About firewall72_

firewall72_ · ‎04-24-2009

Hi, I'm not sure what the issue is, but I would check or try the following: Login to the SA, click on Auth Servers. Click on Administrators. Click on Users tab. Click new, add a username and password for the NSM and save. Click on Admin Realms, Admin Users, Role Mapping. Edit the first rule (i.e. current admin account link) and add the account name just created to the Rule (i.e. If username is "nsm" assign the .Administrators Role and save. Login to the NSM. Add the device. Enter the Device Name and select "Device is not reachable". Select "SA" from the OS Name Menu, Platform, Version, and check/enter the IP of the NSM. Continue by entering the account details (username and password) for the NSM account previously created, then add an additional "First time connect One-Time-Password" password and make a note of the auto-generated device ID. Log back into the SA, click on System, Configuration, DMI Agent. Enable the Agent, enter the IP of the NSM, the Device ID (step 11), and enter the One-Time-Password. Save Changes. Once this is completed, the DMI agent will attempt to contact the NSM. This can take up to one minute. Go back to the NSM, click Devices, Device List Tab, and check for an "Up" status. Once it's UP, you can import the device and start to manage the box using the NSM. If this approach fails or you run into an issue, let me know. I vaguely remember having an issue with one of our four boxes, but I just ripped everything out and went through the above. I hope this helps. -John

firewall72_ · ‎04-24-2009

Hi, I would try the following: Maintenance, Troubleshooting, User Sessions, Policy Tracing and Session recording. This will generate log files and help you identify the issue. System, Log/Monitoring, Client Logs. This will allow you to enable to upload logs for additional analysis. Let me know if this helps. -John

firewall72_ · ‎04-22-2009

Hi, Not sure if it's a bug. I think since the card is a USB, it wasn't present on the system when NC was originally installed. I typically re-install NC when network adapters change or get added and it usually does the trick. If you contact JTAC, they may have more information for you. I'm glad this helped. -John

firewall72_ · ‎04-21-2009

Hi, You can accomplish this by setting up MIP's on your Untrust Firewalls interfaces that would NAT to the Internal IP of the Juniper SA. For example, Corporate SSL VPN traffic would come in off the DS3, hit the public MIP and be NAT'd to the Internal IP assigned to your SA. The special access would come in off the T1, hit the MIP, and be NAT'd to the internal IP assigned to your SA as well. Since no traffic is sourcing from your SA, the return traffic will be managed via the session table on your Firewall. I've seen a similar setup where the customer used two ISP's and terminated the SA in the DMZ. They then created Untrust to DMZ policies and MIPs. Does this help? -John

firewall72_ · ‎04-21-2009

Hi, I've come across this once. Try this: Manually uninstall Network Connect and reboot. Install the 3G USB card Login to the SSL box and launch Network Connect Test and post results -John

firewall72_ · ‎04-20-2009

Hi, I don't think the XML import feature supports single policy deletion. Based on what you said, I would recommend taking a look at the NSM. This now supports the SA boxes and will be used for SSL Management going forward. I've started using our NSM to manage our SA's and have I'm saving a significant amount of time these days by being able to modify a single template and then push the changes down. -John

firewall72_ · ‎04-20-2009

Cool, good luck. -John

firewall72_ · ‎04-20-2009

Hi, Based on what's in the realease notes, it looks like it's related to the GINA and Interactive Logins. I wasn't sure if this was how you have your box setup, so I added it anyway. However, it may not be relevant in your case. -John

firewall72_ · ‎04-20-2009

Hi, I checked the Realease Notes and list of compatible versions for you and it looks like the Windows 64 bit peice should be OK. The only thing that came up in the Release Notes was "Advanced Endpoint Defense: Integrated Malware Protection detection works only in user context mode and in certain situations as described in the documentation". If this doesn't help, I would recommend openeing a ticket with JTAC. As an FYI, bugs are expected in R1's, so this maybe something that is already known to them and they may have a fix. -John

firewall72_ · ‎04-20-2009

Hi, Yes, it does. Go to Network, both "Routes" and "Hosts" are tabs that will assist in adding host entries and static routes. I hope this helps. -John

firewall72_ · ‎04-20-2009

Hi, Ooops! I've done that before, but didn't use AD attributes. I basically pushed out a local .txt file to company machines via the login scripts that identifies the PC as a company asset. I then used Host Checker to make sure the local file existed and that the MD5 was correct. This prevented users from logging in from external macines not part of the domain. That said I'm not sure if Juniper added machine lookup as well. Since there are custom attributes I'm guessing it's possible. However, Juniper recommended this approach a few years back and it may be outdated. Sorry I misunderstood your question. If all else fails, I hope the example above helps. -John

firewall72_ · ‎04-20-2009

Hi Dan, Yes, we've pushed down changes. Both Templates and local configurations have been tested from the NSM. However, we've found some odd issues and have since reported them to JTAC. Specifically, some of the commands/settings become locked in the template and we are forced to make them via the local WebUI, update the template, then sych. I find it very similar to the issues in the begining with some of the Firewalls and NSM. I was told with each update/new version of the NSM code it will become more stable. I hope this helps. Cheers. -John

firewall72_ · ‎04-18-2009

Hi Kevin, We've been running 6.3r2 without issue and also have our SA's integrated into the NSM. However, 6.3R4 has a few cluster related fixes. So I would recommend either upgrading to 6.0r10 or if you're looking to add new features try 6.3R4. Either way, I would be sure to check the release notes for addressed and unresolved issues. I hope this helps. -John

firewall72_ · ‎04-17-2009

Hi, There are two parts to this. First, you will need to setup authentication. This doesn't use groups, but if you leverage AD auth will fail if the user is not a member of your AD or if the password/username is entered wrong. The second peice is related to Role Mapping. You can setup AD Groups and use the SA to query these groups in AD to map specific roles. You can also to configure the SA to only map users to specific roles. This means that even if a member passes auth, he/she won't be permitted access unless he/she is a member of the appropriate AD group(s). Does this help? -John

firewall72_ · ‎04-17-2009

Hi, It's my understandind the Terminal Services approach will always require either a client-side client (i.e. RDP) or plug-in (i.e. Active-X or Java). I don't know of a way around this. I think the reason why you see the Juniper Marketing refer to "clientless" is because the built-in TS option is technically a plug-in. -John

firewall72_ · ‎02-03-2009

Hi' Yep, that was the problem. I found another post with the appropriate files. Thanks.

