- Pulse Secure Community
- :
- About spacyfreak_
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
since
10-29-2017
10-29-2017
spacyfreak_
Contributor
69
Posts
0
Kudos
2
Solutions
01-23-2014
07:24:AM
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" https://<your-IVE-URL> As workaround create a Link on Users desktop that starts IE 32bit and opens your IVE login URL.
... View more
05-03-2011
11:54:AM
Hi trying to get this running, but seems to be hard one.. :-) 1. configured external dns record "sharepoint.company.com", assigned to virtual port on IVE external IF 2. internal dns record "sharepoint.company.com" has the internal, private ip of sharepoint server 3. the sharepoint webserver certificate is installed on IVE and mapped to the external virtual port 4. configured sign-in polcy with url "sharepoint.company.com" which assigns proper realm 5. rolemapping on that sharepoint realm assigns all users sharepoint role 6. sharepoint role has one web bookmark for the sharepoint portal https://sharepoint.company.net When user goes from outside to https://sharepoint.company.com (which should direct him to the virtual ip on IVE, and present the sharepoint webservercertificate), the loginurl of the default sign-in url appears and the link in browser address bar changes to "vpn.company.com". Who did get this running?` Need urgently a stable, clientless access to sharepoint webapplications without evil rewrite engine!!! Thanks folks!
... View more
04-17-2011
09:53:PM
If i understand you right, you use AD-Username AD-Password RSA Token Number for Authentication. Your goal is to use AD Groups to give IPs to the Users according to their membership in one of these AD groups. I use IAS Radiusserver for Authentication of AD Users. In RAS Policies of IAS Server you can define easily Windowsgroup as a condition which has to match. When for example RAS Policy 1 (User must be member of Windows Group "VPN-1") matches, in that RAS Policy under "Profile"... "Advanced" you can define Radius Returning Attribute "Class (25)" with a value like "VPN-1" Then, on IVE Realm Level, Rolemapping, you can use user attributes (what are in this case the radius returning attributes) to map the user to a IVE Role like "VPN-1 Role". If User attribute Class (25) has value "VPN-1" then map the user to IVE Role "VPN-1". And on Resource Policies on IVE...Network Connect... Profiles you can configure mapping of an IP-Network to the IVE User Role "VPN-1". I think «this is the most stable and even easy to configure and maintain solution for your scenario.
... View more
04-10-2011
02:06:AM
Juniper Secure Access VPN_SSL works great also with linux, runs on several linuxes with firefox and JAVA...
... View more
04-05-2011
09:22:PM
http://www.juniper.net/techpubs/software/pulse/guides/j-pulse-mobile-2.0R1-android-ug.pdf
... View more
04-05-2011
10:57:AM
No - Juniper Pulse works GREAT on iPad/iPhone as full VPN Client. You did something wrong in configuration i bet...
... View more
03-27-2011
05:36:AM
IVE automatically presents the proper sign-in page dependend on user agent (browser user agent). Anyway - you could give the users a "global webpage" which presents the different urls for different scenarios. A simple webpage on your companies webserver which shows the user a matrix with the different sign-in urls and a litte description to each sign-in variation. I dont use hostchecker, i prefer clientcertificates on company notebooks.Only trusted company enddevices can use network connect, and they must have a clientcert. This works for ALL platforms. When u use hostchecker you have to activate it on realm level, you can not deactivate it for some devices, and activate for others. And as you control the company devices, you KNOW they have antivirus, users have restricted rights etc and the chance that infected devices come into your network is very small. Hostchecker is not stable enough in my eyes, very dependend on browser of the client, and if the CIO wants to access the company LAN and hostchecker does not work properly you have trouble... :-)
... View more
03-24-2011
01:10:PM
On IVE Role .. network connect configure split tunneling. On Ive .. resource policies... network connect ... split tunneling configure all the internal ressources the users should reach via tunnel. For example internal network 192.168.1.0/24 or host 10.10.10.10:80. On resource policies...network connect...profiles configure dns so the users can use the internal dns for internal ressources, but also the client dns so they can resolve internet dns names, if you have internal dns for internal ressources only. So the user who connects via network connect will reach all the local ressources and the internet, but ONLY what has to go to the networks which you configured on split tunneling rules will go into the tunnel.
