Regarding the CacheCleaner, the question is what you want to reach. What in case of a user is storing important data on the kiosk pc manually anywhere. Then you need to use the SVW (Windows only). Another approach would be to not allow access on such data, but it's often the case that the guys providing the content do not know who is accessing this from which location... But in case you use TS imho both is not needed, except sharing local harddrivesor drag & drop is possible to copy data out of the TS session to the kios ... View more

you could try isobuster, but I think this is encrypted as well. Why don't you ask juniper to send or sell just a single hdd, with a fresh OS on it, and than boot your machine and probably install you back up on it. ... View more

for this only the idle timeout will help, afaik. Especially with NC / *SAM the system is designed to continue working when the browser is closed because the browser is only necessary to start those components. If you are not using the ive as reverse proxy, you could try to check wether a JavaScript "onclose" in each page could call a function redirecting to the IVE's logoutpage. But if this will work it's in my eyes not a real tough solution. ... View more

I'd assume, that it is like with all loopback things, some kind of service is checking this loopback thing, taking the traffic, encrypting and porting this to the ive. the ive itself will decrypt the stuff and forward it if the traffic passes the acl to the back end terminal server... and same way back. For my understanding JSAM should work the same way, NC as well just with having another interface instead of a loopback one. ... View more

Ah sorry. No you were right. I just tried (and wanted, but it did obviously not work ;) ) to point out, that the Browser on the used PC, in your example Kiosk, needs to have this user cert, that's all. I just went one stept further, for our company's special case where the browser does not "store" the user cert, more than that assumes an entrust client software to be there to present the cert, so if our comp. would use user cert based auth. user's would not be able to authenticate because the may only have the cert in access via the entrust client. ... View more

This not a real limitation its just a matter of design. The same if you would do this with an ordinairy apache webserver. Only one certificate may be bound to a pair of IP and Port. This means to have your server listen to either more than only one IP (-> Virtual Ports in the IVE) or to have one IP and change the port. But last thing is not a big help, eg. when accessing sites via a proxy, this might not always let you connect outside resspources on any port you wish. Another thing for sure is those "ugly" wildcard certs, but those are most times more expensive. But maybe this more expensive depends on how much it costs for you to get more than one IP (or in case of a cluster 2+1+n). There is a thing about SAN-Certs (Subject alternate Name) which are based on the fact that a cert may contain alternate names istead of only one. But I do not know if the IVE has the possiblity to generate CSRs for this (but it does not look like, at least there is no field for this. ... View more

The browser should be able to present the client cert, otherwise the login will not be possible. E.g. in our case we have the entrust client, so if you try accessing from a machine without entrust client and thus without your personal cert you won't be able to access. Another thing would be the the so called "machine certs", that you could carry around on a smart card but then you would need to use the HC. ... View more

Are there any infos in the logs? At least it should tell you that ESAP was updated in the positive case? Edit: Just testet this on our testSA 2000, with ESAP 1.3.7. on IVE OS Build 13103 (6.1R2-1) without any problems also no matter if checking the box for activating this package after uploading. Message Edited by ben on 05-21-2008 08:25 AM ... View more

Generally the thing with DHCP should work. But in our case, when we tried this one year ago, the IVE did not sent an IP of the subnet the user shall get an IP from as GiAddr, more than ther her own one, so DHCP wasn't an option for us anymore... ... View more

How abouit filterin on the msg content? In our case we have to messages indicating the sign-in process to be successfull 1.) "Primary authentication successful"... -> But here it may happen that the user may not get mapped any roles,so the overall result will not be successfull, but anyway good to know, e.g. for troubleshooting 2.) "Login succeeded".... The filter could look like: msg = ("*Primary authentication successful*" OR "*Login succeeded*") ... View more

to record rdp sessions you could use balabit's shell control box ;) ... View more

At first you would define your start-page settings to be either the bookmarks page (that also displays the WSAM button) or any other startpage. Then you define where the icon in the browsing toolbar should link to, in this case let it point to the bookmarks page. At last defne your Web ACL + WSAM config on that role and you're done. ... View more

