Information from Admin Guide:   By Choosing "Preserver Client side proxy setting", the temp PROXY PAC file overwrite issue will be resolved.   Preserve client-side proxy settings ÑBy default, Network Connect may change proxy settings when needed. For example, Network Connect may temporarily change the proxy settings of the browser so that traffic intended for the Network Connect session uses the temporary proxy settings. Select the Preserve client-side proxy settings option to prevent the client-side proxy settings from being overridden by Network Connect.       Below Reg key will be changed to temporary PAC file created by Junos Pulse/NC Example change: "file://\\XXXXXXXXXXX\UserData\Username\RF\AppData\Roaming\Juniper Networks\instantproxy.pac" in the regkey AutoConfigURL     HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL   KB Link: http://kb.pulsesecure.net/InfoCenter/index?page=content&id=KB9232&actp=search&viewlocale=en_US&searchid=1421080446396 ... View more

that would be a problem, yes. when you do nslookup or dig on the PC, what do you see? is this on all flavors of windows or just a specific version? ... View more

You normally see this option under Resource Policies > Web > Kerberos/NTLM/Basic Auth. If you donot find it here, the chances are that it is already deleted. You could look through a dsrecord to check what creds the SA is presenting to the Domino server and what the response is for this from the Domino server. ... View more

Thank you for sharing the resolution; I am sorry to hear about the frustration you experience with upgrades and that what we have seen for the ConnectError here is not what you are seeing. You are the first person I have come across who has used the option to specify the Kerberos realm (and successfully); it is possible there is a failure in that section of the configuration. ... View more

I sorted it out. Ended up uploading it using Firefox instead of IE, seems to have worked. ... View more

Ok, the default page is the same as the custom page. So if you download a custom page and make a new Sign-in page with that downloaded file you have a standard sign-in page. If it works, you can make your changes to the custom page ... View more

I'm currently running 6.5R2 on a clustered SA4000 w/ ESAP 1.5.7 and AVG9 Free works correctly running on a Windows 7 box. Also have XP/Vista users using it without an issue as well. ... View more

Just to add to this, I see there is no Radius attribute for PIN Change. I'm thinking if this option was available then I can select the New PIN Page. ... View more

i don't think you can do this with RSA. The self service page is your only option but i am no expert on RSA 7.1 though Now we are moving to a Strong authentication vendor called VASCO they offer more capabilities than RSA for 1/4th the price. Any way the way they handle this is by typing in a pass phrase with your username in Juniper so you go to the login page that you normally go to for juniper. You type in your username and if you dont have your token you type in "sendmepassword" in the password field. Juniper just passes this information to the back end vasco server and server sees the username and the phrase and looks up your cell phone number in it's DB and send you an SMS with the OTP. This works beautifully. ... View more

I have used 6.4R3 and have the same sso broken issues. Hopefully will be fixed in 6.4R4 ... View more

Howdy - I just tested HC running on 6.3r3 against the new Safari 4.0.1 - had no problems with loading HC and having validation occur against a couple of different HC policies. Could check it on 6.4r2 if would help you. But it loads and works just fine for me. ... View more

JTAC says that iNotes 8.5 will be supported in version 6.5 due out soon. However, they got my config working with 6.3r4 using four policies all defined with the base URL and a star wildcard - No-Cache-No-Store, compress, SSO (Basic Auth), ACL. At least the site looks right. Now I need to verify that it works. ... View more

I wonder if 6.4R2 may fix some of my Domino issues? ... View more

In the policy trace log if the value of "Sign-in URL = " does match the windows realm related sign in URL and the user still gets a MAC realm then I would open a JTAC case along with policy trace, user access logs and SSL dump captured on the interface the user is trying to log into. ... View more

This afternoon i was finally able to use native AD integration for authentication. I've been fighting this for about a week, and I think the resolution was to modify the default IVE computername since I also had the same IVE/AD running LDAP for authentication... either that, or it just started working... stine ... View more

We at OPSWAT are aware that consumption of OESIS Framework updates by Juniper (and other partners) for inclusion in Hostchecker features released to end customers can be painful for Juniper and for its customers.    We are committed to releasing OESIS more frequently (currently weekly, with a goal of daily updates by end of 2014) and to make it easier for Juniper to validate OESIS releases and incorporate into their packages.   In addition, OPSWAT recently released a configurable client, GEARS, which auto-updates OESIS and stores endpoint device compliance status in the Windows Registry or Mac OS p-list. The Host Checker can access and use this information through implementing either a (1) the  default Antivirus Rule or (2)  a  custom process / registry checks. A Host Checker-GEARS configuration guide is posted at http://files.cdn.opswat.com/www.opswat.com/files/g ears-integration/integrate-juniper-ssl-vpn-opswat- ...   Using GEARS together with Host Checker should reduce the number of issues you encounter with your end users being blocked due to their running an unrecognized endpoint security application. Attachments: integrate-juniper-ssl-vpn-opswat-gears.pdf ‏1003 KB ... View more

One of our users here just tried IE Tab for Firefox3.0.8, available as an add-on by Firefox. It seems to allow Host Checker to do its thing, and he can use Firefox on his Vista Enterprise. Our IVE is running 6.3R1-2. One caveat is that the first time, he had to do a double-login. Another is that WSAM seemd to crash his browser, and reboot his machine, but that could be unrelated. The second login worked fine. I have seen that Host Checker seems to have random issues with Vista. ... View more

OK guys you'll have to forgive me for my stupidity. I found the problem. With all my testing and stuffing around I ended having the role mapping for this group part of two realms, so obviously it was failing as it didn't know which realm to authenticate me against. Thanks for your help ... View more

Hi, Thanks for your reply. I'll give it a go and see what happens! Abbi ... View more

It's the Malware component of Host Checker we are trying to use, if this helps. ... View more