- Pulse Secure Community
- :
- About ruc_
turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
since
10-29-2017
10-29-2017
ruc_
Regular Contributor
249
Posts
1
Kudos
25
Solutions
02-10-2009
08:53:PM
Ronin, Any chance the users that have this issue are assigned to more than one role and any of the roles assigned have the "auto-uninstall" enabled? Can't see any other reason for this. I would suggest you open a JTAC case and attach the client logs.
... View more
02-10-2009
08:20:PM
How will end user access the page/app? Will they be: 1. Typing a URL in the browser's address bar. 2. Typing a URL in SA 4500 'browse bar' (the one you see on the initial bookmarks page) 3. They will click on links on some external web page
... View more
02-10-2009
08:12:PM
A similar issue (related to validation of the signature file) was fixed in 6.2R4
... View more
02-10-2009
07:57:PM
Given that you are using web access, when a user clicks on a link within an OWA email (example http://www.juniper.net ) the traffic flow will be: Client PC < > SA External interface < > SA Internal Interface < > External Webserver (www.juniper.net) Check the connectivity between internal interface of the SA 4500 and the external webserver.
... View more
01-30-2009
10:09:PM
One limitations about WSAM is that it can secure traffic only for applications that rely on Winsock for making network connections, so if your app or RPC or DCOM (whichever is making the actual network calls) does not use winsock then WSAM will not be able to secure traffic. One of ways of finding if winsock is being used is with the help of the tool 'process explorer ' from sysinternals suite. Using this tool you check what dll are being loaded by the application and in the list if you see ws2_32.dll then you know winsock is being used.
... View more
01-29-2009
07:47:PM
From the three choices above I feel # 3 is the most likely outcome, however its not guaranteed as what if during setup the nodes need to exchange a huge blob of data as during setup the main node will send its config to other nodes and the chances of sending huge packets are highest at setup time. I'm still not convinced about the issue as sending these UDP packets should work as long as the network between the two SA untis can handle fragmented traffic. I would strongly recommend that you get to the bottom of this problem if you plan on using this WAN cluster deployment.
... View more
01-28-2009
04:09:PM
Have you tried adding the destination IP of the RPC request to the "wsam allowed servers list" under role options? In this mode WSAM will not care which exe generated the traffic as long as the destination IP matches.
... View more
01-28-2009
03:59:PM
If you generated the CSR on the SA then you can't extract the private key. If you need to import the cert and private key on another device then you will have to generate the CSR on an external device (example: any PC with open SSL installed) and then import the cert and private key into both the SA and other device that you wish to.
... View more
01-28-2009
03:53:PM
If you are using a web access mechanism for this application then try adding a caching policy for this resource with action=unchanged under Resource Policies > Web > Caching. If the file is not cached then certain applications may not be able to render the file. Reference: http://kb.pulsesecure.net/KB2695
... View more
01-28-2009
03:40:PM
What is the purpose for these large packets ? Are they specific to one type of synchronization that could be deactivated ? Answer: No this is can't be done. What could block those packets ? Answer: Its hard to say. One of the causes I have seen is firewall/one of the intermediate devices not handling fragmented UDP packets. I would start with taking a tcpdump on both SA's and sniffers on a couple of intermdiate devices like the firewall, etc and then looking at what happened to the large UDP packets.
... View more
01-27-2009
08:09:PM
At a very high level: 1. Ensure that Defender is passing windows domain group info (authorization info) in Radius attributes (as a part of access-accept packet) 2. On the SA select role mapping rules based on User attribute option. For config help on # 1 you will have to check with the Radius vendor/documentation and for config help with #2 try the string 'Specifying Role Mapping Rules for an Authentication Realm' in the search option of the SA admin help interface (by clicking on help from the admin GUI)
... View more
01-27-2009
07:42:PM
The Profile defines settings like IP, dns, proxy, etc. For access control you need to set ACL's. For config help bring up the help interface (by clicking on 'help' from the admin GUI) and then under search enter the string 'Defining Network Connect Access Control Policies ' This config section will help you restrict access based on roles. Make sure you edit the allow all rule that is there by default.
... View more
01-27-2009
07:37:PM
How do you start network connect? Do you sign in using a browser and then either manually or auto start NC? Or do the users start it from a desktop shortcut for NC client? And what version of SSL VPN OS do you see this issue on?
... View more
01-27-2009
04:25:PM
If you generated the CSR on the SA (SSL VPN device) then you cannot export/extract the private key from the device itself. However you can save the system.cfg file if you wish to backup the cert.
... View more
12-08-2008
12:44:AM
http://support.microsoft.com/kb/154501
... View more
10-30-2008
08:27:PM
You could go to the user role and enable the below option and then end users can add RDP sessions to any server they need and you can still control which servers they can access using Resource Policies > ACL "User can add sessions Users can define their own Terminal Services sessions."
