If you configure WSAM to tunnel traffic from the browser application you can then use resource policies to control what they access. Of course if they use a different browser they could still get to the Internet without passing through the VPN box. Alternatively you could configure it with an allowed server * and ports 80, 443 which would force all http, https traffic down the tunnel but this might break other things. ... View more

If you are using WSAM then you cannot access DFS file shares. Here's a what is says in he release notes from 6.3: "In Release 5.2, Juniper investigated support for DFS File Sharing through WSAM. However, we have identified that the system needs to trigger Domain Authentication via ICMP/Kerberos, and this functionality is currently not supported. Once Domain Authentication is fully supported through WSAM, there is a high probability Juniper can make DFS File sharing work. There is no ETA at the moment for supporting Domain Authentication. (30587)" As a workaround you can use the File access method to access the DFS shares. ... View more

Try using a tool like the freeware TDImon to determine which processes are sending the network traffic. Run it when not connected via WSAM to see a normal connection. Also you can run it when connected with WSAM to confirm everything is going through WSAM. It should also be noted that WSAM has a list of bypass appications which it won't process. There is a default set and you can add you own. The default ones are list in a config file somewhere on the client machine (can't remember where). Having said this using allowed servers usually gets round this list. ... View more

Resource policies for different roles are combined into a session policy for the user. Double check that another role is not also being mapped for the users and granting the additional access. ... View more

Try the net use command with the user name set to %USERNAME%: net use X: \\server\share /user:%USERNAME% /persistent:no ... View more

Kerberos does work with Network Connect. Make sure you include a policy that allows: 88 udp/tcp, 53 udp/tcp and I think you also need LDAP 389 udp. If this doesn't work try forcing Kerberos to use TCP as described here http://support.microsoft.com/kb/244474 ... View more

I can terminate the process manually. After further investigation the problems seems to be the process is a service. Host Checker does seem to be able to terminate "program" processes but it fails when it is a service. ... View more

I don't think you can import a configuration from an older release. What you would need to do is downgrade to the older release, import the configuration and then upgrade. ... View more

I tried for several months to get Kerberos and SMS to work with WSAM but was not successful. The problem we found was that is DNS SRV requests where not being forwarded by WSAM. There was also a Connectionless LDAP (CLDAP) request that was not being forwarded by WSAM. The really annoying thing is Kerberos itself does work via WSAM but it can't get started because of the DNS issue. ... View more

We have user reporting the same problem. It only seems to affect users in two out of our 4 domains. We have ticket open with Juniper but so far no solution ... View more

What version are you using. Host Checker not detecting processes running as SYSTEM is a bug that appeared in 6.1R1 and was fixed in 6.1R2.1. ... View more

Has anyone tried installing 6.1R2? I'm trying to upgrade out test appliance (SA-2000) from 6.1R1 but the upload keeps failing after about 2%. I've confirmed the checksum is okay so the package didn't get corruprted during the download. I've only briefly tested with 6.1R1 so can't give much feedback. There is a bug in Host Checker that prevents limited rights users seeing processes running as SYSTEM that is supposed to be fixed in 6.1R2 (JTAC told me the same bug was also in the 6.0 stream and fixed in a recent release) ... View more

Just testing 6.1R1 and got the same issue. After further investigation I discovered the problem is a new option "Send reason strings" in the Remediation section of the host checks. If this is enabled and any of the rules in the check fails Host Checker displayed the remediation page even if the rules are not required. Unchecking the option fixes the issue. While it is annoying this option is checked by default after upgrading more concerning is that the Reason String displays the full details of the check. If we hadn't had issues we may have not noticed that the remediation page was now giving full details of our host checker requirements rather than our custom message to call the helpdesk. Unfortunately now that I have got passed this issue I have discovered Host Checker no longer seems able to detect processes running as SYSTEM user when the local user doesn't have admin rights. This is definitely working on 5.3R5.3. We are running the Installer service and I've also tried manually installing Host Checker as an Administrator. ... View more

Make sure the host check is set to "Evaluate" on the Realm. Without this the result is not available. Tip: Depending on which release you are using make sure the "Send reason strings" option is unchecked on the Host Check otherwise you will get the remediation screen if a user who fails the check connects to the realm even though you're not requiring it on the realm. ... View more

We did have a concern about a big increase in concurrent connections when we first switched from Network Connect via a web page login. In the end the jump in peak usage doesn't seem to have been that big but it's difficult to put a figure on it because we rolled out over a period on months and year on year there has been a steady increase anyway in usage. It is definitely something you should think about though and the smaller your license the more likely the impact will be significant. Things to consider are who are the people not regularly connecting and when might they connecting their laptops to the internet. If your peak is during the day but most of your laptop users are normally in the office during business hours then the impact will be less (we did notice the off peak usage went up but this didn't impact the licensing) ... View more

If someone can get a copy of the certificate including the private key and install it then effectively the certificate is worthless as an authentication mechanism. Ideally you want the certificate to be requested by the machine directly so the private key is generated on and only ever exists on the authorized machines keystore. If you need to generate the key and csr manually then you need to ensure the key it is protected by a strong password so even someone gets a copy they need to know the password to install it. ... View more

If I understand correctly you effectively want to route from the internal interface or the VPN box back round to the external. Not sure if the VPN boxes will like this but if it does the issue could be on the interconnect between the internal network and the external DMZ. It could be a firewall intrusion prevention mechnism is dropping the traffic due to the unusual routing path even though you have rules in place to allow the traffic. We sometimes get this when VPN users are trying to connect to Site to Site VPN locations. ... View more

We use Pulse with a location awareness rule based on a DNS lookup that only resolves the correct address on LAN to automatically connect when the user are out of the office. We use certificate based authentication (and a machine certificate host check) so there is no interaction required by the user. It is not "on-demand" in the sense that is always connects regardless of whether access to the corporate network is needed or not but in reality a domain registered machine always wants to talk to the domain or other corporate resources in the background so it would probably trigger an "on-demand" solution anyway. ... View more

First the obvious questions. Have you tried without the quotes on the expected value? Second are there multiple OUs for the certIssuerDN? If yes then there is a note in the help that it may not authenticate correctly if an attribute has multiple values. ... View more

This will work. We pretty much have the set up you want to do except rather that two SM160's in each Chassis we have one SM160 and and one SM360. The SM160 are one cluster and the SM360's another (both Active/Passive). ... View more

A couple of things I found planning/testing for an upgrade from 7.1 to 7.4 are: 1. If you use custom sign-in pages and have users using iPads there are now separate pages for iPads you also need to customize 2. In the management portal on a role you will see a new option "Junos Pulse" and the "Network Connect" and "IKEv2"  access features are now combined into "VPN Tunneling". It's not obvious in the portal how you use these settings to pick whether to use Network Connect or Pulse but it is explained in the admin guide and the upgrade does set the required settings for existing roles. Doesn't impact the functionality but is worth spending a little time familiarizing yourself with the new settings. ... View more

One thing to note is in your NC policy you are opening the ports in the direction from remote client to internal device. If you want to go the other way you may need to add the source ports the internal device is using. ... View more