- Pulse Secure Community
- :
- About MattS_
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
since
10-29-2017
10-29-2017
MattS_
Frequent Contributor
83
Posts
0
Kudos
9
Solutions
04-18-2012
06:42:AM
I understand the frustration, I will try and give an overview of how Juniper gets products into the ESAP package used by Host Checker as that it is something we do not directly control. The ESAP packages used on the SA uses the OESIS framework which is supplied by OPSWAT (http://www.opswat.com/products/oesis-framework). OPSWAT are an industry leader for this technology and they work with the multitude of vendors and their security products. When a Juniper customer reports that a product/version is not included in the current ESAP we have them collect data from the OESIS Diagnose tool on one of their client PCs, then a ticket is opened with OPSWAT requesting support be added to a future OESIS SDK. They need to analyze and code how they will get the various states from the product that need to be reported, using the vendor's APIs where possible. Once OPSWAT release that Juniper can then create a new ESAP package with it. At each step there needs to be testing and verification and there can be delays for various reasons, which is why it is recommended to request the software vendor become certified with OPSWAT (http://www.opswat.com/certified) so that they collaborate with them to help reduce the turnaround time for inclusion of products/versions and enhance what can be offered via Host Checker (http://www.opswat.com/certified/partners/why-certification-matters). You can see the OPSWAT release messages at https://portal.opswat.com/blog/ For the Avast 7.0, it was included in OESIS Framework 3.5.771.2 (https://portal.opswat.com/blog/oesis-framework-357712-released) which was released on March 19th. Juniper posted ESAP 2-1-3 publically to http://www.juniper.net/support/products/esap/#sw on March 29th. Usually Juniper makes an Early Access (EA) version up to a week before it is officially released on the Support site, these are made available for testing purposes to customers who reported issues/missing products which are resolved in that release to confirm that the fix is working with no errant behaviour. If there are no reports of problems with an EA release then it is posted to the public site.
... View more
02-29-2012
05:03:AM
Is the Active SA responding to the requests to the VIP address? Are there any routes on the SA that might effect the communication?
... View more
02-29-2012
02:37:AM
If you have an A/P cluster configured with a VIP address, can you ping and connect to the VIP IP from the internal network, i.e. avoiding the NAT? If that works OK, can you ping through the NAT address to the VIP? It might be that another device is configured for the VIP address so the connections are not arriving at the SA. TCPdumping on the Active member should show is any traffic is arriving and what the SA is responding with.
... View more
02-17-2012
01:21:AM
The X-Forwarded-For entry should be used automatically: From p.829 of the 7.1 Admin Guide: "When a Juniper Networks DX appliance or similar load balancer is deployed in front of the SA Series Appliance in proxy mode, the real client IP address can be preserved in a DX custom HTTP header and passed to the SA Series Appliance. This real client IP address can be recorded within the SA Series ApplianceÕs logs when a user logs into the SA (or a user roams), allowing you to audit and report on the username/real source IP pair using the SA Series Appliance logs. Chapter 31: Logging and Monitoring The remainder of this topic refers to Juniper NetworksÕ DX appliance. See your load balancerÕs documentation for information on sending an X-Forwarded-ForÓ log header. The real source IP address is retrieved from the DX custom header when a user logs in and is placed into the session record. The real source IP address is used in place of the DX IP address in the event, user, admin, and sensors log if it is present in the context data. Otherwise, the source IP address in the context data is used."
... View more
01-06-2012
02:31:AM
I've found out that these are indeed internal test certificates and it is being tracked as a bug, they will be removed in a future release.
... View more
01-05-2012
05:51:AM
Is the Juniper Installer Service (JIS) installed for the non-admin account? As it works for Admins it sounds like a permission problem and Host Checker has failed to install/access some components to detect the Real Time Protection. If you uninstall Host Checker, install JIS as an admin and then connect does HC get re-installed and the HC policy pass? See p.704 of the Admin Guide for details on JIS. If it is still failing with JIS then client-side logs will need to be inspected to find out what is the problem, which would be better handled ina TAC case.
... View more
01-04-2012
07:21:AM
I had a search but could not find any reference to these, I assume they are used during the development and testing of various features where SSL connections are made to internal servers and have been left in the production build so the test suites can be used on the production releases without having to import the necessary CAs. If you are planning to delete them I would recommend taking a backup of them first, just in case, by exporting the configuration.
