About hutchingsp_

hutchingsp_ · ‎02-15-2013

Thinking about it, no, but having tried Pulse I rather like the ease of access you get with the icon always being in the system tray rather than fire up your browser, type an address/click a bookmark, watch the host checker, sign in etc.

hutchingsp_ · ‎02-15-2013

@-red- wrote: I am still having a hard time thinking through this :) I assume your RDP bookmarks are configured to use the IVE as a broker, so even with the Pulse session established, RDP traffic takes a different path. I wonder if there are performance implications here. Just thinking through the path in this scenario. User established VPN session via Pulse terminated at the IVE Using an established Pulse session, user opens a new session to the IVE, presumably via internal interface? User clicks the RDP bookmark and uses the IVE broker functionality on the IVE to connect to the resource. If I am not mistaken, (and I would encourage one of the Juniper guys to speak to this) enabling multiple user sessions would also consume additional user licenses. It may be a whorthwhile effort to figure out which of the RDP users actually need the full Pulse client, and who would be content just using the RDP bookmarks. Let them have a choice in how they establish a session. Allow your RDP users, and users to continue logging in via a browser, and encourage those who dont to use Pulse. Ahh sorry perhaps I wasn't clear about this part. Right now users sign into the IVE and launch NC from the portal. They can still launch TS apps from the IVE portal with network connect running. Pulse seems to be where Juniper is headed and it looks like a quicker way to establish a TCP/IP level connection to the LAN to get to mapped drives etc. but it seems if you initiate the connection from Pulse, rather than starting Pulse from the IVE portal, you have the issue I described. The way it works now it's a two-step process to start NC, but I only have to update one set of TS bookmarks in one location and everyone is good to go. Hopefully that's a little clearer?

hutchingsp_ · ‎02-15-2013

@-red- wrote: With the Pulse session already established, is the goal is to merely use the SA as a bookmarks page at that point? Aside from that, I would think there is no real value in going back to the SA bookmarks as they should be able to RDP via the established tunnel. If you are really compelled to do this, you can increase the limit on the number of concurrent user sessions. I believe you have to do this at the ream as well as the sign-in policy level. Although I would still question the value of this approach.. Essentially yes. The SA already has the resource published, bookmarked etc. so it's a nice "portal" to start things from. I wanted to start rolling Pulse out to some people to test as it seems a much faster way of getting a VPN connection, but some of our major LOB apps run via Remote App from the SA portal - I'd like to avoid duplicating this list of bookmarks if possible.

hutchingsp_ · ‎02-15-2013

I've just started experimenting with Pulse. On our SA (7.2.x) we have a bunch of Terminal Services resources available via the main page. If someone logs in via the SA directly and starts Pulse from the home screen they seem to still be able to access these resources. If someone connects directly using Pulse and then attempts to connect to the SA so they can use the Terminal Services reources they're told they already have a session and it will be disconnected. What's the best workaround here please?

hutchingsp_ · ‎08-16-2012

Are there any issues in doing this please? We haven't changed any config, it was literally a straight upgrade but of course some clients will have upgraded/updated their host checker and Network Connect etc. Thanks.

hutchingsp_ · ‎08-16-2012

Upgraded our SA2500 to 7.2 R2 from 7.1 and can't get past host checker on my 10.8 Mac. Wonderful I'm seeing this in syslog: <Notice>: killed JuniperSetupClientInstaller.osx[pid 11055] because its use of the version entitlement is not allowed I guess there are still no workarounds other than disabling host checker? Can the IVE safely be rolled back to the latest 7.1 code? When is a fix planned please?

hutchingsp_ · ‎07-30-2012

We're using LDAP on our SA2500 (7.1). Is there a way I can allow people to use either their SamAccountName or their UPN name to login with please? It seems you can only specify one or the other? Thanks.

hutchingsp_ · ‎04-26-2012

Thanks and bugger (in that order) So for now the best compromise is considered to be...?

hutchingsp_ · ‎04-26-2012

Is there any sort of end-to-end tutorial on best practises on configuring an SA (currently running the latest 7.1 code) with a realm for iPad users please? Our SA is already setup and working for Pulse and Network Connect so I'm more interested in any quirks peculiar to iPads. In particular there is the host checking/authentication side of things - I'd like to be sure that it really is an iPad and ideally one of our iPads that is trying to authenticate with the SA. Thanks.