... View more
03-22-2011
03:52:PM
Its a question of IVE version. 6.5 changes the behaviour of automatic configuring pac script on client though you disabled proxy function on network connect IVE level.
... View more
03-14-2011
12:05:AM
One more point... If in the company the AD password policy enforces users to change their ad passwords on a regular basis, the IVE will NOT present a message to the User to change his password. The attribute "User must change his password" is not communicated to the user. If you want to use password management, you should go for LDAP. My solution - using Radius. When a user can not log in cause he has to change his ad password, a error message is presented to the user (created on sign-in page, custom sign-in page) where a weblink is presented to the user so he can change his ad password via another solution for passwordchanging from outside the company.
... View more
03-13-2011
11:58:PM
Must be very powerfull AD User. Must have right to add objects to AD. This user must create the AD Computeraccount for the IVE in Active Directory. Dont create manually AD Computeraccount for IVE - wont work. Yes, should be Domain Administrator.
... View more
03-13-2011
10:01:PM
Well - then maybe THIS ONE could help? http://www.juniperforum.com/index.php/topic,5170.0.html Anyway, you could configure also IAS Auth, its just one click to switch between AD and Radius on IVE. You could use a test sign-in policy and realm to test the IAS solution. With AD Solution you need a very powerfull AD Administrator Account on your IVE with static password! And the IVE needs to create a computeraccount in AD for itself.
... View more
03-13-2011
11:40:AM
I would recommend to use IAS (or on Server2008 NPS) als Radius Server to authenticate users AND to map the user to a IVE Role via Radius Attributes. Dead easy - and stable like hell - and easy to troubleshoot - and you can also use radiusproxy to authenticate users from other ad domains. Little HowTo On the Windows Server.. 1. Install IAS on your Server2003 Memberserver or on Domaincontroller 2. Register your IAS in your AD (rightklick on the mmc on IAS to do that) 3. Add your IVE internal IP Address as Radius Client to IAS. configure Radius shared secret. 4. Configure RAS Policy on IAS Select "Windows Group" like "Management Users" (or even "Domain Users" for testing) 5. On IAS RAS Policy, Profile.. Advanced delete all Attributes. Add attribute Class (25) with a Value like for example "1" 6. Restart IAS Server each time you change the configuration 7. Configure additional RAS Policies, for the "Stuff Users" in this example. Give Attribute "Class" the Value "2" On IVE.. 1. configure Auth.Server "Radius". Configure Shared Secret (same like on IAS) and IAS IP-Address 2. Configure your userroles like "Management Users" and "Stuff Users" 3. On Realm Level, configure Rolemapping Rules 3.a. IF User attribute Class (25) is "1" then assign Role "Management Users" 3.b. IF User attribute Class (25) is "2" then assign Role "Stuff Users" Explanation: If a user logs in to IVE, the credentials of the user are transmitted encrypted to the IAS Radius Server. The Radius Server proves in AD if the usercredentials are ok and if the user is in the configured windows group. If the user is member of the group "Management Users", this RAS Policy will match, and the IAS will send a "RAdius Accept" Message back to IVE. PLUS the IAS will send Attribute "Class" with Value "1" to IVE. Then the IVE will match the user to the role "Management Users" because of the Value of Variable Class. Why is this the best solution? The IVE AD integration works with winbind. This is much more complicated and "more things can go wrong". When you use AD for Authentication and Groupmembership, you have to use Global Catalog on IVE. With Radius you have a dead easy, stable and scalable solution. You can also easily use your IAS as RadiusProxy and also integrate Users from other Windows Domains, according to their "prefix" on logon, for example domain1\username and domain2\username. You can troubleshoot the process easily via Windows System Events Log. You can also use policytracer, tcpdump and network monitor to see which attributes the IAS is returning. I installed several SAs and tried everything out, also did AD Authentication, but my expirience is - go with Radius and it will be done fast and with much less headache.
