This issue is now fully resolved with Pulse 5.0R3 (using NDIS6 instead of NDIS5).   See http://kb.pulsesecure.net/InfoCenter/index?page=content&id=KB28571 for details     ... View more

SVW on 64 bits platforms will be supported in the next release (IVE OS 7.2) which should be ready beginning 2012. It's currently in beta. ... View more

Indeed the issue with Firefox 7.0.1, Host Checker and Windows 7 appears to be resolved by an upgrade to Firefox 8.0 released today. The problem with Firefox 7.0.1 will also be resolved in upcoming IVE OS Release 7.1R5. ... View more

This issue with new Firefox 7.0.1 will be resolved in IVE OS 7.1R5 (public release should be towards end of November 2011) ... View more

Hi jspanitz, For guidelines on Supported / Qualified / Compatible platforms, please refer to the "Secure Access supported platform" guide. "The platforms in this list are divided into two categories: compatible and qualified. The complete list of platforms/browsers in the document is supported. If problems are encountered on either a qualified or a compatible platform then Juniper support will attempt to resolve the issue" The "qualified" lists Firefox 3.6 on Windows. The "compatible" lists Firefox 3.0 and above. That being said, Juniper cannot test a release in advance (this applies to all non Juniper products we interoperate with) and also considering now Firefox has moved to a Rapid Release cycle, and of course new releases can introduce some interoperability issues. For example Juniper is commited to support Firefox 7.0 in the next release 7.2, and also attempt to fix problems found with the current release train (as per Supported platforms policies). But if the problem is caused by a major design change in an external product, it is possible that Juniper is not able to fix it immediately before the next major relase, in which case you should consider staying with products listed in the qualified platform list, in this case Firefox 3.6 ... View more

No workaround unfortunately apart from using an older version of Firefox (e.g 3.6.x) or awesome Internet Explorer... Juniper is currently working on a fix, will keep you posted when it's available Thanks, ... View more

Check the solution brief and implementation guide for Oracle Identity Management SSO based on SAML: http://www.juniper.net/us/en/local/pdf/solutionbriefs/3510251-en.pdf http://www.juniper.net/solutions/literature/implementationguides/801015.pdf Step by step demo on AcmeGizmo: http://www.acmegizmo.com/prep/OAAM_SAML_DemoScript.pdf ... View more

Hello, This is indeed an interesting question... You can find the Qualified / Compatible platform list including the base Operating System and Browser for various IVE components including Host Checker in the download area of Juniper website, "Secure Access Supported platforms" for example the 6.5 version is here As defined in the document, Qualified / Compatible platform means: Qualified Platform The platforms listed in the qualifiedÓ category have been systematically tested by QA department as part of the release covered by the Supported Platforms document. Compatible Platform The platforms listed in the compatibleÓ category have not been systematically tested by our QA department in this release but based on testing in previous releases and knowledge of the platform Juniper expects that the functionality will work and will fully support these platforms. Of course that scope has to be limited somehow because number of test to run increases exponentially with every new OS / Browser / version added. Another reason being, in case of new browser versions (Firefox 3.6 for example), these newer versions might not be available at the time of the initial release of IVE OS. So this is it for the "official" guidance. Now... you might actually find out that several OS/Browser combinations that are not in the Qualified / Compatible platform list, actually also work. But there might be some caveats, or some things that do not work as expected. I would distinguish 2 scenario: 1 - Base OS and browser/JRE are in the Qualified / Compatible list but not with exact version: For example Firefox 3.6 on Windows OS falls in this category. If the changes from previous release were not too radical, there you might find out that most if not all of the functionality works. I personally use Firefox 3.6, with Host Checker, Network Connect, Secure Meeting and I haven't came across any major issue. Searching for customer reported issues with Firefox 3.6 I don't see anything serious either. So if you come across a specific issue withe a OS/browser combination that is "quite close" to something officially supported, it is worth opening a JTAC case so that we can look into the problem and we'll certainly try to adress it on a "best effort" basis. We also had a few instances in the past where a minor browser or JRE upgrade caused some issues but these were immediately addressed in the following IVE OS maintenance release. 2 - Unsupported OS/Browser: For example, we have seen some requests to support Firefox on Mac OS. Although this is currently unsupported, you might find that some of the functionality work, so depending on what features are used, this might work for you. But depending on the actual issue, you might be advised to revert to a supported/tested platform. Google Chrome also falls in this category. Currently Chrome isn't even included in the Qualified or Compatible platform list. Again, some functionality might work and some not. For example, Host Checker does not even launch with Chrome and you will find a log message like this in User access logs: Browser on host 172.26.124.90 is not supported for Host Checker or Cache Cleaner: User agent Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.5 (KHTML, like Gecko) Chrome/4.1.249.1045 Safari/532.5. In this case, it is best to contact your local Juniper Sales team and ask for "New feature request". If we see enough demand for a specific browser / OS, then we will certainly consider adding it in the future. Thanks, Lionel Chilaud (JTAC) ... View more