... View more
01-04-2012
07:06:AM
Is 192.168.5.200 the external or internal interface IP on the SA? Do you have a one-armed (only internal i/f configured) or two-armed (internal and external i/f with SA sitting between the networks) set-up? Is 192.168.20.0/24 and 192.168.21.0/24 reachable from the internal interface? Can you ping the hosts from the SA? What access method you want to configure on the SA to allow the RDP connection through to the back-end server? You can create a Terminal Services Resource Profile and have the option to use an RDP applet instead of a locally installed RDP client to make the RDP connection - see http://kb.pulsesecure.net/InfoCenter/index?page=content&id=KB16835 for example. Chapter 24 p.561 of the Admin Guide has more details on this. You could also use Network Connect/Pulse or SAM to allow the traffic for the RDP port to pass and use an RDP client on the local PC.
... View more
01-04-2012
06:40:AM
For ESET Smart Security 5.x , it has been requested by a customer and OPSWAT have informed us that they are attempting to validate and include support for it in ESAP 1.8.3 which is expected to be released in February 2012. Until the support for ESET 5.x is added, as a workaround you can create your own custom Host Checker policy to detect the ESET application, please review http://kb.pulsesecure.net/KB22348 To generate the Oesis diagnostic log file, you can also download the tool from the OPSWAT site: * go to http://www.opswat.com/products/oesis-framework * download the OESIS Diagnostic Tool (http://c3384790.r90.cf0.rackcdn.com/OESIS-Diagnose/OESIS-Diagnose.zip) * extract the files to the Host Checker directory (C:\Documents and Settings\<USER NAME>\Application Data\Juniper Networks\Host Checker for XP; C:\Users\<USER NAME>\AppData\Roaming\Juniper Networks\Host Checker\ for Win7) * run the OesisDiagnose executable. This will generate a log file in the same directory.
... View more
01-04-2012
05:14:AM
You are correct, to access the laptop you would use RDP via the SA device. Virtual desktop is used on the SA when the client is connecting to a virtual computer provisioned on a server (Citrix Xendesktop, VM).
... View more
01-02-2012
07:41:AM
The client-side logs referred to by Kita will have a lot of low level details about the client-side components, there are logs on the SA at System > Log/Monitoring which are worth checking first as it will be a more general entry about the disconnect reason. Search for the user's username in the User Access logs to find the disconnect reason as reported by the SA and also check the Event log around the disconnect period in case anything at a system level is causing disconnects. If those do not show the reason then client-side logs will help in finding out what is happening from the client's perspective.
... View more
01-02-2012
06:06:AM
Have you tried using Split Tunneling for Network Connect, so only the traffic for the internal example.com hosts are tunneled? "When split-tunneling is used, Network Connect modifies routes on clients so that traffic meant for the corporate intranet networks to Network Connect and all other traffic goes through the local physical adapter.The SA Series Appliance tries to resolve all DNS requests through the physical adapter first and then routes those that fail to the Network Connect adapter." (From ch. 27, p.666 of the Admin Guide). Another possibility is to use start and end scripts to add/remove host file entries on the client to override DNS. This could lead to problems if NC is not stopped correctly and the end script is not ran, as the modified hosts file would remain in place while the NC tunnel is not up.
... View more
01-02-2012
05:40:AM
Virtual Desktops are dynamically provisioned with Citrix XenDesktop or VMWare View Manager providing the desktop resource for the user. Remote Desktop is where RDP is used to connect to a physical or virtual server which has a static IP Address. So if you have Xendesktop or VMWare View Manager, look at configuring Virtual Desktops on the SA under Resource Profiles > Virtual Desktops (Chapter 6 in Admin Guide); for access using an RDP client to a specific server use Resource Profiles > Terminal Services (Chapter 24 in Admin Guide).
... View more
12-28-2011
03:01:AM
http://kb.pulsesecure.net/KB9122 has a guide to various things to check - do you have a resource policy that includes the 9300 port access? Changing the caching policy for the URLs of the images might also help. If tweaking the configuration does not display the images correctly, then follow http://www.juniper.net/techpubs/software/ive/guides/troubleshooting/RewriteTroubleshootingandLogCollection.pdf on what to collect for a TAC case. The Session recording (Maintenance > Troubleshooting > User Sessions > Session Recording) will have the HTTP requests and responses from both sides of the SA so you can inspect what the SA is doing with the image URLs and content, it can be hard to follow so if it does not make sense to you then please open a TAC case and they can explain what is happening in the session.
