We don't use PAC files.  We do however push the proxy configuration using GPO.   When I choose 'preserve client settings' on the IVE, nothing changes in the browser on the client machine. But accessing the web still tries to go direct (I can confirm this in the firewall logs).   When I choose 'manual' on the IVE, I enter the proxy address and port number on the IVE.  On the client side the proxy setting under 'Use a proxy server for your LAN' is unticked and there is a tick against 'use automatic configurtion script'.  The field contains the path to the local instantproxy.pac file on the C drive.   When I choose 'no proxy' on the IVE, on the client side the 'use a proxy server for your LAN' is unticked and an instantproxy.pac file is used with a Direct connection configured within the pac file.   When I disconnect from the VPN, the proxy settings are returned to what they were prior to the VPN connection (i.e the GPO settings) which is what it should do.   Basically no matter what option I choose, the client still tries to get to the Internet directly without ever trying to use the proxy, no matter how the client is configured. ... View more

The clients proxy settings are pre-configured from Group Policy in AD. Not sure I understand what you are saying. If the logic you say is correct, why does the clients browser settings get updated with whatever is configured on the SA with regard to proxies? ... View more

Yes the client already has pre configured proxy settings. And yes an instant proxy PAC file does get created when set to manual. It also reverts it back when I disconnect like it should. I'll take another look at the instant proxy PAC file when I'm back in the office. I did look previously and it looked fine but I'll check again. ... View more

Thanks zanyterp. I've just PM'd you the JTAC number. Unfortunately the call is now closed. I gave up trying to get a resolution. ... View more

The ACL's look fine. I've put a rule in to enable DNS. I've noticed when doing an IPCONFIG that the DNS settings a blank, like it's not known. That possibly why DNS resolution is not working. The question is now why does the client device not know what it's DNS settings are. I've tried the option of using the IVE DNS Settings, and manually entering the DNS configuration into the NC Connection Profile section. ... View more

Can you believe I've been told by Juniper I now have to log an enhancement request through my reseller. Although this used to work fine in Avast 6 they have no intention to rectify it in Avast 7 and are regarding such a change as an 'enhancement.' I expressed my dissatisfaction to the juniper tech as that is an impractical workaround in my situation, but it got me no where. I'm finding more and more reasons to replace this product with something else. ... View more

There's a workaround to make this work with Avast 7. I'm not happy with this workaround so I still have the call open with Juniper. Not sure what has changed from Avast 6 to 7. "The Current implementation of OPSWAT needs UAC elevation and administrator's privilege. The workaround is to turn run as administrator on for dsHostChecker.exe, which is present in the HC installed folder (C:\User\<username>\AppData\Roaming\Juniper Netwos\HostChcker). ... View more

Can others also log JTAC calls, as I keep getting told it tests OK for them ... View more

Yeah it still doesn't work. I logged a JTAC but the tech claimed he tested it and worked fine and assumed it was a problem with the pc I was testing with. Turns out I got it to work with Windows XP but not Windows 7. But we will need others to log JTAC to get further action cause I didn't get anywhere. ... View more

Well there's a default route configured on the device which sends the traffic to the router that knows how to get to the right destination. ... View more

According to the doco the latest version of ESAP supports Avast v7, but it still doesn't work for me on Windows 7. Anyone else got issues with the latest version? ... View more

Not sure what you mean by 'both'? The addresses the IVE give out to the VPN clients are on the 192.168.x.x. The internal and external interfaces of the IVE are also on a 192.168.x.x but different subnets. Internally our addresses are on 10.x.x.x subnets. ... View more

It can't be latency or a security issue with anything external to the IVE, because it used to work prior to the upgrade. Any way, I got it work by changing two things: * I selected all three settings, Kerberos, NTLMv2 and NTLMv1. Previously I just had Kerberos. * Instead of specifying the kerberos realm, I select the option to seach LDAP for the Kerboros realm. My test connectivity still fails but everything is working as it should, so I'm happy. Frustrates the hell out of me everytime Juniper releases an update to the IVE something always breaks. ... View more

I know everyone has given up on me, but I'm being persistent. I just found this comment in the admin guide that could be the cause of my issue: When upgrading an SA series appliance or performing a new install, the default SSO policy of BasicAuthnoSSO is preserved. Even if all sections of the General tab are enabled, SSO will not be enabled until the BasicAuthNoSSO policy is deleted. This could be my problem but I can't find the BasicAuthNoSSO policy anywhere. Either it's already deleted or it's hiding somewhere. Any assistance would be great. ... View more

I've just attached the Domino logs. You can see in the old firmware attachment there is authentication details with a process time. In the new firmware attachment there is no authentication details, and the process time is 0, indicating it hasn't even attempted to pass the credentials. Any ideas? ... View more

I don't know if this helps troubleshooting, but I added my own credentials into the BA_Upg_2 as static credentials, and sso still didn't work. ... View more

Yeah tried all that, didn't work unfortunately. See attached screenshot. ... View more

I have been playing with these settings with no luck. See attached print screen. What do the options under "Enable Intermediation with Credential" mean with the option of BA_Upg_2? ... View more

When I do a Test Connectivity, it just sits there for a couple minutes thinking about it, then nothing happens. No confirmation whether it was successful or not. I can confirm it's not a connectivity issue, as like I said, it was working perfectly before the upgrade. What would have changed as a result of the upgrade? ... View more

I sorted it out. Ended up uploading it using Firefox instead of IE, seems to have worked. ... View more

Sorry, just wondering if anyone else can add to this? ... View more

Jan, I don't see the options you're talking about to download a zip file of my current sign-in page. Remember it is a standard page, not a custom one. If you can do it, please step it through for me but from what I can see you are not correct. I'm running R6.3R5. I had a feeling I'd have to modify the sample.zip files. I just had great difficulty finding what to change, even going through the user guide. I found what I need to change in the Defender.thtml file, but I need to fix up the initial login page. Basically on the login screen I have to change the wording of username, password, additional password (ACE PIN) and Realm selection, and I have comments on the right hand side. Can you point me in the right direction on what files/parameters I need to change for these 5 items? Thanks. ... View more

Just to add to this, I see there is no Radius attribute for PIN Change. I'm thinking if this option was available then I can select the New PIN Page. ... View more

Well I finally got around to testing this. I selected the "next token" page and this is perfect. The wording is exactly what I'm after. My problem now is when I use this page, the user no longer gets prompted to change their PIN number when RSA is configured for the user to change their PIN at next logon. It simply brings up the screen awaiting the SMS token code, which will never arrive as the PIN needs to be changed. If I leave it on the "Generic Login" page the PIN change screen appears as expected. Any idea why this would be the case and how can use the "next token" page and also ensure PIN changes can occur? Thanks ... View more