For Citrix 128 bits encryption to work properly, you need to be at least on the following release: IVE OS 6.2R6, 6.3R5, 6.4R2 or 6. 5R1 or a higher maintenance release. Check for the following in Release Notes: The Juniper Citrix Listed Applications functionality now supports the Encryption settings that are configured on a Citrix Metaframe Presentation server. (418081) ... View more

Hello zvitins This board is for Juniper SSL VPN products (Secure Access Series). For firewall issues you might want to try the Firewall board. ... View more

Unfortunately, this is not supported/possible. The only way I know to work around that limitation is by setting up a VMWare image running in NAT mode: - The VM host machine is running NC1 to Site1 - The VMWare guest is running NC2 to Site2 Not sure this is acceptable for you but it;s the only way I can think of. ... View more

You can't really do that based on NC pools managed by the SA. Previously used NC IP's will be cached for a while so if the same user logs in again and the IP is still cached and available from the pool, it will be reused. However, this approach won't work if users reconnect and the IP has been re-used by another user. The only approach that would work is to assign a pool made of 1 single IP. That means you should create one NC profile per user. We can't really recommend this approach as it would be a nightmare for admins. An alternative approach is to get the IP address retrieved from a custom LDAP or Radius attribute during authorisation step to store a permanent IP for the user. You can use variables in NC Resource profile for the pool, e.g: <userAttr.framed-ip-address> This will ensure users always get the same NC IP's. ... View more

EndPoint Security > Host Checker Manage Endpoint Security Assessment Plug-In Versions Make sure ESAP 1.5.5 is activated Policies > New > Predefoned OS Check > Add Check: Windows 7 and Windows 7-64-Bit Save Changes. Platform: SA6500, IVE OS 6.5R2, ESAP 1.5.5. ... View more

This problem is specific to 6.5R1. It works in previous IVE release (6.4) and was fixed in 6.5R2 IVE OS 6.5R2 Release Notes: 96. win-term-svcs-admin Ð System variables cannot be entered in the hostnames of Terminal Services bookmarks. (478291, 477885) ... View more

This problem is specific to 6.5R1. It works in previous IVE release (6.4) and was fixed in 6.5R2 IVE OS 6.5R2 Release Notes: 96. win-term-svcs-admin Ð System variables cannot be entered in the hostnames of Terminal Services bookmarks. (478291, 477885) ... View more

yes, 64-bits WSAM support is included in IVE OS 6.5: http://www.juniper.net/techpubs/software/ive/6.x/releasenotes/6.5-whats_new.pdf http://www.juniper.net/techpubs/software/ive/6.x/releasenotes/SA-SupportedPlatforms-65.pdf p 9 Windows version of Secure Application Manager (W-SAM) Compatible platforms: Vista Enterprise/Ultimate/Business/Home Basic/Home Premium with Service Pack 1 or 2 on 32 bit or 64 bit platforms ... View more

IVE OS 6.5R2 is available on the download site and provides official support for Windows 7 Enterprise. Also check the Release Notes and KB13195 for know issues and gotchas. Predefined OS check is also available for Windows7 in ESAP 1.5.5 (which comes with IVE 6.5R2, ESAP will be upgraded automatically as part of IVE OS upgrade) Please note, installing the same ESAP 1.5.5 package in IVE OS < 6.5 will not provide the same predefined Windows7 OS check, so for lower versions, custom registry host chek is the only workaround. Also note that even though a number of features migh work fine with Windows 7 and earlier releases of IVE OS <6.5R2, since this configuration would not be officially supported, any JTAC case involving Windows 7 will require upgrading to a qualified configuration, that means IVE OS 6.5R2 or above. ... View more

By popular demand: In IVE OS 6.5R2, there is now an option in Admin UI to enable/disable the RDP launcher introduced in 6.5R1. The option is found under the Role > Terminal Services > Options: Enable Remote Desktop Launcher 6.5R2 is ready for download here ... View more

