It gets stranger. I changed the role/VPN tunneling config to use Default/Default for JP Config/Conn Set (VPN tunneling option still unchecked in role) and it works just fine and creates the right URL. I duplicate the exact JP Config/Conn Set with custom name and same URL ect. and it fails. ... View more

The connection that populates on the client just says vpn.domain.com for the URL and the Name.It says nothing else. I've checked both in the IVE. I even went into the JP connection config on the IVE and changed the connection Name to something unique like "JP WSAM" and deleted all client connections in Windows. Logged back on to the site, it re-creates the connection in the JP client as vpn.domain.com. No https:// in the URL at all and just sits there trying to connect. If I turn off "deliver via Junos Pulse" the legacy WSAM launches and connects just fine. Also, if I assign a role with full VPN tunneling, it works fine as well. ... View more

I looked at that, and defined it as https://... but it still does it without on the client. Anyways, I thought that part of the config really only applied if you have full VPN Tunneling enabled? ... View more

Yes, we are concerned about key loggers. So, while users do technically have a password in AD, we only are allowing remote users to access with RSA token. However, even with Kerberos SSO, it still asks for the user's password.   Bottom line is, we do not want users putting in their password on an unmanaged machine. ... View more

@zanyterp wrote: have you followed the sample outline on the support site? do you have any/all servers that should be used for the constrained delegation configured successfully? No offense, but this was pretty unhelpful. Maybe you could throw a bone (aka a hyperlink) to a pretty frustrated fellow? I;'ve been searching on this and trying to familiarize myself with kerberos more and the IVE's configuration of it, without much success.   JTAC was not very helpful either other than to say "maybe it can be done with contrained delegation."   ... View more

Ok, I am very unexperienced with Kerberos. Can you elaborate? I really want this to work for OWA with RSA.   RSA is using LDAP for username. ... View more

@kita wrote: This is a reported issue which will be fixed in Pulse for Desktop 3.0R3. This should be released within a few days. Any word on when the fix will be released? ... View more

Junos Pulse suffers none of the absurdly annoying connection problems with the secure gateway that NC has always had, even though it uses the NC back-end. Plus it looks nicer. I like it. So do my clients. ... View more

Let me know if you get an answer to this. I'm looking for a similar solution. ... View more

@bullyrag wrote: I tried the custom page today but it loads with errors and now appears to be out of date. Do you have an update. This was on 2/2/2011. Thanks Not sure. I know when I uploaded the iOS custom page it said it was outdated, but it still works with the iPad and iPhone. However I am now getting reports that my users are getting lots of timeout errors and can't connect at remote locations. When they are here at HQ on the wifi (separated conference room network) it works fine, but that's still physically in the same location as the SA. It's becoming annoying with the calls, especially since they are testers. But you know how VP's are... ... View more

I uploaded the custom sign on page for Apple iOS and now it connects. Noticed a couple of things though: 1. My Intranet bookmarks (OWA etc.) don't work. It tries to rewrite them and they never load, just timeout. I can go to the homescreen though and use Safari to open my OWA page directly. Even when I make the bookmark to explicitly NOT rewrite, it does. 2. It seems to have problems with disconnecting. My session stays in the SA, even if I choose disconnect in Junos Pulse. ... View more

I'm trying get iPhones and iPads to connect to the SA and I have followed the documentation at this link exactly: http://www.juniper.net/techpubs/software/pulse/guides/j-pulse-1.0R2-adminguide.pdf I always get "The request timed out". I noticed that the version of Junos Pulse app from iTunes store is now 2.0.0.8059. Does that make a difference? ... View more

This is interesting. I have never been able to get ESP working either and I have mine in a DMZ behind my Juniper SSG's. ... View more

My caching policies are set to unchanged and IE8 is set to allow saving encrypted pages to disk. It works fine in IE8 on the LAN, but not when the URL is rewritten. When I compare the source url's in both browsers they are different. IE8 doesn't even get to the dialog box to choose the permanent destination for the file. IE8: https://vpn.domain.com/,DanaInfo=B8B17EC8-AD06-44C8-B0D1-54F3AD2EF661,SSL+?REDIRECT=x-owacid2://976A0000/guid:25CA3F23-EB99-45CDD-80DE-447F2CF2C73/Parts%20List.xls Firefox: https://vpn.domain.com/owa/,DanaInfo=mail.domain.com,SSL+attachment.ashx?attach=1&id=RgAAAAA6O6OxpgRBRbofHnDbHt%2bnBwBY6bdm%2fJE5R7BKQ%2fSlEUgBAAAAAkOgAADfRHHaKjFpRqgNP6uMlOK6AAAABCGtAAAJ&attid0=BAAAAAAA&attcnt=1 ... View more

That could happen with any device (including laptops), not just iPad. Hopefully you have proper security in place on the endpoint and on the IVE to prevent this from happening. ... View more

It seems that the problem only affects internet explorer and not Firefox either. Firefox can click and download the signed email attachments no problem. ... View more

@zanyterp wrote: @deaconz: I would recommend opening a JTAC case for this one. Did the S/MIME support work prior to the upgrade to 2010 SP1? The S/MIME ActiveX control is something that, unfortunately, does see changes that cause it to not always work with the IVE and they need to be investigated with JTAC. I have a case open with JTAC on it. By default OWA 2010 SP1 doesn't allow to point and click open an attachment on a digitally signed email. You have to right-click and Save As. However, when it's rewritten by the IVE the download fails because for some reason it can't find the source. I know it's somehow related to the rewriting of the url to the download source. The error message I receive is "Unable to open this Internet site. The requested site is either unavailable or cannot be found. Please try again later." ... View more

Bump. Well I thought 7.0R3 was compatible with OWA 2010 SP1. Unfortunately we are having problems with S/MIME. Emails that are digitally signed open fine. But when they have attachments, you can't open the attachments! Anybody with the same issues? ... View more

@muttbarker wrote: You may need to add an intermediary certificate for Verisign into your cert store. I have seen this error occur and that resolved it. I marked this as the solution since it pointed me in the right direction. Network Solution's CA in the chain above it was already in there, but the one above that was not. So I manually added the "grand-daddy" CA cert for Network Solutions to the Trusted Server CA on the IVE and presto! ... View more

@miked wrote: Tigeli, thanks for the info... and Dooop. ANyuone have any info on when we will see compatability? Yes, I am curious as well. I just installed Exchange 2010 SP1 in my organization and can't roll it out because we use our SA (6.5R6) for external access. ... View more

Never figured out why it was happening. However, it is now fixed. I have another vpn that i use to test before an OS upgrade and I logged into that one and it installed the latest version. Later I went back to the Prod vpn and it worked. Weird. Almost like something got corrupted somewhere (although I tried reinstalling the same version too) ... View more