Thank you for the question.   This type of question is probably better answered via our support team.  We will need client and server logs from your endpoint and PCS appliance.     Please open a case with us and we can get to the bottom of what the issue is.   Thank you.   Craig Brauckmiller Global Escalation Manager Pulse Secure ... View more

Under the user Role.  Select SAM > Options > Enable fail-over to TDI for Pulse SAM connection.  If it is checked, try unchecking and saving the role settings.   Thanks   Craig ... View more

If there is a memory leak as indicated and Pulse Desktop 9.1R8.2 doesn't resolve this, we really do need a support case opened so we can work more closely with you.     What access method are you using?  Pulse Secure Access Manager (PSAM)?  Full Tunnel?  Split Tunnel? Etc.  We'd want to see the output of ProcMon as well as the Pulse Client logs.     If you cannot open a case on-line, you should be able to provide your contact email and Support Contract info when you call into our support center.  The agent can try and validate your account and open a courtesy case.  Failing that, you can mention my name and the agent can contact me internally for permission to open a courtesy case.   Thank you   Craig Brauckmiller Global Escalation Manager Pulse Secure ... View more

Hello, Pulse offers the ue of TDI drivers as a fall back from the WFP driver option.  Windows 7 should support WFP.  Have you checked to see if TDI fall back in enabled?  If so, can you try disabling it and see if the problem resolves itself.     Also, Microsoft has EOL'd WIndows 7 as of January of 2020.  However, they are offering extended support for this OS.  Pulse Secure will continue to support Windows 7 on a best effort basis.     Should you have further questions, I'd recommend opening a case with our support team.   Thank you   Craig Brauckmiller Escalation Manager Pulse Secure ... View more

As previously stated, please upgrade to the 9.11R8.2 Mac Client.   We removed the requirment for Kernel Extentions in this release and this should resolve your issue.   Thank you   Craig Brauckmiller Eastern Region Escalation Manager Pulse Secure ... View more

Hello, can you please open a support case with us?  We'll want to know the following:   OS version running Version of Pulse Client installed Version of the PCS appliance Does the user have admin rights on the local system?   Thank you   Craig Brauckmiller Eastern Region Escalation Manager Pulse Secure ... View more

It is pretty cool, isn't it!   Read up on a couple different ways we do this:   https://docs.pulsesecure.net/WebHelp/PCS/9.1R2/AG/Home.htm#PCS/PCS_AdminGuide_9.1R2/CHAPTER_26_Terminal_Services.htm   Hope this helps!   Thanks   Craig Brauckmiller Pulse Secure ... View more

Mgilan is correct.  Cell networks are not as reliable with IP as one would think.  VPNs are dependent on keep-alive messages going back and forth between the client and VPN server.  If too many of these are lost, the connection witll drop.   When you roam from tower to tower, you may also get a new IP address and this will also break a VPN connection.  Pulse VPN support a roaming mechanism where if the IP address does change, we can perform a quck reconnect, but the odds are good that if you have a stateful session running, it will drop due to the IP address changing on the endpoint.   Thanks   Craig Brauckmiller Pulse Secure. ... View more

Thanks.  As you may or may not know, Pulse Secure was part of Juniper.  As such, I still know a lot of the folks in the SRX support area.  Was hoping to close the loop on this and see what they say.   If the fix is available in later JUNOS releases, this would suggest that the issue was on the SRX all along.   Hopefully, Juniper does have a fix.   Thanks   Craig ... View more

Do you have a Juniper case number?  I'd like to reach out to our contacts there to get to the bottom of this.  Our client hasn't changed with respect to the IPSEC connection to the SRX for a few years now.   Thank you   Craig Brauckmiller Global Escalation Manager Pulse Secure ... View more

For the folks using the Pulse Secure/Juniper clients, are you creating a SRX connection type in the client or are you using Pulse Secure's Policy Secure to provision the connection for you?    Thanks   Craig Brauckmiller Global Escalation Manager Pulse Secure ... View more

I haven't set this up, but in theory, what you can do is create a RADIUS REQUEST ATTRIBUTE policy based on the user-name attribute.  You should be able to use a regular expression in the field to match whatever you want.  Then, you apply that request policy to the specific user realm that has the correct authentication method you desire.    Hope that helps.   Thanks   Craig Brauckmiller Global Escalation Manager ... View more

Adding to the previous comment:  you can use the TCP DUMP feature in PPS to see what data is hitting the wire between PPS and the switch.  We'd need to know if the switch is sending back an error or if PPS is the source of the error.  After auth, you will see the RADIUS Access-Accept and then a COA message going out to the switch.  If the switch NAKs the message, we'd need to know what the reported error in the TCP DUMP shows.    Additionally, you can turn on the RADIUS diagnostics in PPS and collect our logs to see if they give more information as to the reason of the failure.   Thanks   Craig Brauckmiller Pulse Secure ... View more

