- Pulse Secure Community
- :
- About dcvers_
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
since
10-29-2017
10-29-2017
dcvers_
Regular Contributor
196
Posts
1
Kudos
11
Solutions
03-03-2009
07:54:AM
If you configure WSAM to tunnel traffic from the browser application you can then use resource policies to control what they access. Of course if they use a different browser they could still get to the Internet without passing through the VPN box. Alternatively you could configure it with an allowed server * and ports 80, 443 which would force all http, https traffic down the tunnel but this might break other things.
... View more
02-03-2009
04:53:AM
If you are using WSAM then you cannot access DFS file shares. Here's a what is says in he release notes from 6.3: "In Release 5.2, Juniper investigated support for DFS File Sharing through WSAM. However, we have identified that the system needs to trigger Domain Authentication via ICMP/Kerberos, and this functionality is currently not supported. Once Domain Authentication is fully supported through WSAM, there is a high probability Juniper can make DFS File sharing work. There is no ETA at the moment for supporting Domain Authentication. (30587)" As a workaround you can use the File access method to access the DFS shares.
... View more
01-30-2009
08:22:AM
Try using a tool like the freeware TDImon to determine which processes are sending the network traffic. Run it when not connected via WSAM to see a normal connection. Also you can run it when connected with WSAM to confirm everything is going through WSAM. It should also be noted that WSAM has a list of bypass appications which it won't process. There is a default set and you can add you own. The default ones are list in a config file somewhere on the client machine (can't remember where). Having said this using allowed servers usually gets round this list.
... View more
01-29-2009
06:10:AM
Resource policies for different roles are combined into a session policy for the user. Double check that another role is not also being mapped for the users and granting the additional access.
... View more
01-21-2009
02:09:AM
Try the net use command with the user name set to %USERNAME%: net use X: \\server\share /user:%USERNAME% /persistent:no
... View more
01-08-2009
09:06:AM
Kerberos does work with Network Connect. Make sure you include a policy that allows: 88 udp/tcp, 53 udp/tcp and I think you also need LDAP 389 udp. If this doesn't work try forcing Kerberos to use TCP as described here http://support.microsoft.com/kb/244474
... View more
12-09-2008
04:51:AM
I can terminate the process manually. After further investigation the problems seems to be the process is a service. Host Checker does seem to be able to terminate "program" processes but it fails when it is a service.
... View more
12-01-2008
09:12:AM
I don't think you can import a configuration from an older release. What you would need to do is downgrade to the older release, import the configuration and then upgrade.
... View more
11-27-2008
07:56:AM
Has any one had any success using the Kill Process Host Checker remediation option? IÕm trying to configure a host check that will kill the Bonjour mDNSResponder.exe process that breaks Network Connect. IÕve set up the host check as normally and selected the Kill Processes option but Host Checker is not killing the process. I have tried having the Host Check set to EvaluateÓ and Require and EnforceÓ on the realm both without success. The logs show the check is evaluating correctly and when set to Require and EnforceÓ access to the realm is blocked. Any ideas what IÕm missing? Running Version 6.1R2-1 (build 13103)
... View more
09-19-2008
03:12:AM
One of our users is gettting a "Page cannot be displayed" error after login. The URIL in the IE address box is: http:///dana/home/index.cfg There are no errors in the logs and a policy trace shows the roles are getting mapped correctly and the session is starting. Anyone else seen this? We are running 6.1R2-1 (build 13103).
... View more
09-15-2008
03:26:AM
I tried for several months to get Kerberos and SMS to work with WSAM but was not successful. The problem we found was that is DNS SRV requests where not being forwarded by WSAM. There was also a Connectionless LDAP (CLDAP) request that was not being forwarded by WSAM. The really annoying thing is Kerberos itself does work via WSAM but it can't get started because of the DNS issue.
... View more
08-19-2008
08:00:AM
We have user reporting the same problem. It only seems to affect users in two out of our 4 domains. We have ticket open with Juniper but so far no solution
... View more
06-26-2008
08:29:AM
What version are you using. Host Checker not detecting processes running as SYSTEM is a bug that appeared in 6.1R1 and was fixed in 6.1R2.1.