... View more
10-30-2008
07:43:PM
What privilege level does the service account defined on the SA have? The service account/admin account needs the privileges listed in KB2624 at the minimum. http://kb.pulsesecure.net/KB2624
... View more
10-19-2008
10:51:PM
Have you selected "NTLM" under authentication protocols (AD auth server definition page on IVE)? If yes changing to Kerberos will resolve this issue. Below is an article from MS that explains 'why' http://support.microsoft.com/kb/886705 Note: For each user session IVE will always validate the credentails against the backend authentication server Hope it helps!
... View more
10-19-2008
10:30:PM
Hi, To get Enterprise Vault to work correctly (using web access mechanism) you will have to follow the below steps. 1. Create a Web Resource Policy for allowing custom headers (Resource Policy -> Web -> Rewriting -> Custom headers) 2. Contact JTAC to get a rewrite filter license and a rewrite filter package for EV application (the filter package is called filter50375.pkg.encypted) and apply the license and rewrite filter package to the Secure Access platform (For details about rewrite filters refer http://kb.pulsesecure.net/KB10195 ) 3. Once you have installed the filter ensure the following URL's are associated with the filter. http://*:*/exchweb/* https://*:*/exchweb/* http://*/*/archiveexplorerui.asp* https://*/*/archiveexplorerui.asp* http://*/*/*/*/script/*.js https://*/*/*/*/script/*.js 4. If you still face any issues with EV then kindly collect a session recording (dsrecord), policy trace and some screenshots of the errors and report via a JTAC case. Alternatively you could create a selective rewrite policy and use some other access mechanism like WSAM or Network Connect. Hope it helps!
... View more
09-18-2008
09:37:PM
Can you please clarify 'http variables'? In general you can use any variable defined in the list (System Variables and Examples) To access this list click on the "help" link and search for the string 'System Variables and Examples. Another option is to try the polciy trace tool under "Troubelshooting" section.
... View more
09-18-2008
09:27:PM
From Admin UI, under User Roles > SAM > options check the option "Skip web-proxy registry check"
... View more
02-24-2008
09:34:PM
If you need SSO the only option is to use NTLM v1 (can be configured on AD under Security policies " Network security: Lan Manager authentication level" ) Message Edited by ruc on 02-24-2008 09:35 PM
... View more
11-11-2007
06:02:PM
http://kb.pulsesecure.net/KB10181
... View more
11-11-2007
05:59:PM
You are right. The 'Authentication Intermediation' pages are not exposed for customization to the extent of sign-in pages. Some of the workarounds for your scenario are: 1. Use SSO feature (form/post, Basic Auth or NTLM - any one option) so end users never see any auth intermediation pages. 2. If #1 is not an option disable intermedaition and have the backend application/web server handle authentication so it can send a page that is consistent with other pages.
... View more
11-06-2007
10:42:PM
My IVE will mediate this traffic now, so I should create a virtual host "myserver.mycompany.com" so that when the user access the URL "myserver.mycompany.com/subpath-X/subpath-Y" he will be authorized based on your Certificate Attributes, and then either redirected to "http:/myserver.local/subpath-X/subpath-Y". I did not fully understand your requirements but for setting up something similar to what is described in above paragraph using certificate authentication you will have to do the following: 1. Set up a realm which uses a Certificate authentication server . 2. Ensure you have a resolvable name configured under Network > Hostname 3. Enable 'Browser request follow-through' under Role > Session Options 4. Set up Pass through proxy using virtual hostname options as shown in attached screenshot (myserver.mycompany.com should resolve to the SA) Now when an end-user accesses https://myserver.mycompany.com/subpath-X/subpath-Y the user will get redirected to the sign-in page where certificate authentication will take place and then user will get redirected to backend via SA. Attachments: jnet_ptp_sample.jpg â€141 KB
... View more
11-06-2007
09:48:PM
The internal VIP will have to be in the same subnet as the 2 internal interfaces.
... View more
11-06-2007
09:38:PM
If this is a new deployment then I strongly recommend that you use Junos Pulse rather than Network Connect as Junos Pulse is the newer client offering mostly everything that NC offers and more. With Pulse you could use location awarness to trigger the client.
... View more
11-06-2007
09:30:PM
The external I/F IP address needs to be defined (can't use dynamic IP)
... View more
11-06-2007
08:47:PM
As long as the NC config and firewalls allow this it should be possible. A similar use case is documented in http://kb.pulsesecure.net/IKB20394
... View more
- « Previous
- Next »
Latest Tags
No tags yet
© 2017 Pulse Secure, LLC. Use of this website assumes acceptance of our Legal Notices and Privacy Policy.
Pulse Secure has updated its Privacy Policy effective June 28, 2017.
