established, is the goal is to merely use the SA as a bookmarks page at that point? Aside from that, I would think there is no real value in going back to the SA bookmarks as they should be able to RDP via the established tunnel. If you are really compelled to do this, you can increase the limit on the number of concurrent user sessions. I believe you have to do this at the ream as well as the sign-in policy level. Although I would still question the value of this approach..
... View more
02-15-2013
05:53:AM
The last version I've tried this on is 3.1.3.31097. I am curious if Juniper has an ETA on getting this addressed.
... View more
02-12-2013
10:29:AM
If their environment permits, you may be able to configure a Web Resource profile as Citrix, define their Web-I URL and XenDesktop servers, then configure the URL in the UI option to point to the Web-I . I believe they can autolaunch the desktop from the Web-i itself. you will likely be expected to configure this resource for SSO into the Web-i.
... View more
02-08-2013
12:56:PM
Odd. Mine shows users who've not logged in for over a year. I wonder if you got something enabled to automatically clear user records after a period of time.
... View more
02-06-2013
12:44:PM
You should be able to get that data by going to the users tab of the auth server you are utilizing. It should contain user's last log-in time, IP along with user agent string.
... View more
01-31-2013
10:43:AM
I've gone through a similar upgrade last year. We did do a fair amount of testing ahead of the upgrade, and for the most part it was uneventful. Few client issues here and there, but otherwise no major problems. With that said, if you want an opportunity for some limited user testing, see if you can download the DTE release of the code you're upgrading to. http://www.juniper.net/support/downloads/?p=savadte
... View more
01-31-2013
10:30:AM
I do not believe you can use MAC address. Looking under Realm->Authentication, Source IP, and User agent strings are your best bet, assuming you can take advantage of them. Some type of client side certificate restriction may also be an option, but I've not messed with that feature, so can't really comment on it. Even if possible,I imagine managing client side certs could be a potential headache.
... View more
01-30-2013
01:43:PM
I'm not sure you're going to be able to pull this off without either a new URL or a realm drop down menu. The only automated alternative I can think of involved tying two realms to the sign-in policy then leveraging restrictions at the realm level preventing the users meant to go to realm a from logging into realm b, and so on.. However, unless you can use something like user agent string, or source IP to distinguish the users, that would not be an option.
... View more
01-29-2013
02:22:PM
Couple of ways you can do this. You should be able to accomplish this via a custom expression in the role mapping (using user agent variable along with name of your host checker policy) Alternately, assuming you have a separate role for your iOS users, you can add a user agent string restriction there as well. Hopefully this helps.
... View more
01-22-2013
11:25:AM
Originating from the SA, the NC traffic will not be NATed. Each IP address will correspond to a user session. As long as you are monitoring your traffic before it gets NATed out on the perimeter (assuming that's what you're doing,) you should have visibility into their activity.
... View more
01-18-2013
05:38:AM
Maybe I am missing something, but I am a little confused by the need to use public address space. With logging enabled on your perimeter devices, I would imagine you'd be able to monitor activity regardless of whether the IP address is public or not. Juniper logs will have the information regarding which IP address is assigned to which user. Also, do you have 10 different groups of users, or are the roles just being created to accommodate the 10 subnets? Based on your use case, assuming you just need two roles (Students, and Staff), I would create a role one for each group, then I'd create a corresponding NC connection profile for each of the roles. Depending upon your desired IP space distribution, you can place 5 subnets into each connection profile, or just distribute them as you see fit.
... View more
11-16-2012
11:54:AM
What does your NC ACL look like?
... View more
11-07-2012
12:47:PM
Not the answer I was hoping to find, but it does address my question. We have reached out to Microsoft for some ideas on this as well, but it sounds as if this may be a time to ping my account team with an enhancement request. Considering some of the feedback regarding ESAP, I think this would be well received. Thanks for the info.
... View more
11-05-2012
06:31:AM
Thanks for the input. I do realize that a rule can be written to check for a registry entry. With that said, I am curious to see if there is a way to do this specifically looking for status of the Microsoft Action/Security. The goal is not merely to bypass ESAP, but to actually leverage Microsoft's Security Center/Action Center status to get compliance information. Again, I realize it wont be as granular, at least no in terms of determining age of virus definition file, or the last time a scan was performed, but to simply find out whether machine has AV/Firewall sofrware running, I would think it should be sufficient. The key is to determine whether status information can somehow be extracted from the registy, or if there is another means of obtaining it without using ESAP. Regards,
... View more
11-02-2012
05:50:PM
Based on a number of posts I've seen on this forum, along with having experienced it first hand. Use of ESAP tends to be a bit tedious. I have been kicking around an idea of accomplishing some of the same goals, but without having to rely on it, and wanted to bounce it off this user group to see if this is viable. I am looking to see if there is a way for us to query state of the Windows Action Center/Windows Security Center. It seems Microsoft already privides us with the means to determine whether firewall and AV software is running on the machine by way of Windows Security Center and/or Action Center, so I am curious to see if there is a way to build a host checker policy to do nothing more than query those tools to determine compliance. Granted this isnt as granular as the checks offered by ESAP, but would be sufficient for some of my applications. Essentially, the main goal is to detect presense of a running AV/firewall product without using ESAP. I am curious if this is possible. Regards,
... View more
10-31-2012
01:14:PM
Wouldn't going to the auth server->user tab give you this data? Granted its not in a report you can export, but, but depending upon your user volume, you should be able to paste the output into Excel.