... View more
04-17-2008
10:11:AM
Has anyone tried installing 6.1R2? I'm trying to upgrade out test appliance ( SA-2000) from 6.1R1 but the upload keeps failing after about 2%. I've confirmed the checksum is okay so the package didn't get corruprted during the download. I've only briefly tested with 6.1R1 so can't give much feedback. There is a bug in Host Checker that prevents limited rights users seeing processes running as SYSTEM that is supposed to be fixed in 6.1R2 (JTAC told me the same bug was also in the 6.0 stream and fixed in a recent release)
... View more
04-02-2008
04:50:AM
In the knowledge base there is an article about Cluster Licensing (KB9664). Included is following picture. In this situation what is the maximum number of concurrent users on the cluster? Is it 50 or 50+50=100?
... View more
03-27-2008
04:04:AM
I raise a trouble ticket with JTAC about the issue with Host Checker not detecting the processes and they told me this is a know issue fixed in 6.1R2 (and 6.0R4)
... View more
03-26-2008
06:34:AM
Just testing 6.1R1 and got the same issue. After further investigation I discovered the problem is a new option "Send reason strings" in the Remediation section of the host checks. If this is enabled and any of the rules in the check fails Host Checker displayed the remediation page even if the rules are not required. Unchecking the option fixes the issue. While it is annoying this option is checked by default after upgrading more concerning is that the Reason String displays the full details of the check. If we hadn't had issues we may have not noticed that the remediation page was now giving full details of our host checker requirements rather than our custom message to call the helpdesk. Unfortunately now that I have got passed this issue I have discovered Host Checker no longer seems able to detect processes running as SYSTEM user when the local user doesn't have admin rights. This is definitely working on 5.3R5.3. We are running the Installer service and I've also tried manually installing Host Checker as an Administrator.
... View more
01-10-2008
03:45:AM
A number of users have started reporting getting a Window message box with the following text while using our SSL VPN (5.3R5.3) "You cannot run this process as a standalone application" The box title is blank and there is only an OK button. Personally I have seen this when doing some testing with Host Checker (at the time I ignored it as I was dliverately killing Host Checker to see what error messages it threw up). I've tried various search engines but get no results whatsoever. Anyone else seen this or have any ideas?
... View more
12-17-2007
04:58:AM
I've just upgraded our test applinace to 6.0R3 (build 12359) and I am now having the following problems with Host Checker: 1. Access to a realm is being denied due to failing of an Evaluate only Host Check (the check is only used for a role mapping) 2. Access to a realm is being denied due when any one of the rules in OR'ed in a custom expression fails (e.g. 'ePO AND (McAfee OR McAfeeV7)') I rolled back the appliance to the previous version - 5.3R5.3 (build 11159) - and the problem immediately disappear. Update - Just tried installing 5.5R4 (build 12129) and Host Checker works correctly. Message Edited by dcvers on 12-17-2007 01:49 PM
... View more
11-16-2007
10:23:AM
Make sure the host check is set to "Evaluate" on the Realm. Without this the result is not available. Tip: Depending on which release you are using make sure the "Send reason strings" option is unchecked on the Host Check otherwise you will get the remediation screen if a user who fails the check connects to the realm even though you're not requiring it on the realm.
... View more
11-16-2007
08:45:AM
We did have a concern about a big increase in concurrent connections when we first switched from Network Connect via a web page login. In the end the jump in peak usage doesn't seem to have been that big but it's difficult to put a figure on it because we rolled out over a period on months and year on year there has been a steady increase anyway in usage. It is definitely something you should think about though and the smaller your license the more likely the impact will be significant. Things to consider are who are the people not regularly connecting and when might they connecting their laptops to the internet. If your peak is during the day but most of your laptop users are normally in the office during business hours then the impact will be less (we did notice the off peak usage went up but this didn't impact the licensing)
... View more
11-16-2007
08:31:AM
If someone can get a copy of the certificate including the private key and install it then effectively the certificate is worthless as an authentication mechanism. Ideally you want the certificate to be requested by the machine directly so the private key is generated on and only ever exists on the authorized machines keystore. If you need to generate the key and csr manually then you need to ensure the key it is protected by a strong password so even someone gets a copy they need to know the password to install it.