... View more
03-13-2011
11:34:AM
I would recommend to use IAS (or on Server2008 NPS) als Radius Server to authenticate users AND to map the user to a IVE Role via Radius Attributes. Dead easy - and stable like hell - and easy to troubleshoot - and you can also use radiusproxy to authenticate users from other ad domains. Little HowTo On the Windows Server.. 1. Install IAS on your Server2003 Memberserver or on Domaincontroller 2. Register your IAS in your AD (rightklick on the mmc on IAS to do that) 3. Add your IVE internal IP Address as Radius Client to IAS. configure Radius shared secret. 4. Configure RAS Policy on IAS Select "Windows Group" like "Management Users" (or even "Domain Users" for testing) 5. On IAS RAS Policy, Profile.. Advanced delete all Attributes. Add attribute Class (25) with a Value like for example "1" 6. Restart IAS Server each time you change the configuration 7. Configure additional RAS Policies, for the "Stuff Users" in this example. Give Attribute "Class" the Value "2" On IVE.. 1. Configure your userroles like "Management Users" and "Stuff Users" 2. On Realm Level, configure Rolemapping Rules 2.a. IF User attribute Class (25) is "1" then assign Role "Management Users" 2.b. IF User attribute Class (25) is "2" then assign Role "Stuff Users" Explanation: If a user logs in to IVE, the credentials of the user are transmitted encrypted to the IAS Radius Server. The Radius Server proves in AD if the usercredentials are ok and if the user is in the configured windows group. If the user is member of the group "Management Users", this RAS Policy will match, and the IAS will send a "RAdius Accept" Message back to IVE. PLUS the IAS will send Attribute "Class" with Value "1" to IVE. Then the IVE will match the user to the role "Management Users" because of the Value of Variable Class. Why is this the best solution? The IVE AD integration works with winbind. This is much more complicated and "more things can go wrong". When you use AD for Authentication and Groupmembership, you have to use Global Catalog on IVE. With Radius you have a dead easy, stable and scalable solution. You can also easily use your IAS as RadiusProxy and also integrate Users from other Windows Domains, according to their "prefix" on logon, for example domain1\username and domain2\username. You can troubleshoot the process easily via Windows System Events Log. You can also use policytracer, tcpdump and network monitor to see which attributes the IAS is returning. I installed several SAs and tried everything out, also did AD Authentication, but my expirience is - go with Radius and it will be done fast and with much less headache.
... View more
03-13-2011
01:40:AM
Hi Folks i plan upgrade from 6.4 to 7.0. Did anyone try out 7.1 in enterprise environement? What about 7.0 and Sharepoint 2010? Need clientless access to sharepoint portal. 6.4 has some problems with sharepoint (clientless access). Thanks for your expirience!
... View more
04-20-2010
09:49:PM
Ah, IVE is 6.4R3
... View more
04-20-2010
09:48:PM
No changes on IVE system. When this client uses firefox, no problem. So it is browserdependend issue, on IE8. But when uses IE8, after login on IVE sing-in page, message "page can not be displayed". I opened JTAC case, clearing ssl cache in browser and deleting cookies and temp. files did not resolve the issue. Anyway, the enddevice of the user seems to have some undefinded "problem", i adviced the stuff to do new installation of the client system (windows xp). I did not find any newer windows updates that have to do with crypto modules on that client.
... View more
04-18-2010
09:01:AM
Some users with latest IE8 Windows Updates have Problems after successfull IVE Sign-In Page login - "page can not be displayed". Looks like an SSL Handshake error. Anywone expiriencing this issue? The client devices are up to date (windows update), there was also some "crypto update for IE". Maybe that causes the behaviour?
