The no downtime upgrade can only be done on Active/Passive clusters because Active/Active clusters are both always recieveing traffic from their upstream load balancer. If you have NSM you can do the upgrade from there. Othewise the procedure is outlined in the FAQ http://kb.pulsesecure.net/InfoCenter/index?page=content&id=KB17017 How do I upgrade a cluster? Answer: If you have central manager, enable all nodes and just upgrade one node of the cluster. After the node upgrades it detects the nodes that run the older version of the software. It instructs them to upgrade as well. If you do not have central manager you should open multiple admin sessions, one for each node in the cluster. Then perform the upgrade by pressing the button almost simultaneously in all the windows. The nodes will upgrade, reboot and rejoin into one cluster. If you upgrade only one node, it will reboot, find the other nodes running an older version of the software, wait for about two minutes and eventually boot as a disabled node. Attempting to enable the node will silently fail with a log message in the events log. To continue, disable all the nodes and then enable the node you have upgraded. Then upgrade each node independently and enable it after upgrade. Central manager license is strongly recommended in particular in clusters with more than two nodes. ... View more

If a user is not mapped to a role, he/she is kicked back to the login page with a message like "You are not allowed to log in". There seem to be hundreds of reasons for this message. In fact, it might be interesting to start a thread to allow people to document what they found when diagnosing it. In our case, the most likely culprit has been the inability of the IVE to assign an address to the NC session. We've seen the following reasons - (1) Exhaustion of an address pool (2) Use of a static address already in use (3) Unmatching configuration between the network NC settings and the NC connection resource policies In this case, there is a message in the user log which confirms this. Hope this is helpful. Ken ... View more

As was already mentioned, you have to create a Split Tunneling policy under Network Connect Resource Policies and then once defined you can just apply to all policies... then just a matter of enabling it on each role in the Options. For an aside in case you're not aware-- enabling Split Tunneling is viewed by most as a major security risk; in most situations you're then allowing the user's computer to act as a bridge to connect your network with another network that you have very little or know knowledge of. It still has its uses depending on your circumstances and may be needed, but I would caution to be very careful about implementing Split Tunneling because it can be a very risky thing to do. ... View more

Did you try uninstalling the components, reboot and have the user install them again? I ran into various NC errors after installing Windows XP service packs. ... View more

Make sure they are not more than 100ms a part, Juniper does not support them if the delay exceeds 100ms and you will have all kinds of issues. ... View more

The steps are in the Administration Guide http://www.juniper.net/techpubs/software/ive/6.x/6.3/ ... View more

Hi Guarav, Refer to admin guide, you can crate admin users by click on Auth Server - Administrators. Then create admin users as you want. ... View more

I am not familiar with the error but in reading the KB - the fix is to be done on the PC side - NOT the SSL VPN. Here is a link to another (non Juniper) forum that talks at length about this problem and gives you some troubleshooting tips in addition to what is shown in the KB. http://www.juniperforum.com/index.php/topic,3005.0.html ... View more

Request a new CSR , renewing does not replace private key.   Once you recieve the new signed certificate, upload it and map the interfaces to use the new certificate, the old certificate is invalid then as it is not tied to any interfaces (external/internal etc)   Thanks, Jay ... View more

Hi Just a quick note if you come accross this from google as i did, a certificate signing request (csr) is not a private key. you should not give the private key to anyone including a certificate authority. /Adam ... View more

Is there a way to capture the config so that it can be imported into an SA running a different version of the OS? I've had to rebuild my SA recently because something happened to the config that meant upgrades failed... I had to reset the config in order to upgrade but then I had no way to import the old config (or bits of it). ... View more

Select the user's role Select UI options for the Role (which is an option under the General tab) Change the welcome message and portal name. ... View more