- Pulse Secure Community
- :
- About rdit_
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
since
10-29-2017
10-29-2017
rdit_
Regular Contributor
151
Posts
0
Kudos
7
Solutions
06-05-2013
11:04:PM
We are changing some structures internally and for now we are out of support cause our SA's are EOL, so I cannot open a case at JTAC :D Thats why I tried to get some info here... :)
... View more
06-05-2013
05:19:AM
I dont really know which version the users had before. Its just that since the last update it isnt working anymore. I'm talking about the latest generic one, the Samsung specific version is not being used (although we are using samsung devices).
... View more
06-04-2013
11:45:PM
And how do you explain that this worked for quite a while? Since the last Junos Pulse App Update on our Android Devices this isnt working anymore. We always had split-tunneling enabled and were able to resolve internal resources and external names. Now DNS is only resolving externally...and we didnt do any changes to our SA configuration.
... View more
02-12-2013
02:58:AM
Sorry for the delay, I still couldnt find the reason for this. I made a workaround by decreasing the timeout value to 5 seconds. So after 5 seconds it works definitely. I still guess the reason most somewhere at the DNS Servers or maybe that one of them is not working properly and when the request reaches that one it failes. To your questions: No I cannot replicate it on-demand. It just happens 1 out of 5 times or so. The tcpdump didnt really help, I will make some further research when I find the time and let you know! Thanks already!
... View more
12-04-2012
05:16:AM
Hey all, I'm using 2-factor authentication via Token as first authentication server. For authorisation I use a LDAP as secondary Server. This works pretty well most of the time but 1 out 5 times I have to following problem. Normally its like that: User opens his login-site and signs in with username and pin+tokencode Immediately after a click on "Login" the secondary's server login page appears, where he can fill in his domain user/password. After providing this information hostchecker starts and session runs But sporadically its like that: User opens his login-site and signs in with username and pin+tokencode Then it takes exactly the amount of time that is defined under the Auth Servers Connection Timeout (30 seconds) So the site is loading for 30 seconds -> after those 30 seconds the secondary server login page appears The user puts in his credentials and login goes on at normal speed When I decrease the timeout to 10 seconds then it takes 10 seconds, so its exactly that timeout. No I have no more ideas what could be causing that, I found out the following so far: Its not a client-problem, happens on all clients Its not a problem of a specific LDAP-Server, I swapped both in the configuration and also tested only single ones and it happens with both Both Servers are reachable for sure When I do a policy-trace it says "User Lookup failed to LDAP server ServerXYZ", but directly after that message (means after the timeout) it goes on and works. The connection never really fails, so the user doesnt see any messages. Its just that it takes so long sometimes and I dont have an idea why - cause afterwards its definitely working. Would be great if someone has advice!
... View more
12-04-2012
12:14:AM
Hi, I noticed that on older NC versions (7.0R4) the clients default gateway is the same IP as the assigned NC IP. In newer versions and Junos Pulse the default gateway on the client is 0.0.0.0. Is there an explanation for this?
... View more
12-03-2012
11:42:PM
Did you allow access in the ACL of NC?
... View more
11-21-2012
07:53:AM
Hey, same issue here and I didnt find a solution yet. Does anybody know how to solve this? The above mentioned KB article says: Article is in review and not yet ready for viewing Any help would be appreciated!
... View more
11-20-2012
07:45:AM
You rather need to control the Terminal Server itself, for example by placing it in a DMZ. I know...in many cases this is not possible, so you could use software on that server to prevent the user from doing RDP to other machines. For example a software firewall on that server or something like that. But I wouldnt really call that "secure" :-D When someone is on a machine in your LAN, then he's in your LAN... But I think theres no way of doing this through the MAG-Config.
... View more
11-20-2012
07:23:AM
I was also not sure about the interfaces and wasnt able to find the hardware documentation either. I just tested it then and its like that: eth0 = Management Interface (new, didnt exist on SA) eth1 = Internal Interface eth2 = External Interface First I thought it would be the same as the order in the webinterface under "Network -> Overview" but it isnt. There its: Internal(eth0) - External(eth1) - Management(eth0) Hope that helps!
... View more
11-19-2012
02:32:AM
Hostchecker is causing problems for years now, not only because of missing supported products. Everytime you update the IVE OS or ESAP, half of the users are experiencing problems with the auto-upgrade. I just installed a new ESAP version in our test-environment and since that time the login process takes ages!!! It hangs at the Hostchecker Page approx. a minute but then goes on without errors. Why does it take so long? Anyone else experienced that? Tested with ESAP 2.2.5 and 2.2.7. When I switch back to 1.6.9 or something pretty old, login is pretty fast again!
... View more
09-11-2012
11:36:PM
OK I was able to solve that issue, it was nothing about the SA-Configuration, it was a Firewall-Rule preventing the access. In your case the DNS-Name "SWCS" resolves probably to more than just 1 Domain Controller, right? In our case there was another DC added to the pool and noone provided this information to our firewall-admins. So this single host was not allowed and everytime a request was send by the SA to particulary this DC, the access failed with error19 (FB-2). Every request to other DC's in this pool was okay, so that caused this sporadic behaviour. 9 out of 10 times it worked but on the 10th time it reached the new DC and was dropped by the FW-ruleset. This solved it in our case, maybe you have similar issues. This happens when the communication between teams is improvable ;-) So maybe someone else changed something, must not be an issue of the SA.