... View more
03-28-2010
03:51:AM
Authentication-Type = <not determined> What is configured at RAS Policy Authentication Type?` Mark PAP. Though PAP does not encrypt authentication, the user passwords will allways be encrypted through radius protocol between IVE and Radiusserver. The strenght of radius encryption depends of the compexity of the radius secret. So use a long and complex Radius Secret, like AGhafdsa!$Q123TRZHsl$¤!!!123adfjnvuda
... View more
03-28-2010
12:16:AM
I now added "Ignore User Dial-in Properties - true" to the profile, but what else has to be added here? Nothing. Here you confgiure "return attributes" which radius server will return to the requesting Radius Client (like IVE) when radius accept message is sent to IVE. You can use this for additional features. Good idea to use Network Monitor (Sniffer) on the Windows Server, to see whats going on. It will help you a lot to understand how this works together. Without sniffing for testing you work as "blind", cause you dont see which radius attributes and messages travel between IVE and IAS. This are attributes and values, which could be used for some rolemapping rules on ive. Means - it also works, if you dont configure at "advanced" tab ANY attributes. But i use mostly attribute "class (25)" with any value, for example value "admin". Then on IvE rolemapping you can configure rules with "user attributes". Means for IVE... IF userattribute class (25) with value "admin" then assign userrole admin IF userattribute class (25) with value "user" then assign userrole vpnuser So you can use these ias radiusattributes to configure rolemappingrules, isnt that fantastic`? The other attributes on ias "advanced tab" are only for other purposes like dial-in callback number and stuff like that, as historically radius is a "dial-in" authentication service, but nowadays its a standard network authanticationmechanism which is supported by most network devices.
... View more
03-28-2010
12:09:AM
Proxy-Policy-Name = NOne Check your RAdius Proxy Policy, enter minimum the policy "allow authentication for windows users" or something like that. its the default policy when you instaled ias radius. maybe you deleted it? Its under i think "connection request policies". When you dont have there any policy, radius requests will allways be denied.
... View more
03-24-2010
07:55:PM
NAS Idenifier can be let at the defaults. What about Encryption Tab on IAS Ras Policies .. Profile i think? Unmark this all, as IVE does not support that. But i think your actual problem is that IAS wont accept radius requests from you IVE ip address, as you configurd wrong IP on IAS client tab, means check with which IP the radius request packets arrive at the IAS, with network monitor sniffing.
... View more
03-24-2010
07:49:PM
"A RADIUS message was received from the invalid. RADIUS client IP address xxx.xxx.xxx.xxx" Do you use the internal IP of the IVE System as Radius Client on IVE? If you have a cluster, enter the physical IVE IPs as radius clients on IAS, as i remember IVE sends the physical IP of the active IvE node to the Radius Server as source IP.
... View more
03-24-2010
07:46:PM
It should also work with local SAM Users if IAS is not in a AD Domain. But i never tried this out, i allways authenticate users from Active Directory via IAS. http://technet.microsoft.com/en-us/library/cc773343(WS.10).aspx#w2k3tr_ias_how_qmlj
... View more
03-24-2010
07:27:PM
Do you have proper radius secret on IVE and IAS set? What about using sniffers like Network Monitor in IAS to check if Radius Packets arrive there? Do you have an eye on IAS Server System Eventlog? Very helpfull for Radius Errors Have you configured RAS Policies on IAS? Insert Attribute "Ignore User Dial-in Properties - true" on Advanced Tab on Profile so that ias ras policy can take control Insert some RAS Policy like "Windows Groups" / "Domain Users" for first tests Do you have realm role mapping rule configured properly? You can also use "Username" is "*" for first tests is the client correctly configured on IAS radius client part? restart IAS service each time you modify the config Does your Server Windows Firewall block UDP1812 (or UDP1645) Do you have an eye on IVE user access log? Use IVE tcpdump to watch radius returning packets from IAS (can read them unencrypted, only password is encrypted) use policytrace on IVE for troubleshooting I find configuration of IVE and IAS for Radius Support dead easy, done in a snatch. Try to understand how this two work together, and troubleshoot step by step the whole line till you got it.