... View more
12-28-2011
02:45:AM
As the DNS server is added I guess that Auto-allow IP's in DNS/WINS settings (only for split-tunnel enabled mode)'' is enabled, do you have a Split Tunneling Policy defined for the Role (Users > Resource Policies > Network Connect > Split-Tunneling Policies)? Another potential cause is that another application is preventing the route table changes but as the DNS entry is added I doubt that is the solution.
... View more
12-22-2011
08:11:AM
The Content Intermediation Engine Best Practices document (http://www.juniper.net/techpubs/software/ive/admin/j-sa-sslvpn-7.1-ciebestpractices.pdf) covers what is and isn't supported using javascript, Flash etc. If the content cannot be re-written correctly using Core Access then other access methods should be tried - Passthrough Proxy, SAM or NC//Pulse.
... View more
11-07-2011
02:13:AM
Is the client's IP address changing? If it is you can enable Roaming on the Role (Users > Roles > RoleName > General > Session Options) to allow the connection to continue across source IP changes.
... View more
11-07-2011
02:03:AM
You can use role-mapping to assign different roles for MAC and Windows users authenticating against the same realm and on the Windows role you can enable the Host Checker which would check for the AV software status. At the Realm level you can use a HC that detects Windows OS, so all clients passing this can be mapped using Custom Expression in the Role Mapping to the Windows Role. To detect MAC clients, you can use either a HC policy that checks for a specific port, process or file on the MAC or test the User-Agent string sent by the browser (which could be faked by Windows users attempting to by-pass the restriction on Windows users to have an up-to-date AV.) and use those results in the Role Mapping for MAC users. See the HC Guide for more details on configuring Host Checker.
... View more
09-30-2011
02:10:AM
You might be affected by the problem discussed in KB21656 - see if disabling the QoS packet scheduler on the physical adaptor works around the problem.
... View more
09-27-2011
05:48:AM
Hi, You will need to talk to the SA admin as the Host Checker is probably searching for Windows-specific components. If they agree to allow Linux to connect with Network Connect to the network they should configure the SA to allow it, the HC for Linux can check Ports, Processes and Files while HC for Windows has many more checks it can perform. From http://www.juniper.net/techpubs/software/ive/admin/6.5-IVEAdminGuide.pdf "NOTE: You must explicitly create policies for each operating system you want to allow. For example, if you create a Windows Host Checker policy, but don't create one for Mac or Linux, users who sign into the IVE from a Mac or Linux machine will not comply with the Host Checker policy and therefore will not be able to access the realm, role, or resource on which you enforce Host Checker." Also: "NOTE: On Linux systems, Host Checker is not supported when launching Network Connect through ncsvc." Check http://www.juniper.net/techpubs/software/ive/releasenotes/SA-SupportedPlatforms-65.pdf to see what are the Supported Platforms for the 6.5 version the SA you are connecting to is running. If there is difficulty getting NC to connect they could try enabling JSAM access for Linux.
... View more
09-27-2011
05:29:AM
The Hostname field in the Network Identity section of System > Network > Overview is the aplliances fully-qualified hostname. The cluster configuration is under System > Clustering
... View more
09-19-2011
06:15:AM
The way the value is calculated in 7.x was changed - see http://kb.pulsesecure.net/InfoCenter/index?page=content&id=KB21434
... View more
09-19-2011
04:40:AM
If the license server becomes unavailable you cannot manage the license allocations on the client devices, the license allocations remain and the client devices operate as expected. There is no HA for the license server - if it becomes unreachable there is a 5 day grace period (I believe increased to 10 days in 7.1R2 onwards) when the devices will continue to run with their leased licenses. The auto-leasing feature works when the license server is unavailable so the devices can increase their license counts (see http://www.juniper.net/techpubs/software/ive/guides/j-sa-sslvpn-7.1-licensemgmt.pdf). A spare device can be used as a replacement license server and the configs from the failed license server loaded if the license server needs to be back on-line before an RMA of the failed device can be completed.
... View more
09-15-2011
02:55:AM
Devices in the cluster will synchronize their settings, there is no default way to automate synchronization with devices outside the cluster. What you can use is the Push Config feature (Maintenance -> Push Config) , which will allow you to trigger sending the whole or partial configuration from one SA to others. Please read p.796 onwards in http://www.juniper.net/techpubs/software/ive/admin/j-sa-sslvpn-7.1-adminguide.pdf for more details. To automate the sync would require scripting - for example set up automated archiving of the XML config (Maintenance -> Archiving) and then use DMI (http://www.juniper.net/techpubs/software/ive/guides/j-sa-sslvpn-7.1-dmiguide.pdf) to edit the config on the SAs that needs the new configuration.
