- Pulse Secure Community
- :
- About KevinW_
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
since
10-29-2017
10-29-2017
KevinW_
Contributor
29
Posts
0
Kudos
3
Solutions
02-05-2010
02:53:AM
I am having problems using certificate checking on the role level. Tested this on the realm level and it works ok. Generating a client cert on a machine. Importing this into the local computer store in personal certificates and enrollment certificate requests, and then also putting this certificate into the user personal certificate store. Then getting this certificate and installing it on the Client CA area on the IVE and the Server CA area. Also setup the root CA and the CRL checking options. So the certificate is everywhere at the moment. Then I have set the role to only allow clients who match with the CRL checking options. Try to log into this role and it fails. Put the same settings on the realm, and it works ok. Does this not work at the role level, or am I missing something here ?
... View more
02-05-2010
02:27:AM
Dont know if you resolved this but we are having a similar issue here. We are tryin to use the Gina client for our DR site on new machines which are pushed out. Of course, no user has logged into these before, so a "new profile" is always created. NC is configured as a Gina setup. New user logs in and cant use HC because it is not installed. Using a certificate check on the role or the realm level presents "you are not allowed to sign in" because the cert check cant find the certificate on the local machine. So no new users can log on and use gina.
... View more
02-03-2010
06:54:AM
Managed to sort this out. The Net Connect profile wasnt assigned to the role I was using. Doh! All working now - just have another problem with Host Checker.
... View more
02-03-2010
02:20:AM
I have a bit of a dilema at the moment. Part of our DR scenario is changing their workstation spec, so we need to update the image for the hardware. Not a problem (usually). We have updated, put all the apps on there, and put netconnect with the juniper framework package on there, and host checker. Now under normal circumstances in the past, this will just connect and work fine. When I connect on this new machine (a HP Compaq 8000 desktop) the client loads and connects fine. I get the IP from the DHCP server and then the IP address and routing is added ok. Then the client flashes up in the taskbar with only 1 way of traffic which is sending. No receiving traffic is being picked up at all. If i connect from another machine, from an older image its fine. Now there was an issue with Windows XP and SP2 where there was a TCP loopback problem, for KB884020 which is similar to this issue. But this machine is on SP3 with full updates. I cant see a lot in the debug log as to why it is not working. It looks more or less the same as a log which is working ok but I do need to look at it closer. Any suggestions would be appreciated.
... View more
06-01-2009
02:31:AM
Tried turning this off, and although the speed was increased when connecting to the farm, the same error message appears. I have done some logging on this and the connection from the citrix listed applications when you fire up an icon for the user which does not work does this: Connecting using ICA File (Server: ICOServer) [ApplicationServers] ICOServer= [Encoding] InputEncoding=ASCII [ICOServer] Client-Type=Internet IconPath=C:\Program Files\Citrix\ICA Client\wfica32.exe IconIndex=0 Connecting using ICA File (Server: ICOServer) [ApplicationServers] ICOServer= [Encoding] InputEncoding=ASCII [ICOServer] Client-Type=Internet IconPath=C:\Program Files\Citrix\ICA Client\wfica32.exe IconIndex=0 Connecting using ICA File (Server: ICOServer) [ApplicationServers] ICOServer= [Encoding] InputEncoding=ASCII [ICOServer] Client-Type=Internet IconPath=C:\Program Files\Citrix\ICA Client\wfica32.exe IconIndex=0 Now, on my machine as myself the ICOServer parts are replaced by the actual application name, and this connects ok. Tried this on my machine as the user which does not work and the same logs above come up and permission denied on the 1494 connection. But if I create a custom ICA file, and get the user to use this going to the same application logged in as him then it works ok. Really lost on this now.
... View more
05-28-2009
09:00:AM
Tell them to sort out their scanning tools :) Why it came up as windows I dont know. We use a 3rd party company called NCC Group. They are good at doing pen test and scans, and identified this as a hardened OS.
... View more
05-28-2009
08:57:AM
We run Wsam on 6.3r2 and works fine so far. No problems reported apart from a netbios share mapping issue. So looks like an issue with 6.4
... View more
05-28-2009
08:29:AM
Just spent on hour on the phone to jtech. What we have tested: 2 users: Both in the same groups, same permission on citrix, same role permissions, same firewall rules, same ICA client - only difference is the username. User A connects ok and can use listed applications, user B connects but cant use listed applications. user A goes to user B machine and works fine - abeit a little slow. user B goes to user A machine and does not work. User B always gets the "unable to connect" error. User A never gets this. Sent all logs to Juniper. What I can see in the user log is that when User A logs in, it tries on 1494 and connects fine, and logs into the application - job done. When User B logs in, there is this error: Request to connect to (IP of citrix server) port 2598 permission denied. This is the same for port 1494. This does not matter on location, the same on any computer, and even the same when trying from a jtech machine in india. So you would think "the user has not got access to the citrix server!". Not correct, because User B has an ica file which is exactly the same application and permisions which is on the listed applications and this works fine, so its not a user permission problem connecting to exchange. No resolution as yet, will check again tomrrow.