This solutions works for the role, this was set to. In case of having different "access profiles", we configured our SA to have a role for UI + Session and other roles with just the "features" + ACLs. But I did not try to assign two roles to a user, containing different settings for the startpage. ... View more

I think the biggest problem here is the closing after the NC has been "properly started", because afaik there's no feedback from the NC client to the webpage. Anyway with placing JavaScript code [code] window.close(); [/code] on the right place, you could close the browser window. BUT in case the user has surfed the internet with this browser window alread, there will be a confirmbox, that a script is trying to close the window, that can not be avoided. ... View more

My skill in custom signinpages is maybe kind of outmoded, because last time I used them was one year ago. But by that time there was no need for any tool except any editor for the thtml stuff. Just downloaded and editet with ultraedit / dreamweaver. That's all. don't worry about the ending, that does not really give you a hint about the content, especially in this case. I guess the "t" of thtml is just for template or sth. similar. But in the end ists just a bit html code with some logic inside that the IVE will parse before sending the content to the browser. The use of active perl may belong to a similar syntax of a perl module for parsing such kind of templates, but that's only a guess. Anyway I tried to avoid using custom sign in pages, except the normal customisations, due to the fact that they were quite unhandy, escpecially when upgrading the OS. Most warnings could just be ignored because it worked fine anyway, but it gave me the feeling of doing something more like quick & dirty... ... View more

Yes, on our SA2000 Testsystem. Upgradeded from 6.0R4.2 and it worked without any problems. Also the SVW on a Vistamachine worked fine,even if it was just a very short test, start SVW and exit ;) ... View more

If this is an issue with a that big impact I'd raise the pressure on the support by checking for assistance from either your local Juniper SE or Account. ... View more

Well the only thing for us here is to test 6.1 because auf the SVW Support for vista. AS my SE told me 6.1R1 is out a while but seemed not hat stable, so I shall wait to 6.1R2. But I guess till we migratio our production env. to 6.1x it will take a while. We are doing fine with 6.0R4.2 (even if 6.0R.4.2.1 is out, but according to the changelog with one fix for NC...) ... View more

Just fyi, 6.0R4.2.1 is out, where "NC + Proxy support is restored. (55902)". Even if not written in the release notes, SVW + FF 2.0 shall be supported, said JTAC... Message Edited by ben on 04-10-2008 07:36 PM ... View more

Are you talking about web ressources or what, that is authenticated against AD? Just activate two authentications on your realm, i.e. 1. 2-factor, 2. AD. The post the Username + Password (username and password[2]) to the ressources, authenticating against AD. ... View more

According to the Supported Platform Document, available in Juniper's Support -> Download section, NC is not available for mobile devices. Only WSAM is available, this is just available on SA2000+ but noton SA700. ... View more

Same here, before switching to 6.0x we ran with our SA6000s on 5.5R4. If you change to 6.0x I would suggest 6.0R3.1 or 4-, both worked fine here. 6.0R3 had an ugly bug that rolemapping base on AD Groups were not working. ... View more

@Sylvain: I though this "feature" is free of charge... I should check how this is with a SA6000... ... View more

In my eyes this would mean your session is "killed. If so you should see something in the user access log in the ive. Maybe there is an issue with your cookies, and thus your session is killed? ... View more

Did the support at least ask for the clientlogs to see futher more there? How about a local Juniper SE beeing responsible for you to push this case? ... View more

I guess Sylvain meant 50 ccu in case of A/P ;) btw, there is an extra license key for SSL-Acceleration??? Message Edited by ben on 04-03-2008 08:19 AM ... View more

May the pool be the same then? E.g. if you map an IP to a user via Radius attribute ... View more

Where should the last hop's route poin to? the internal VIP of the IVE? If the IVE would support RIP / OSPF such things would be easier... Message Edited by ben on 03-17-2008 04:14 PM ... View more

Maybe this is fixed in 6.0R4.2, unfortunately I do not have that, yet, but good to know to check for Advanced Endpoint Defense, that we plan to engineer/use in a few weeks. ... View more

@MCT: looks like you do not have a cluster, or at least an active active one, where you will lose needed capacity if one cluster member goes down? When upgrading our A/P cluster we nearly have no downtime. ... View more