firewall72_ · ‎02-03-2009

Hi, I've downloaded the latest ProperJavaRDP from Sourceforge, but I get the error below. We're running SA6.3R2. Anyone? Thanks. The uploaded archive does not contain any Java applet code. Please upload a file that contains code for at least one Java applet

firewall72_ · ‎01-08-2009

Hi, There is limited support for Vista 64-bit on most versions of firmware. What version are you running? I would first check your version and take a look at the release notes. -John

firewall72_ · ‎01-06-2009

Hi, I think you would need two AD groups in order to map each specific OWA rule. We have a similar issue and this was the only way we could get this going. However, you could flag a specific AD attribute for users that need the new or old bookmark and setup a role mapping rule to check the attribute. -John

firewall72_ · ‎01-05-2009

Hi Theresa, It sounds like you don't want your users using the Terminal or Web bookmarks without Network Connect, yes? I think you may be able to set your bookmarks to the internal IP and then block re-write. This would force users to be connected via NC in order to connect. Other than that, I'm not sure if what you're looking for is possible. Let me know if I'm in the ball park. -John

firewall72_ · ‎01-02-2009

Hi, I think you need to configure single-signon (see below). I have noticed the same issue, but our users are OK with being prompted for auth. http://kb.pulsesecure.net/index?page=content&id=KB2594&actp=search&searchid=1230931894719 -John

firewall72_ · ‎12-29-2008

Hi, That sounds like a bug to me. I would report this to JTAC and consider an upgrade. -John

firewall72_ · ‎07-14-2008

Hi, I would try the following: - Remove all instances of Network Connect on the PC (Add/Remove Programs). - Reboot - Login to the IVE, click Maintenance, System, Installers - Download Network Connect - Login as Administrator on the PC - Install Network Connect - Reboot This approach has resolved some of our NC issues in the past. Hope this helps. Rgds, John

firewall72_ · ‎07-06-2008

Hi, I don't think you can compare the SSL VPN to the Cisco VPN client. If you want to compare apples to apples, then I would compare the Netscreen Remote Client. You can upgrade the Firmware on the Firewall without upgrading the ScreenOS client (just like Cisco). Rgds, John

firewall72_ · ‎07-03-2008

Hi, The NC and WSAM applications will be upgraded automatically when the client logs in. It's not recommended that you run different versions. Rgds, John

firewall72_ · ‎06-30-2008

Hi, You can add a Split tunneling Network policy (Users, Resource Policies, Network Connect, Split Tunneling Networks) for the desitnation web server. For example, if the WSJ IP was 201.1.2.3, you would add "201.1.2.3/32" as a resource. This would route web traffic to WSJ via the Virtual Adapter/SSL tunnel when Network Connect is enabled. This will allow you to selectively route specific routes via the SSL without disabling split tunneling. If you are using a Network Connect access policy, you will also need to enable this host. Rgds, John

firewall72_ · ‎06-28-2008

Hi, Thanks for the response. Anyone else? I have a client looking to permit company and non company equipment. The requirement is that we check for Virex and Norton. Rgds, John

firewall72_ · ‎06-27-2008

Hello, I've been playing around with Host Checker for our Mac's. The process approach for AV has worked, but it only can detect if the AV process is running. I was wondering what other people were doing with HC for Macintosh. All feedback welcome. Thank you. John

firewall72_ · ‎06-27-2008

Hi, I don't think so. I opened a ticket with JTAC early this year and they said NC and W/JSAM can't run at the same time. We have since remove the auto launch for NC on roles that require W/JSAM. This has worked out well. Rgds, John

firewall72_ · ‎06-18-2008

Excellent, I'm glad you got it working. John

Re: NSM and SSL VPN - can't make them talk

Re: Trouble shooting connection issues

Re: Split tunnel with 3g usb cards

Re: Special Routing configuration

Re: Split tunnel with 3g usb cards

Re: XML Import

Re: Firmware Version

Re: Advanced Malware Protection on 64bit Windows

Re: Advanced Malware Protection on 64bit Windows

Re: does 6500 support routing ?

Re: Check AD group for the host

Re: Firmware Version

Re: Firmware Version

Re: Check AD group for the host

Re: Terminal Server Access on restricted clients

Re: Host Java Applet Issue

Host Java Applet Issue

Re: TCP Loopback Error

Re: Is there a way to assign role if the user is N...

Re: Question re Network Connect exit

Re: Network Connect - IIS with IWA

Re: RDP Problems with IVE 5.5R1

Re: Network Connect cannot create adapter - Win Vi...

Re: NC/WSAM version vs. IVE version

Re: NC/WSAM version vs. IVE version

Re: Cannot pass domain's public IP address to a sp...

Re: Macintosh Host Checker

Macintosh Host Checker

Re: Auto start Network Connect with JSAM/WSAM

Re: Role Mapping