Hi Matt, Ruc We only see it happening to WSAM users as we do not run Network Connect. Currently the only people using the SSL-VPN are accessing a backend web app via WSAM. (WSAM because of rewriting issues) Alas it looks like the window closing PR may not be applicable in our case. I have half a dozen other traces now and the IVE closing the window shows up in only one of them. We are planning on failing over to the currently passive member of the cluster on Wed evening to see if that helps. (That is, is the problem with the hardware somewhere (nic?) or is it because of some rot in memory) JTAC has finally responded to my pings so maybe we will see some traction now. Cheers. ... View more

Thank you for this informaton ruc. Your description of the problem seems to be a potential match. Is there some kind of reference number or case number I can refer JTAC to which would help speed things along? Now having said the above there are two very odd things about what we are seeing. 1. It is only happening for users in one office location. The networking group has practically replaced every network device there but that has not changed anything. It was running clean prior to the change and it is running clean after. If the user is set up so they can bypass the SSL-VPN then they have no trouble. All other applications work fine. 2. If we direct some of the affected users to our lab SSL-VPN (2 x SA2000, active/passive - matching our 2 x SA6000 FIPS active/passive) then they work just fine. Now given that the problem is sporadic this may not indicate much but even today before the user went over to the lab SSL-VPN they were getting hung >5 times - after moving over to the lab - zero hangs. Thank you again for this information. I really hope it is related. Cheers, ... View more

We have a somewhat similar problem. 2 x SA6000 FIPS. For us it is the WSAM session that appears to freeze or lock up. The interesting thing is that it only happens at one office. One would think that this indicates a network problem at that office and yet all of their other applications are fine at the time of freeze. Also, if we take one of these users and have them bypass the Juniper to access the application they run into no problems whatsoever. If we direct one of the users to our lab 2 x SA2000 cluster setup (in order to cut down on the amount of trace data) running the same level of code and definitions they also cannot reproduce the problem there. I have been poking around the TCP Dump taken when one of these events happened and I see the SSL-VPN on a number of occasions setting the TCP Window Size to zero to the backend application but I have no method of mapping that backend (internal interface connection) to the user on the external side reporting the problem so it may be a red herring. Like you the problem seems to occur when they are busy doing lots of transactions but the bandwidth utilization is still very very low. I also have a case open but it appears to be languishing. Unfortunately I have no answers and can only commiserate with you at this time. ... View more

Further to my wish. I haven't thought about this but Cache Cleaner versions linger around. That is, I can have a 6.4 version of CC and a 6.5 version of CC installed at the same time. Now if the same were possible with HC then when users flip between different versions of the SSL-VPN [either by hitting a different SSL-VPN server cluster running at a different level of code or via an SSL-VPN upgrade or roll-back] then we would avoid the download and installation process which seems to give users some consternation. :-) Not sure if whtis is a good idea or not. I am just thinking out loud on this one and for me that can be dangerous :-). ... View more

But isn't this easily spoofed? On my home machine I add the appropriate registry key and HC will I am a compnay asset. We have a similar request from one of our customers but short of installing client side machine certificates I don't see how this can be done securely. The problem with client side macnine certs is you need a PKI infrastructure to back that up. If there is another way to do this I would be interested or if Juniper will be adding some other way of doing this via HC without machine certs/PKI then that would be goodness. :-) Thanks. ./Colin ... View more

Hi, We have noticed this as well under 6.4Rx. Benign but it does cause the end user some consternation. If you do hear of a workaround for this please let us know. Thanks. ./Colin ... View more

Just an update to my earlier note. We have V6.4R2 installed in the lab and it looks like NTLMv2 support is working. Unfortunately I cannot say the same about the Siteminder issue we have (still). . . ... View more

We also experienced this very same issue, although it was not with video. It turns out that the target server would only accept NTLMv2 authentication for web bookmarks and the SSL-VPN does not support NTLMv2 for web and displays this message as a result. This is apparently fixed in V6.4R2 but we haven't installed on the lab yet to verify. ./Colin ... View more