... View more
05-27-2009
04:12:AM
Sounds like either vista is trying to be too clever for its own good, or there is a bug with the vista client. There was an issue with windows XP where the SAM client wouldnt pick up any TCP data at all. this was because the tcp.sys file was not allowing reverse loopback to tunnel connections through via SSL. I wonder if there is a similar issue but with vista dns resolution. As dns works, it will use host file before dns and then broadcast if no dns is available, so it shows there is an issue with the vista machine resolving dns.
... View more
05-27-2009
04:00:AM
Hi Still the same issue. I have created a Citrix Listed Applications profile pointing to the Citrix farm server's xml port and then created an auto policy to allow *:* access which appears first in the policy list. Still does not work when trying to use citrix listed applications on the IVE I keep getting an error "The Xenapp server you have selected is not accepting connections". However, if I configure a custom ICA file, and create a new profile based on this instead of using a Citrix Listed Applications profile, it works fine going to the same server. Its almost like the citrix server does not like the client which is used for Citrix Listed Appliactions. I cant find anywhere which tells me info about the client connection used when it tries to connect. I am using WSAM. I know the xml port is working fine, because it gives me a list of the applications based on the permissions from the citrix server. Its just that none of the applications load up in the list. As a work around I have had to create each application for citrix manually, using custom ICA files and then create policies and roles for these and assigned them to the necessary realms. It would have been easier just to use the Listed Applications instead of doing it this way.
... View more
05-26-2009
04:10:AM
Hi, Did you have any joy with this as I am having the same problem pushing the list to our 4.5 server. I have configured the XML port on port 80, and opened up all the ICA ports going to our farm internally (not going to the web interface box) and I get the application list up but I cant connect to any application at all.
... View more
03-11-2009
07:31:AM
i had the same problem today with not being able to see the content. Any fix for this at all ?
... View more
03-11-2009
06:43:AM
I found a line in the documentation: If the IVE is used for OWA & Activesync, the hostnames for OWA access and Activesync must be different I think this is the cause of the problem because I am using the same exchange server for the auth only policy as what is published as the owa access.
... View more
03-11-2009
05:57:AM
This is because the juniper software does an application hook and runs as a double extension. Default mcafee policies see this acting as a virus, although it is not. Its the way the application has been installed. You can get around this by using the mcafee HIP (host intrusion protection) software and create a rule which allows this application behaviour.
... View more
03-10-2009
10:00:AM
If I create a new sign in for an authorization only policy(A), and then specify the site internally to point to a particular host which is in use for the default sign in policy(B) already, then the auth only policy(A) takes over the default sign in policy settings. This is in the post i raised earlier, but this is another issue. I have a default sign in policy which is using a certificate on the external interface which directs to our internal web server. If I configure the auth only policy, with a new certificate, on a new IP address, and point to the same resource as what is specified in the default one, then when I goto the default one I get the settings which have been applied in the auth only policy and not the default one. Its like, you cant use the same resource for both a normal sign in page setup, and an auth only policy at the same time or the auth only one takes priority. As far as I can see it should work seperately but its not working like :) again, any help would be appreciated on how this is supposed to work. I have followed the docs on this, but it does not explain anything which is related to this problem I am seeing.
... View more
03-10-2009
04:56:AM
I managed to get this working up to the point where it shows the server pages but content is not working for some reason, I think that could be a policy issue. Seemed that putting in the full domain name of the internal box didnt work, and putting in the hostname worked instead.
... View more
03-10-2009
01:42:AM
I have a VPort with a certificate allocated. This works fine when seeing the SSL settings from a browser. I have a Vhostname which is set to publish the content of an internal server. Vhostname = hosta Vport name = hosta Everytime I try and browse to this website, it takes me to the default "*/" sign in page, and not the vhost. One thing I dont have in the host settings is an auth server, as I am trying to use this for PDA sync with outlook. Again, any pointers will be appreciated.
... View more
03-09-2009
09:11:AM
The First thing you need to make sure of is that DNS is working. This is the first thing which I looked at, because the timeout could have been a DNS problem. Just configure your DNS in the nework overview page. Also put in a hostname of your appliance which can be resolved both internally and externally. Then, on your internal firewall, open up and NAT udp/tcp 53 for DNS. Then on your internal firewall, open up http and https from the juniper physical and virtual interfaces if you have a cluster setup. Make sure you open up http and https for all destinations. Next, from the box, make sure you can lookup hostnames. Goto the Troubleshooting/tools/commands section and run a ping to www.google.com or something. This should do an external lookup with the IP address. Dont worry about if the ping does not get back, so long as it does a DNS lookup with an external address, then this is working. If it does not do a dns lookup, then you have a dns problem, and I suggest why it is not looking up DNS. If it does a DNS lookup, and you just timeout on web pages, then its a firewall rule problem. Remember, the internal interface of the SA to a firewall will be treated like any other clien trying to get internet access to certain sites via a firewall. If you deny everything from the juniper box, to the internal network, apart from certain ip addresses, then your web sites are not going to work. You need to allow http/https - juniper internal interface > any.