hutchingsp_ · ‎08-16-2011

I'm doing LDAP auth against Active Directory on our SA running 7.0 R6. Our AD OU layout is something like: Corp Users -Permanent -Contractors -Administrative -Conference Rooms -Role Accounts What I'd like to do is be able to specify on my base DN that a user has to be in either the "Permanent" or "Contractors" OU to be able to authenticate, but I don't know if I can do this? I can kind of work around it by using role mappings so that only accounts that have one of the attributes that we only set on human accounts can login, but I'd still prefer to only authenticate on specific OU's. Any suggestions would be great. Thanks

hutchingsp_ · ‎08-06-2011

I'm evaluating 2008 R2's RemoteApp to see if it's viable in our environment. Our IVE is running 7.0 R6. I created a Resource Profile that points to the Terminal Server, then I created a bookmark that points to the specific app that I have defined in RemoteApp. The odd thing is that when I enter "<user>" in the SSO username field and "<password>" in the variable password field, when I connect through to the server it won't log me on. It's trying to log me on as "SERVER\user" rather than as "DOMAIN\user" If I edit to bookmark and try to pass either "DOMAIN\<user>" or "DOMAIN\\<user>" it then tries to log me onto the server as "DOMAIN\First" and not "DOMAIN\First Last" so I can't logon that way. This is using the HOB applet on OS X. I won't be able to test this on a Windows PC for a day or two, but does this sound normal? Thanks, Paul

hutchingsp_ · ‎07-28-2011

Does anyone know if there is a roadmap for the SA series that will make mapping network drives a bit more pleasant? Realistically for the average non-technical user, all the "Connect As" stuff is a complete no-go, so we don't try to use WSAM we simply get the user to use Network Connect. I guess I'm a little surprised that a major player such as Juniper hasn't come up with some mechanism where you allocated a bunch of UNC paths with a role, and when someone logs in and is assigned that role, the drives get mapped, and when you logout they get disconnected. I wondered if anything is in the works? Thanks.

hutchingsp_ · ‎11-04-2010

Hmm thanks (and sorry for the late reply, I didn't spot any email to tell me). That's unfortunate - anyone know if anything is on the horizon or if you have a Blackberry and want remote access is your only option web rewriting and things outside of Juniper such as Citrix/TS Remote App?

hutchingsp_ · ‎11-03-2010

Bump.. anyone?

hutchingsp_ · ‎10-12-2010

Kind of as subject really. I'm shocked how easy it was to get our SA and iPhone working with JunOS Pulse, but we may be looking at what smartphones we use as a company and of course Blackberry is on the list. Other than web re-writing I don't see too much reference to them, so I don't believe there is a TS option, or a Pulse/NC option?

hutchingsp_ · ‎10-12-2010

Is there any way with the HobSoft RDP Java applet (on Mac OS X) to be able to specify a custom screen size or percentage of the host screen resolution? It's 2010 and I'm on a huge 24" screen here but can't RDP into my work PC at anything other than 4:3 or full screen resolution. Thanks in advance.

hutchingsp_ · ‎10-07-2010

Is there an upgrade/migration guide somewhere? I presume it's just a case of upgrading the package but I'm unclear what (if anything) I need do immediately after i.e. what will stop working if anything? The key things are that Network Connect still works, and that Citrix bookmarks still work, or work with minimal reconfiguration.

hutchingsp_ · ‎10-07-2010

Is there a summary somewhere of what is possible with an SA2500 and an iPhone? I have a user would would like to be able to use Citrix/Remote Desktop (I know, I know) on an iPhone - not sure what model or iOS but if the SA code doesn't support anything other then a Network Connect type connection it's academic anyway.

hutchingsp_ · ‎10-04-2010

It does to an extent, however we have some roles where I want to say "Anyone who logs on", and I don't want to have to start adding people to a distinct VPN Users group. In reality it's not a significant risk but it would be nice to take the option away for a projector or a meeting room to be able to log on.

hutchingsp_ · ‎10-02-2010

In our AD we have a parent OU called "Corp Accounts" and within that we have various OU's such as "Contractors", "Staff", "Equipment", "Service Accounts" and so on. I'm currently using LDAP authentication on our SA, but I can only get it to work at the "OU=Corp Accounts...." level, when ideally I want to restrict it so that only users in "Staff" and "Contractors" can authenticate (as accounts for things such as equipment and service accounts should never need to be using a VPN). I know I can filter on group membership but that's additional overhead and relies on us doing something other than simply dropping accounts in the relevant OU. Can I do this with a filter or anything? Thanks.