... View more
09-14-2011
08:21:AM
With clustering, you can do either Active-Active (which needs a load balancer) or Active-Passive (which uses a floating VIP). As the units are not in the same site it is not recommended to cluster them unless you have a LAN-like connection between them. If you do not wish to use a load balancer and want to use both units active with different sign-in URLs per SA4500 you can run them as stand-alone units. This would not allow the units to 'share' the license's total user count across the two as they are not clustered which would mean they can only accept the user count they are individually licensed for.
... View more
09-14-2011
07:49:AM
Hi, PTP is not required but see http://kb.pulsesecure.net/InfoCenter/index?page=content&id=KB20085 for what is and isn't supported through the rewiter for 7.1R1 and later.
... View more
09-14-2011
07:26:AM
If you select Evaluate Host Checker at the Realm level the remediation screen will not be displayed as HC policies are not enforced, so non-compliance would not cause remediation" "EvaluatePoliciesÑEvaluates without enforcing the policy on the client and allows user-access. This option does not require Host Checker to be installed during the evaluation process; however, Host Checker is installed once the use signs in to Secure Access. RequireandEnforceÑRequiresandenforcesthepolicyontheclientinorderf the user to log in to the specified realm. Requires that Host Checker is running the specified Host Checker policies in order for the user to meet the access requirement. Requires Secure Access to download Host Checker to the client machine.IfyouchoosethisoptionforarealmÕsauthenticationpolicy,thenSecu Access downloads Host Checker to the client machine after the user is authenticatedandbeforetheuserismappedtoanyrolesinthesystem.Selectin this option automatically enables the Evaluate Policies option." You can enable the HC at the Role level (Users>User Roles>SelectRole>General>Restrictions>HostChecker) which will allow users to authenticate before HC runs: "RoleÑWhenSecureAccessdeterminesthelistofeligiblerolestowhichitcanmapan administratororuser,itevaluateseachroleÕsrestrictionstodetermineiftherolerequires that the userÕs computer adheres to certain Host Checker policies. If it does and the user's computer does not follow the specified Host Checker policies, then Secure Access does not map the user to that role unless you configure remediation actions to help the user bring his computer into compliance. You can configure role-mapping using settings in the Users > User Realms > SelectRealm > Role Mapping page. You can configure role-level restrictions through the Administrators > Admin Roles > SelectRole > General > Restrictions > Host Checker page of the admin console or the Users > User Roles> SelectRole > General > Restrictions > Host Checker page. If you have enabled Advanced Endpoint Defense Malware Protection, you can select to implement this feature for any role." [edit: formatting due to cut and paste from PDF http://www.juniper.net/techpubs/software/ive/admin/j-sa-sslvpn-7.1-adminguide.pdf - HC is chapter 13, p.289 onwards]
... View more
09-07-2011
05:33:AM
Hi, Have you updated the ESAP package which you can get from https://www.juniper.net/support/products/esap/ ? This contains the 3rd party applications you can use Host Checker to test for, the ESAP 1.7.4 Release Notes show "[McAfee] McAfee VirusScan 15.x" was aded in that version. Once this version or later is loaded you should see VirusScan 15.x in the McAffee section when you create a new Predefined Antivirus HC Policy. The epudate file contains the anti-virus definitions so you can check if the AV product on the client has updated it's definitions.
... View more
09-02-2011
05:49:AM
Under Authentication > Signing In > Sign-In Policies there is a check-box to enable/disable 'Display open user session[s] warning notification'. Underneath is also a radio button 'Select when to display a notification page to users' which can toggle between 'Always' and 'If the maximum session limit per user for the realm has been reached '
... View more
06-06-2011
07:18:AM
The MAG devices/blades run the SA software which has the usual GUI format. The J-Web GUI you saw is probably for the optional management module MAG-CM060 which runs Junos - see http://www.juniper.net/techpubs/software/mag/guides/j-pulse-gateway-cmc-admin-guide.pdf - and can be installed in a MAG6610 or MAG6611 chassis slot.
... View more
Latest Tags
No tags yet
© 2017 Pulse Secure, LLC. Use of this website assumes acceptance of our Legal Notices and Privacy Policy.
Pulse Secure has updated its Privacy Policy effective June 28, 2017.