... View more
03-03-2009
03:52:AM
Have a look at your Web ACL list. By defualt there is a policy which allows *:* for web browsing. You may want to disable this. Dont know if this will fix it or not but can give it a go.
... View more
03-03-2009
03:48:AM
Solved this at last, after looking at it today. Basically, the path of the packets have to go from the internal interface, to the internal network and then back out again. We have multiple firewalls which allowing the VPN clients to connect to specific hosts. When trying to access www.google.com, the firewalls treat this as another network which the vpn is trying to access, so it will allow/deny access to this site on the firewall. Adding in http from the juniper vpn to allow on port 80 for all sites fixed the issue :)
... View more
02-17-2009
02:07:AM
I did a little bit of work on this. Our clients can access the net at the moment without a proxy on because this is on a trial basis. So if i plug my laptop in, the routes take me out on the internet via our firewall. The gateway I use is exactly the same gateway which the VPN's internet NIC can see. When I do a packet trace from the VPN, I can see the box connect to DNS, resolve the IP. It then sends a SYN to the IP, with the next hop as the gateway. However, nothing happens to the packet. It just tries to SYN, SYN, SYN and then will time out. Again, I could do with more time to look at this, but I will look again with using proxy and see if that behaves the same way.
... View more
02-10-2009
12:39:AM
Issue: When clicking on a link which is external on a OWA session which is published via web resource, the browser just times out saying "Cannot access the Web Site. Please check your proxy settings. Made http request for GET / HTTP/1.1 to xxx.xxx.xxx. The URL entered is incorrect or the Web site is not accissible" Port 80 is open going to the internal network. DNS works ok because of SAM working and the SAM client being able to resolve. No proxy settings are set on the browser so it cant be that. I am not sure how the box will route the traffic. I have had a quick look at this, and I may be wrong in this, but it looks like the 4500 is trying to make the request and not sure how to get out to an external link. If trying to click on an external link causes this effect, then whats the best place to start looking at this? Or what is the default behavior of the box when trying to make this kind of request? I have looked at policy based routing, and im sure that this is not the reason why its not working and ill keep looking to find out what else it is. I have not got around to doing some tracing yet that my next step to find the path its taking, but I could do with cloning myself about 7 times to I have time to sit down and look at this. Thank you :)
... View more
02-05-2009
08:40:AM
this remains unresolved. I have submitted an RFC to juniper to change the way SAM works on these type of applications.
... View more
02-03-2009
01:36:AM
Ok, changed this message.. the application is using winsock. Also using all the comctl32.ocx files. Next step is to have a look at this with the SAM client active. Message Edited by KevinW on 02-03-2009 02:13 AM
... View more
02-03-2009
12:59:AM
Thanks guys. This was going to be my next step, just a little busy at the moment. Usually, I would use something like strace on unix to trace out the application so ill get one of these tools installed and then find out what its doing and then let you know.
... View more
01-30-2009
12:56:AM
Tried this out and still does not work. Getting the same windows error message "the dcom subsystem could not connec to server (servername). Check that the server is available blah blah blah" Using a command prompt resolves the server name ok, and again, using the net connect client then the RPC request gets sent through. I am not sure what I am supposed to see in the SAM client itself. I assume it would be svchost.exe trying to make the call to the server, but I am not seeing anything in the client. Any advice would be good.
... View more
01-30-2009
12:35:AM
I have tried adding the hostname of the server, but not the IP address. I did notice that the client does not even try and contact the hostname of the server, even though I can resolve it and DNS is working fine, but I will try adding the IP address instead. Tried this on a Net Connect role too, and appears to work ok. Its although the SAM application is not capturing the request for DCOM to use RPC. I will try this and post back.
... View more
01-27-2009
03:32:AM
If that does not work, you may have to install the cert, and then copy to file and set the file to export as a pkcs7 file. Or you may have to export to a pkcs12 file and export a private key.
... View more
01-27-2009
03:23:AM
I have a major problem with one of the applications we use here. Not the best in the world, id even go as far to say it was totally rubbish, but still our company still requires it to be used if people are connecting through SAM. I have had no problems with other applications working at all, but this one fires up an .exe file which then makes a call to DCOM to fire off an RPC request to the host which can be seen in DNS. I always get an error back saying "Unable to connect to destination host. RPC server is not available". I think this is because its trying to use the DCOM subsystem to make the call to the server, instead of the actual .exe file making the RPC request. This causes SAM not to work, as it expects the actual .exe file to make the connection on the session and not DCOM. So my question to someone is: Has anyone managed to get RPC over DCOM working for SAM? And "change the application" is not an option :) Any pointers would be appreciated.
... View more
Latest Tags
No tags yet
© 2017 Pulse Secure, LLC. Use of this website assumes acceptance of our Legal Notices and Privacy Policy.
Pulse Secure has updated its Privacy Policy effective June 28, 2017.