... View more
11-16-2007
08:09:AM
If I understand correctly you effectively want to route from the internal interface or the VPN box back round to the external. Not sure if the VPN boxes will like this but if it does the issue could be on the interconnect between the internal network and the external DMZ. It could be a firewall intrusion prevention mechnism is dropping the traffic due to the unusual routing path even though you have rules in place to allow the traffic. We sometimes get this when VPN users are trying to connect to Site to Site VPN locations.
... View more
11-16-2007
07:59:AM
I am doing some testing with Pulse as preparation for an upgrade from 7.1R10 to 7.4R4. In 7.1R10 if I login via a web page Pulse gets installed and the full Pulse Connection configuration associated with her role gets pulled down in appears in the connstore.dat file as configuration with a connection-source of "preconfig". If I do the same in 7.4R4 a get a configuration with connection-source of "dynamic" that just has the uri (the "friendly-name" is also just the URL). In particular it is missing the connection-policy setting used to enable location awareness. I've tried using the Pulse Connections converted from 7.1R10 by the upgrade and creating a new one after the upgrade with various options but I never get a location awareness enabled configuration pushed to the client. A lot seems to have change between the two versions on the Pulse/NC side so maybe I'm missing something. How do I get a location awareness enabled configuration to automatically download to the clients?
... View more
11-16-2007
07:40:AM
We use Pulse with a location awareness rule based on a DNS lookup that only resolves the correct address on LAN to automatically connect when the user are out of the office. We use certificate based authentication (and a machine certificate host check) so there is no interaction required by the user. It is not "on-demand" in the sense that is always connects regardless of whether access to the corporate network is needed or not but in reality a domain registered machine always wants to talk to the domain or other corporate resources in the background so it would probably trigger an "on-demand" solution anyway.
... View more
11-16-2007
07:03:AM
First the obvious questions. Have you tried without the quotes on the expected value? Second are there multiple OUs for the certIssuerDN? If yes then there is a note in the help that it may not authenticate correctly if an attribute has multiple values.
... View more
11-16-2007
06:54:AM
This will work. We pretty much have the set up you want to do except rather that two SM160's in each Chassis we have one SM160 and and one SM360. The SM160 are one cluster and the SM360's another (both Active/Passive).
... View more
11-16-2007
06:31:AM
A couple of things I found planning/testing for an upgrade from 7.1 to 7.4 are: 1. If you use custom sign-in pages and have users using iPads there are now separate pages for iPads you also need to customize 2. In the management portal on a role you will see a new option "Junos Pulse" and the "Network Connect" and "IKEv2" access features are now combined into "VPN Tunneling". It's not obvious in the portal how you use these settings to pick whether to use Network Connect or Pulse but it is explained in the admin guide and the upgrade does set the required settings for existing roles. Doesn't impact the functionality but is worth spending a little time familiarizing yourself with the new settings.
... View more
11-16-2007
06:04:AM
Looking at a policy trace I am seeing messages saying: "Start Policy [WEBURL/WEBPDSID] evaluation for resource ..." immediately followed by a "No Policy configured " message Anyone know which polices this refers to? My trace is only tracking Web Access policies. 6.1R7 (build 13915)
... View more
11-16-2007
06:04:AM
One thing to note is in your NC policy you are opening the ports in the direction from remote client to internal device. If you want to go the other way you may need to add the source ports the internal device is using.
... View more
- « Previous
- Next »
Latest Tags
No tags yet
© 2017 Pulse Secure, LLC. Use of this website assumes acceptance of our Legal Notices and Privacy Policy.
Pulse Secure has updated its Privacy Policy effective June 28, 2017.