... View more
09-11-2012
11:29:PM
Hi Mark, no I didnt get it working and it seems that this is not supposed to work at all. Certificate Authentication works with an Certificate Server and thats what all the KB's are about. Its actually not possible to use a role-based check for client-certs on android. You can just authenticate clients with a client-cert through an certificate-server but not just require a client to present a cert for login. This is working for iOS (iPhone, iPad) Devices and under normal Desktop OSes (WinXP, 7,...) but not for Android.
... View more
09-07-2012
02:46:AM
I have the same sporadic problem with some users. Does anyone have a solution for this? Sometimes the log shows the following while the users gets "Error FB-2": Failed to read Windows directory <dfs-path> with error 19.
... View more
08-28-2012
12:13:AM
We are facing the same issue for the past few weeks. It worked for YEARS but now it started to make problems and we didnt make any changes to the configuration or Virus-Software. I tried multiple things to solve it but always got that error again every now and then. Only way to solve it permanentely was to disable the checkbox for "Virus Definition Files should not be older than XX days". Now I'm only checking that the AntiVirus Software is installed, but not for the age of the Definition Files anymore. I dont really know why this setting was changed anyway. Some releases ago, I think IVE OS6.x, we had the option to define the number of days the definition files can be old. Now that changed, its not the number of days, but the number Updates now and those cannot be older than 10. Why that JTAC? As the thread starter said, I also couldnt fix it by updating the clients definition files manually - so they were definitely up2date. It appears as if Juniper (and so the SA) gets the Update-Lists earlier than the Clients actually do and then the hostcheck fails cause the Juniper already knows Signature-Updates that are not yet released for the clients. I think this is something that Juniper has to solve with the virus vendors. I cant even open a Case at JTAC, cause when someone calls me back, the issue is gone. Its always just for a couple of hours, then its working.
... View more
07-29-2012
11:52:PM
Yes I understand this. Its just hard to explain to my boss, why its working and supported on Apple Devices and not on Android Devices...
... View more
07-24-2012
07:07:AM
OK, thank you - heres the case-number: 2012-0523-0156
... View more
07-24-2012
07:04:AM
Are you talking about SecureMeeting? Never had this issue. Which IVE OS version are you using?
... View more
07-24-2012
07:03:AM
Client-Side Certificate Authentication is definitely a good start...as long as its working. I dont get it working on my Android Devices though. On Apple-Devices no problems. You can just use openssl under linux to create and convert your certs and keys.
... View more
07-24-2012
07:01:AM
This can have many different reasons, such as: Is a network connect (NC) role assigned to all users or do some only get some webbookmarks, SAM, etc.? If they doesnt have a sign-in policy configured that assigns them NC, they dont get a VPN IP. Did you configure that users can start NC manually instead of starting it automatically after login? Maybe they just didnt start NC, so they dont get a VPN IP. Is a client-side firewall preventing network connect from starting, do users get a message such as nc.23791? Maybe their session just expired, cause they are logged in for a while - then they are losing their NC connection. Just check the user access log file and you will know why!
... View more
07-11-2012
04:31:AM
Okay I got some Feedback from JTAC now: There is no solution for this as it is limitation in Pulse version release that is published in market place. We will test this against pulse version 4.0 release code and will let you know the results.
... View more
07-08-2012
10:34:PM
Its also not working on ICS by the way. Thanks for the KB Article, but I read it mabye 10 times meanwhile and I created the certs as advised. Yes there is a case and it was just escalated last week. Can I just post the number here?
... View more
06-29-2012
12:02:AM
You must create the CSR with the IVE and sign this one. It gets the status "pending request" until you install the signed certificate.
... View more
06-28-2012
11:43:PM
Which device vendor are you using with your Android Devices? With Asus Tablets I dont get any Pulse Cert Authentication working, no way (but Gingerbread, Android 2.3). JTAC still didnt find a solution either .
... View more
06-28-2012
11:31:PM
I had a similar issue 2 days ago, where users were not able to login anymore, cause of out-of-date virus definition files. I decreased the interval timer for the download from 120 to 60 minutes and tested in the evening again. Everything worked then. But I didnt get an error that the IVE was unable to download the definition files. One question regarding this: Why is the max. age of a definition file only 10 "updates"? I remember in older versions it was possible to define the number of days the definition files are accepted.
... View more
06-28-2012
11:25:PM
I was looking for the same and didnt find anything 2 years ago. Thats why I used the Client-Side Changes guide and just wrote a little AutoIt-Script that removes everything. But it was build for IVE OS6.3 I think. Maybe I could upload it somewhere.
... View more
06-04-2012
01:40:AM
Yes I used the DER-Format, I payed attention to all the advices from the KB Article. I opened a case at JTAC last week but they havent found a solution yet either.
... View more
05-23-2012
11:52:PM
What is the failure message you see in your user access log? I get the NoCert Message on the access log. Do you have other certificate-based servers you can test against to see if the certifcate was installed successfully? No, unfortunately I dont! Is the certificate listed in the trusted client CAs Well, only the CA-Certificate (that was used to sign the client-cert) is listed there and this is working cause our iPads dont have any problems connecting with certificates (they just need a p12, not 2 separerated DER's like on Android). I just added the client-cert itself to the trusted client CA's but that doesnt help either.
... View more
Latest Tags
No tags yet
© 2017 Pulse Secure, LLC. Use of this website assumes acceptance of our Legal Notices and Privacy Policy.
Pulse Secure has updated its Privacy Policy effective June 28, 2017.