... View more
12-23-2009
04:42:AM
Here the solution from Vodafone Support: Vodafone Mobile Connect Client Software 9.4.X seems to have a Bug, a problem with "Zero Click Connect" functionality. This function automatically detects any LAN-Adapter, UMTS Adapter, WLAN Adapter available and automatically chooses the "best" connection. Unfortunatelly, when Juniper Network Connect VPN Connection is established, this Vodafone function cuts the UMTS connection as it "thinks" there is a better LAN connection. But as UMTS connection breaks up, also Network Connect tunnel can not be established. There is a patch from Vodafone planned for January 2010 for Vodafone Mobile Connect clietn 9.4. Till then, ask Vodafone Support for Vodafone Mobile Connect Clientsoftware 9.3.6 which functions properly in my testings.
... View more
12-19-2009
10:35:AM
Users have issue when connectiong to internet via vodafone umts pcmcia card. Internet access is no problem, but when launching network connect vpn connection, umts connection is dropped, so also network connect can not establish the vpn tunnel. Anyone having this issue? Windows XP is the Client OS, we use IVE 6.4R3, Vodafone Client 9.5 / 9.4
... View more
11-06-2009
10:38:AM
The VIP one or two times a day switches over to the other node and back. FAilover works fine, but WHY it fails over? Network ping times are superb good and i dont have an idea WHY the cluster algorithm thinks the other node should be better.
... View more
10-13-2009
12:59:PM
Are we talking about IVE clustering over WAN link? Behave! Sometimes "more" redundancy can lead to "less" availability. Assuming the wan link breaks, both nodes "could" get master and noone can log in in active/passive scenario. Automatic backups of whole config and user accounts is great. You could also use little cronjob script to send automatic the config via mail (secure config with strong password...) from the ftp server, so if IVE aND FTP servers burn, you will still have your config and can recover it in the second IVE System. On linux something like..... mail -s "backup-config" [email protected] -a iveconfigbackup_1312009.cfg
... View more
10-10-2009
12:00:PM
Sure - this forum and especialy www.juniperforum.com are great platforms for IVE admins. I love IVE, and i love JTAC as they provide best support i know. Have you ever had case with Checkpoint Firewalls? You will FEEL the difference. :-) Anyway, JTAC also does not know everything, and often the REAL LIFE expirience of admins is a great ressource of information in long-term stability. In last time quality control on IVE developers seems to have sometimes little "problems"? Also, JTAC wont tell you allways under which circumstances their product could do problems. Hostchecker Solution is in my expirience unstable - you simply can not get it runnig for some thousand users, as the mechanism is to complicated, they should design a new NC client which has Hostchecker encapsulated i think, all in one software. Actually, you have a number of clients you have to download and upgrade, why not encapsulate all the functianlity in ONE client - as an option maybe? I would be happy if Juniper would integrate some GREAT functions in IVE.. Otherwise it COULD happen, that Citrix Access Gateway will be market leader in the next years. Be carefull! Drag- and Drop functionality for clientless file access (Microsoft Sharepoint can do - why not Juniper IVE?) More Design Flexibility on webportal page (using own icons, look and feel) Using IVE as Proxy-PAC webserver Using IVE as Radius-Server (actually it can only work as radius-client) More flexiblity in Local User Database Email admin notification according to syslog messages On the other hand - compary the admin GUI, scalability and stability of IVE with the headbanging JAVA-GUIs of Citrix or ASA. There is no better, easier, stable SSL-VPN Product then Juniper SA on the market! And what about superb policytracer? Nice logging, and and and.. Message Edited by spacyfreak on 10-10-2009 12:05 PM
... View more
Latest Tags
No tags yet
© 2017 Pulse Secure, LLC. Use of this website assumes acceptance of our Legal Notices and Privacy Policy.
Pulse Secure has updated its Privacy Policy effective June 28, 2017.