hutchingsp_ · ‎07-25-2010

I only have a single SA2500, it's not heavily utilized but it means that I don't really have a test environment. So, 7.0 is out and I figure if they go from 6.4 to 6.5 to 7.0 it's a pretty significant change. How is it for an R1 release? From what I can make out from the guides the main change is the integration of an RDP client for OS X (a big deal for me personally) and the change to Junos Pulse, which seems difficult to gauge without actually trying it. I'd be interested in any feedback as the forum seems strangely short of posts on 7.0?

hutchingsp_ · ‎06-18-2010

Fabulous, I feel a bit stupid for not having spotted that but thank you very much.

hutchingsp_ · ‎06-16-2010

We have our OWA server available via our SA2500 (running 6.5 r4). I've had a few users complain that whenever they try to add an attachment to an email it doesn't work, they get an "access denied" error message. Has anyone experienced this? I can replicate the problem but I'm not familiar enough with the SA's to know quite where to start with troubleshooting it. Thanks.

hutchingsp_ · ‎11-16-2009

That's fantastic as I've never been able to get this to work until now. Being fussy, I guess there's no way of hooking in to allow a custom window size as per the option in Preferences of the SA homepage? I ask as it only ever seems to come up at 640x480 as in the html regardless of the setting in preferences?

hutchingsp_ · ‎11-16-2009

I think I'm getting a little confused. We're using IVE 6.5 and I've configured a WSAM application that defines an executable with MD5 checksum, and in the autopolicy limits it to *.ourdomain.com:portno. In Resource Policies/SAM I see an autopolicy, yet my user is saying he can't connect using the application. It's not an app I use so I need to test tomorrow using a laptop, but should I need to do anything additional to this? All I want is to allow the use of that executable, with that checksum to allow it to connect to a given port on any machine on our LAN (though as this chap is using a non-company device I want to do this via WSAM rather than NC). Thanks.

hutchingsp_ · ‎09-29-2009

The Citrix Java applet gives a warning about using an untrusted certificate (the default of "Root Authority") every time I launch a Citrix app on my Mac using the 9.7 Java client. I've scoured the help and I'm not clear if I can make the SA use the trusted SSL certificate that's used on our SA itself, to sign the Java code?

hutchingsp_ · ‎07-17-2009

We've an SA2500 on 6.4 R1. On one laptop I'm seeing that when I visit our IVE default logon screen, Windows Data Execution Prevention kicks in and closes the page, but I don't understand why it's only doing it on this single machine? The Juniper Installer Service is installed, and the browser is IE8. The laptop is running XP Pro SP3 with all updates as of around an hour ago when it was updated via Microsoft Update (the laptop was never configured to use the SA before so I don't know if these issues are related to the updates or not).

hutchingsp_ · ‎06-23-2009

I don't think it's that - NLA seems to detect that the machine is on a "foreign" network until Network Connect launches and gpupdate eventually runs/kicks in.

hutchingsp_ · ‎06-23-2009

Unfortunately no, it would seem it doesn't apply to this component.

hutchingsp_ · ‎06-23-2009

OK so it seems there are a few ways to mitigate this outside of changing our XP Firewall group policy: Disable split tunnelling - not a firewall but seems to have the effect of making the client appear invisible to its local subnet? Use Host Checker Connection Control - great, fantastic... needs admin rights!!! Does anyone know if the Connection Control can be made to work without admin rights by tweaking priviledges using Group Policy?

Re: Connecting to SA when already connected via Pu...

Re: Connecting to SA when already connected via Pu...

Re: Connecting to SA when already connected via Pu...

Connecting to SA when already connected via Pulse?

Rolling back from 7.2 to 7.1?

Re: OS X 10.8 Mountain Lion

Using UPN or SamAccountName to login to SA Series?

Re: iPad with SA/Pulse - Tutorial?

iPad with SA/Pulse - Tutorial?

LDAP Authentication - Multiple OU's?

TS RemoteApp - SSO only passing first name?

Network Drive Access via Windows Explorer?

Re: Blackberry Support?

Re: HobSoft RDP Applet - Custom Resolution?

Blackberry Support?

HobSoft RDP Applet - Custom Resolution?

Re: 7.0 - When to upgrade from 6.5?

iPhone with SA2500 - what's possible?

Re: LDAP Authentication with multiple OU's?

LDAP Authentication with multiple OU's?

7.0 - When to upgrade from 6.5?

Re: OWA Exchange 2003 Issue - Attachments?

OWA Exchange 2003 Issue - Attachments?

Re: ProperJava RDP - Complete Jar Files - Zipped

WSAM and Resource Policies?

Signing Citrix Java Applet?

IVE being blocked by Windows DEP?

Re: NC and XP Firewall

Re: NC and XP Firewall

Re: NC and XP Firewall