Ronin, Any chance the users that have this issue are assigned to more than one role and any of the roles assigned have the "auto-uninstall" enabled? Can't see any other reason for this. I would suggest you open a JTAC case and attach the client logs. ... View more

One limitations about WSAM is that it can secure traffic only for applications that rely on Winsock for making network connections, so if your app or RPC or DCOM (whichever is making the actual network calls) does not use winsock then WSAM will not be able to secure traffic. One of ways of finding if winsock is being used is with the help of the tool 'process explorer ' from sysinternals suite. Using this tool you check what dll are being loaded by the application and in the list if you see ws2_32.dll then you know winsock is being used. ... View more

The SA platform only supports PAP ... View more

From the three choices above I feel # 3 is the most likely outcome, however its not guaranteed as what if during setup the nodes need to exchange a huge blob of data as during setup the main node will send its config to other nodes and the chances of sending huge packets are highest at setup time. I'm still not convinced about the issue as sending these UDP packets should work as long as the network between the two SA untis can handle fragmented traffic. I would strongly recommend that you get to the bottom of this problem if you plan on using this WAN cluster deployment. ... View more

Have you tried adding the destination IP of the RPC request to the "wsam allowed servers list" under role options? In this mode WSAM will not care which exe generated the traffic as long as the destination IP matches. ... View more

What is the purpose for these large packets ? Are they specific to one type of synchronization that could be deactivated ? Answer: No this is can't be done. What could block those packets ? Answer: Its hard to say. One of the causes I have seen is firewall/one of the intermediate devices not handling fragmented UDP packets. I would start with taking a tcpdump on both SA's and sniffers on a couple of intermdiate devices like the firewall, etc and then looking at what happened to the large UDP packets. ... View more

At a very high level: 1. Ensure that Defender is passing windows domain group info (authorization info) in Radius attributes (as a part of access-accept packet) 2. On the SA select role mapping rules based on User attribute option. For config help on # 1 you will have to check with the Radius vendor/documentation and for config help with #2 try the string 'Specifying Role Mapping Rules for an Authentication Realm' in the search option of the SA admin help interface (by clicking on help from the admin GUI) ... View more

The Profile defines settings like IP, dns, proxy, etc. For access control you need to set ACL's. For config help bring up the help interface (by clicking on 'help' from the admin GUI) and then under search enter the string 'Defining Network Connect Access Control Policies ' This config section will help you restrict access based on roles. Make sure you edit the allow all rule that is there by default. ... View more

How do you start network connect? Do you sign in using a browser and then either manually or auto start NC? Or do the users start it from a desktop shortcut for NC client? And what version of SSL VPN OS do you see this issue on? ... View more

If you generated the CSR on the SA (SSL VPN device) then you cannot export/extract the private key from the device itself. However you can save the system.cfg file if you wish to backup the cert. ... View more

http://support.microsoft.com/kb/154501 ... View more

You could go to the user role and enable the below option and then end users can add RDP sessions to any server they need and you can still control which servers they can access using Resource Policies > ACL "User can add sessions Users can define their own Terminal Services sessions." ... View more

What privilege level does the service account defined on the SA have? The service account/admin account needs the privileges listed in KB2624 at the minimum. http://kb.pulsesecure.net/KB2624 ... View more

Have you selected "NTLM" under authentication protocols (AD auth server definition page on IVE)? If yes changing to Kerberos will resolve this issue. Below is an article from MS that explains 'why' http://support.microsoft.com/kb/886705 Note: For each user session IVE will always validate the credentails against the backend authentication server Hope it helps! ... View more

Can you please clarify 'http variables'? In general you can use any variable defined in the list (System Variables and Examples) To access this list click on the "help" link and search for the string 'System Variables and Examples. Another option is to try the polciy trace tool under "Troubelshooting" section. ... View more

If you need SSO the only option is to use NTLM v1 (can be configured on AD under Security policies " Network security: Lan Manager authentication level" ) Message Edited by ruc on 02-24-2008 09:35 PM ... View more

http://kb.pulsesecure.net/KB10181 ... View more

You are right. The 'Authentication Intermediation' pages are not exposed for customization to the extent of sign-in pages. Some of the workarounds for your scenario are: 1. Use SSO feature (form/post, Basic Auth or NTLM - any one option) so end users never see any auth intermediation pages. 2. If #1 is not an option disable intermedaition and have the backend application/web server handle authentication so it can send a page that is consistent with other pages. ... View more

My IVE will mediate this traffic now, so I should create a virtual host  "myserver.mycompany.com" so that when the user access the URL  "myserver.mycompany.com/subpath-X/subpath-Y" he will be authorized based on your  Certificate Attributes, and then either redirected to  "http:/myserver.local/subpath-X/subpath-Y". I did not fully understand your requirements but for setting up something similar to what is described in above paragraph using certificate authentication you will have to do the following: 1. Set up a realm which uses a Certificate authentication server . 2. Ensure you have a resolvable name configured under Network > Hostname 3. Enable 'Browser request follow-through' under Role > Session Options 4. Set up Pass through proxy using virtual hostname options as shown in attached screenshot (myserver.mycompany.com should resolve to the SA) Now when an end-user accesses https://myserver.mycompany.com/subpath-X/subpath-Y the user will get redirected to the sign-in page where certificate authentication will take place and then user will get redirected to backend via SA. Attachments: jnet_ptp_sample.jpg ‏141 KB ... View more

The internal VIP will have to be in the same subnet as the 2 internal interfaces. ... View more

If this is a new deployment then I strongly recommend that you use Junos Pulse rather than Network Connect as Junos Pulse is the newer client offering mostly everything that NC offers and more. With Pulse you could use location awarness to trigger the client. ... View more

The external I/F IP address needs to be defined (can't use dynamic IP) ... View more

As long as the NC config and firewalls allow this it should be possible. A similar use case is documented in http://kb.pulsesecure.net/IKB20394 ... View more