... View more
10-23-2012
05:56:PM
Unless I am forgetting something, I am not sure there is a clean way to do this within the IVE itself. Assuming you have a firewall filtering traffic from the inside interface, why not just log that and filter on your NC IP range? While it will obviously not give you the username, assuming your users stay logged in for a decent period of time, you can look up thier assigned IP for that session then correlate it to the firewall log. Though not ideal, its a good starting point.
... View more
10-01-2012
11:21:AM
Unless I am missing something about the details of Juniper clustering I don't understand what is gained by disabling the peer?
... View more
09-27-2012
07:32:AM
I would think you should be able to do this by setting browser restrictions at the realm level. You may need to do some tweaking to find the correct user agent strings, but I imagine *iphone* deny, *ipad* deny followed by * allow rules should do the trick.
... View more
09-27-2012
05:48:AM
As pointed out in the previous post, you cannot technically mix SA hardware platforms. With that said, depending upon what you are trying to accomplish, you may still be able to manage 2 boxes as one cluster, but with few extra steps. You can place the SAs behind an external load balancer, and control connection distribution from there. With regards to propagating the configuration across appliances, you may either manage both via NSM, or use the push config feature to distribute the config from one box to another. Depending upon how frequently you make configuration changes to your appliances, this may become tedious, but is certainly doable. One other thing to consider, if I remember correctly, XML config push used to restart services on the target appliance. Not sure whether this has been addressed recently, but something to keep in mind if you're willing to entertain this idea. Hope this helps.
... View more
09-26-2012
12:26:PM
See if this is your issue. We ran into this upgrading from 6.5R5 to 7.1R10 [KB22040] Show KB Properties SUMMARY: Users are unable to launch UAC/IVE client software such as Junos Pulse, Host Checker, Network Connect, Windows Secure Application Manager (WSAM), Terminal Services, and so on. PROBLEM OR GOAL: When users attempt to connect, the application looks like it is trying to launch but fails. There is little or no external notification that there is a problem; other than failing to launch. Users will see the Please Wait... screen for the application launch and may even see the executable attempting to launch; but nothing more is observed. When looking at the client-side logs, the following sequence is observed (edited for clarity and emphasis added for the keywords to check against): 2011/10/04 11:03:43.819 1 dsVerifyHelper.cpp:184 - 'DSVerifyHelper::verify()' Enter: C:\DOCUME~1\tester\LOCALS~1\Temp\JuniperSetupClientInstaller.exe dsVerifyHelper.cpp:184 - 'DSVerifyHelper::verify()' WinVerifyTrust() failed, 800B010A 2011/10/04 14:58:04.833 1 dp59 - 'DSVerifyHelper::verify()' Enter: C:\Documents and Settings\tester\ Application Data\Juniper Networks\Setup Client\JuniperSetupDLL.dll dsVerifyHelper.cpp:184 -'DSVerifyHelper::verify()' WinVerifyTrust() failed, 800B010A CAUSE: The certificates, which are used to sign the Juniper binary files, are not installed on the client machine. SOLUTION: The following certificate needs to be installed on the machine in the root CA store: VeriSign Class 3 Public Primary Certification Authority - G5 Once the above certificate is downloaded and installed, the chain is allowed to be successfully created.
... View more
09-24-2012
11:31:AM
As much as I like the concept behind ESAP, I find the real world implementation very challenging. In order to "successfully" deploy ESAP, you must first realize (and then sell your organization on) the fact that you will always be in catch up mode. Over the few years I have run ESAP, I have run into a few instances where OPSWAT has not been able to keep up with releases of products by major players in the space. Even when they are keeping up, by deploying this functionality you are relinquishing a great deal of control to the end users' ability to maintain their workstation in a condition which will allow them to meet your criteria for access. It is my understanding that these challenges are not unique to Juniper, but rather this functionality as a whole. With that said, I do think that if this is utilized selectively, it could be beneficial. But a blanket requirement for ESAP may not yet be the way to go. I run it because now I have to. But if I could do it over again, I am not entirely sure I would.
... View more
08-29-2012
07:12:AM
I've looked at this in our QA environment although never rolled this into production. From what I could make of the configuration, disconnecting the IDP should have no impact (at least didn't in my case). With that said, to be on the safe side, you can probably look at the Sensor Event Policies and set the IDP policy not to apply to any role. I was able to completely remove the sensor from the IVE configuration with no impact to user connectivity.
... View more
08-06-2012
08:24:AM
From what I have seen in my test cluster, if you do not have the image staged across all the appliances individually, it will be pushed out to other nodes much like it did prior to the staging function. I would actually be curious to see whether pre-staging it on all appliances gives you a different result (other than simply allowing you to forego having the image pushed across multiple cluster members) I am not sure that it does.
... View more
07-31-2012
12:47:PM
Issue was identified, and appears to have been resolved as of 7.2R3
... View more
Latest Tags
No tags yet
© 2017 Pulse Secure, LLC. Use of this website assumes acceptance of our Legal Notices and Privacy Policy.
Pulse Secure has updated its Privacy Policy effective June 28, 2017.