In addition to what Brian pointed out, Orca or any other utility to modify the Pulse Client MSIs is not supported.  We don't qualify that method as part of our release QA process and therefore cannot guarantee its functionality.   Thanks   Craig Brauckmiller Pulse Secure ... View more

Yes, in fact, RSPAN is only available on the external port...so you will need to enable the EXTERNAL port on PPS in order to use that feature.  When you create the profiler authentication server, the option for DHCP Sniffing mode has a drop down.  You can choose RSPAN there.   Hope this helps   Thanks   Craig ... View more

Hi, this issue looks to be more indepth than what is normally handled on a web forum.    Can you open a case with our Customer Success team and work it from there.  If there were any type of bugs / issues that are determined, a support case is needed to file a report with our developer team.   Please provide the agent with the specific version of Pulse Client you are using as well as the OS and Citrix versions in play.   Thanks   Craig Brauckmiller Escalation Manager Pulse Secure ... View more

Profiler can detect MAC spoofing if the device profile changes.   In your example, if an attacker used his laptop to spoof the MAC of a printer, Profiler would detect this due to the fact that the OS changed or the DHCP fingerprint changed or other profilable data had changed.    Refer to https://www.pulsesecure.net/download/techpubs/current/1468/pulse-policy-secure/pps/9.0rx/ps-pps-9.0r3-profiler-administration-guide.pdf   Go to Page 20 under the Access Control heading for more information.   Thanks   Craig Brauckmiller Escalation Manager Pulse Secure ... View more

Hello, I'm not sure that I understand your question.   If your assertion that server #2 would never see the traffic as that config is a "primary / backup" config, than this is an issue that would need to be taken up with the switch vendor.   If the switch cannot send data to multiple helpers simultaneously, you can look into using Profiler's SPAN/RSPAN support instead.  This would allow PPS/Profiler to be on a SPAN/RSPAN port and we'd see all of the traffic on that SPAN/RSPAN port.   Hope that helps   Thanks   Craig Brauckmiller Escalation Manager Pulse Secure ... View more

You should probably open a support ticket on this issue.  It is somewhat complicated to describe in a forum post.   Thanks   Craig Brauckmiller ... View more

I can't speak to pricing, but there are three ways you can license a physical box. 1.  Perpetual licenses (lifetime of the box).  The keys are tied to the hardware and cannot be transferred. 2.  Subscription licenses that expire after 1, 2 or 3 years. 3.  Local license server that passes out seat licenses out of a large pool of seats.  This is useful in large environments when you want to redistribute your seat counts between your appliances.   For an overvew of licensing, read through this: https://www.pulsesecure.net/download/techpubs/current/1224/pulse-policy-secure/pps/9.0rx/ps-pcs-pps-9.0r1-license-mgmt.pdf ... View more

Ok, there is no single answer for this.   A couple questions: 1.  What type of clients are connecting to PPS?  Pulse Client, Native 802.1X supplicant, Web Browser? 2.  What is the primary use for PPS? 3.  Are you going to use a local license server or leverage PCLS (for virtual instances)?   The answers will inform my answers.   Thanks   Craig Brauckmiller Escalation Manager Pulse Secure ... View more

Hello, Peter.  Thank you for the questions and post.   1.  No, the TACACS+ process is part of the radius executable file and thus cannot be launched separately.  The SBR server will accept inbound RADIUS traffic and will attempt process it.  If nothing is configured, SBR will simply ignore the traffic since no RADIUS clients have been defined.   2.  See answer #1   Hope this helps.   Thanks   Craig Brauckmiller Pulse Secure ... View more

Take a packet capture and look at the RADIUS attributes that are sent from the WLC.   Some WLCs will use Called-Station-ID.  Others, like Aruba, use a VSA called "Aruba-ESSID".   Once you know which attribute the SSID is sent in, you can then create a RADIUS Request Attribute policy to select the correct realm or use it for role mapping rules.   Hope this helps   Thanks   Craig ... View more

A few questions:   1.  What version of MAC OS X? 2.  What version of Pulse Desktop Client? 3.  How are you installing it?  Installer or from a PPS/PCS appliance web login? 4.  Was Pulse Desktop previously installed? 5.  What command are you using to install the new connection set?   Thank you   Craig Brauckmiller Pulse Secure ... View more

The URL for the KB is: https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB43600     Thanks   Craig ... View more

Hello, looking at the ESAP release notes, we only support Kaspersky Internet Security 18.x.  The 2018 version is not listed.  If you need this supported, please open a case with our Customer Success group and we can place the request with our developers to get the product added.   Also, are you using the Pulse Secure desktop client?  If so, what version of that client are you running?   if you are seeing failures for all hostchecker polices related to anti-virus and firewalls, it is possible you are running into the issue described here : https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB43600Thank youCraig BrauckmillerSr. Escalation EngineerPulse Secure, LLC ... View more