@ player RDP access to the backend resource is still controlled by Resource Policies > Terminal Services > Access Control. If ACL's are not allowing access to a given server the user is trying to access, then access will be denied. So there is no compromise from a security point of view and administrators still have full control of what Terminal Server users can access or what not. ... View more

Maybe you are using Citrix Embedded client with Java ICA delivery on the SA ? In this case it would be a known issue: http://www.juniper.net/techpubs/software/ive/6.x/releasenotes/Juniper-Secure_Access_6.4_GA_Release_Notes.pdf Known Issues and Limitations in this Release: When using Citrix Web Interface 5.0 on Windows-XP and IE6, with Embedded Citrix client and JSAM access method, clicking on the Applications will cause a looping pop-up window. (417481) The workaround is to change "Embedded client" to Native Client or Client for Java in the Citrix Web Interface configuration: Manage Client Deployment, or choose Non-Java ICA in the SA Resource Profile ... View more

That's right, you should open a JTAC case so the problem can be fixed in next Maintenance Release ... View more

http://www.juniper.net/techpubs/software/ive/6.x/releasenotes/Juniper-Secure_Access_6.5_GA_Release_Notes.pdf states the lowest release for upgrade to 6.5R1 is 6.1R1 The corresponding document (6.xR1 release Notes) for 6.1, 6.2 or 6.3 states you can upgrade from any 5.x release. So you need to follow upgrade path: 5.5 -> Any of 6.1Rx or 6.2Rx or 6.3Rx or 6.4Rx -> 6.5R1 ... View more

No I don't think wildcard cert would make any difference. The logic for checking the certificate hostname seems to be broken when going via a proxy. ... View more

Sounds like there is an issue when going via proxy. Connect direct ( Client -> SA -> secure site) : no warning Connect via proxy (Client -> SA -> Proxy -> secure site): warning Can you trying opening a direct connection to the secure site (not via proxy) to see if the warning goes away ? If this is not possible in your network, can you open a JTAC case to get it fixed ? Thanks, ... View more

Sounds like you have an issue with the ACL's Goto Resource Policies > SAM > Access Control Create New Policy, add your Exchange server(s). If you don't know exactly what ports you need, open the whole lot, once that works you can filter down. Resource: <server.name.or.ip>:* If using a server name / fully qualified domain name in ACL's, you should also enable under Resource Policies > SAM > Options: IP based matching for Hostname based policy resources If you still having issues, run a policy trace with SAM enabled. ... View more

There was some improvements in term of responsiveness over slow links for WTS using rich content (like flash) that eventually lead the entire session to freeze in IVE OS 6.4R3 and above and in 6.5Rx IVE OS 6.4 R3 Release Notes: 52. win-term-svcs-other - Fixed a WTS freeze issue while accessing flash content on a slow link. (390188) So upgrading to 6.4R3 or above might get you some improvements. However it is not possible to fully fix the slowness of such sites when accessed through RDP, this is due to underlying RDP limitations that should see some improvements with RDP7, check these links: http://computerboom.blogspot.com/2008/12/microsoft-demos-remote-desktop-7.html http://www.snakelegs.org/2008/10/14/flash-performance-on-terminal-services-rdp/ ... View more

When you configure the bookmark for the "secure site" on the SA, also make sure you are using the same name as appears in the "secure site" certificate common name (when you go direct to the secure site, double click on the keylock in your browser and View Certificate. Check the field: "Issued To:" you need to use the same hostname when creating the bookmark on teh SA. Usually it is the FQDN of your server. Using anything else will also trigger the warning. ... View more

Have you tried JSAM ? Terminal Services client is a Windows only feature so it will not work on the MAC. The Java applet should work though, did you check that Java ACL's are open under Ressource Policies > Web> Java ACL's ? For JSAM you will need to: - select JSAM under Role > SAM > Options - define the target server by hostname under Role > SAM > Applications - check "Automatic Host-Mapping" under Role > SAM > Options so that the mapping to hostname -> loopback interface is created automatically in /etc/hosts file when JSAM starts - SAM ACL's to target server under Ressource Profiles > SAM > Access Control - "IP based matching for Hostname based policy resources" under Ressource Profiles > SAM >Options if using FQDN in ACL's You can even create a specific role for Mac users that you can assign automatically by defining a role mapping rule using a custom expression: isMac: useragent = '*Mac*' and assign automatically the JSAM role. I tested this some time ago with the Windows terminal server client for Mac and it was working fine. ... View more