Sure can, using the user-agent string based realm level restriction. The concept is explained in https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB19883 however instead of the user agent strings mentioned in the KB create just two browser restriction rules on the user realm: 1. *Pulse* Allow 2. * Deny    Note: Since user-agent strings can be maniupulated by a client above logic should not be used as a strict security control rather its a way to discourage browser based access  ... View more

Given that reverting DNS settings to its orignal state is a client side functionality at least getting detailed level client side log and approximate time stamps should provide some starting point for support to see why the api/calls to revert DNS settings are failing.      ... View more

Error 1110 indicates that the Pulse client is not able to connect the server due to an underlying netwroking issue (specifically it means that when the client tried opening a TCP 443 connection to the server the connection was RESET by an intermediate device) This typically is a local enviroment issue so in your case I would guess the chances are the issue is with the local company network rather than the university side.    It will be hard to troubelshoot this over the forum, here are some tips and hopefully this provides you with some more specific insight into where the issue lies.    1. Instead of Pulse Client open a browser and connect to your university server. Example https://abc.university.com/ (if the browser worked i.e. atleast shows you the login page and Pulse client does not it could mean there is a proxy between you and the internet thatis not allowing Pulse Client's traffic to reach the internet/server)   2. If even browser does not work then perform a traceroute to test the connectivity between your local network and the university VPN server. ... View more

Please see below thread, If the solution mentioned there does not work please open a support case and mention the version of the microsoft reliability tool (assuming you are running windows 10)   https://community.pulsesecure.net/t5/Pulse-Connect-Secure/Pulse-secure-stuck-at-securing-connection-and-fails-with-1205/td-p/38183 ... View more

Some further info from other engineers that are working on this issue.  ---- KB4023057 is not a MS patch update instead it an APP. Since it is an APP/Program it will not appear under Installed Updates, instead it will be seen under Installed Programs as shown below: Reference link: https://answers.microsoft.com/en-us/windows/forum/windows_10-update/what-does-this-update-do-in-windows-10-kb4023057/a0744249-1b61-49bf-8e5d-60bf55fddea8 ----   So it looks like previous versions (older than  10.0.14393.10020)  of this reliability tool (C:\Program Files\rempl) from MS is errorneously deleting the drivers for Pulse Secure resulting in the 1205 errors.    If anyone is seeing this issue with newer versions of the relaibility tool as well please let us know.  ... View more

Could it be this windows update? https://support.microsoft.com/en-au/help/4098563/usb-device-drivers-are-removed-unexpectedly-after-windows-update-windo   Let us know if this was it. thanks ... View more

This error is mostly because you are failing some security policies or other checks that your IT that manages the Pulse Secure gateway device has configured. You will have to reach out to the administrator of the device or your IT team to help you (in case they are not familiar ask them to turn on Policy tracing for your username and once you replicate the issue it will provide a detailed report of your login attempt) ... View more

In addition to various docs that are available on the documents section of the website, Pulse Secure also offers a remote installation service which is targeted towards helping customers meet their business requirements through a remote session during which experts can advise and assist you with all the details for your initial deployment. If you are intrested here is a starting point    https://www.pulsesecure.net/services/remote-installation-consulting-service/ ... View more

Based on what you mentioned above I reckon the Web rewriting feature is a going to be the best fit for you (its dynamic and a very advanced parsing and rewriting engine that works with several web technologies/applications). Here is a strating point for relevant config. Let us know how you go.    https://docs.pulsesecure.net/WebHelp/Content/PCS/PCS_AdminGuide_8.2/Task%20Summary%20Configuring%20the.htm   ... View more

Neither, since its a higher client version it will just connect to the server as long as there is no compatability/known issue.  ... View more

For Web based access (web bookmark) the logs will only contain successful and denied web requests. However in your case I suspect the print functionality is not pure web traffic and hence not  being sent via PCS web access method. I think capturing a PCAP when using this application/functionality over  LAN is a good starting point. If it turns out its using non-web traffic then you can configure Pulse L3 VPN client to enable secure remote access to this app instead of web bookmark based access. If its pure web traffic and still not working you may have to open a support case with the logs mentioned in https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB40981 which will allow support to understand why the rewrite engine is not intercepting and securing traffic for this print work flow.  ... View more

If this is for single PCS appliance you can set 'Maximum users' per realm and will help achieve your objective. If this is a multiple PCS appliance deployment and likely to continue growing in terms on number of users you should look at deploying a Pulse License Server which help elastic licensing deployment and allocation ... View more

Hi - Can you try searching kb.pulsesecure.net , top of my head I recollect there was a known issue that resulted in this error which was resolved in newer versions (to upgrade to newer versions you have to contact your IT team that manage the PCS gateway) ... View more

Use the delegated admin role functionality https://docs.pulsesecure.net/WebHelp/Content/PCS/PCS_AdminGuide_8.2/About%20Delegating%20Administrator.htm ... View more

The traffic to internal and external websites will be routed via the internal interface of your Pulse VPN gateway device. And based on your trace route output it looks like its reaching the internal interface of the VPN gateway but not beyond that. So if you do not see traffic on the network gateway (router or firewall) configured on the internal interface of your Pulse VPN gateway device then it must be an ACL ... View more

[url]https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB13295[/url] ... View more

Hi Alex - The first log entry 'ipsec.warn ESP tunnel expired in:0x898A83A6, out:0x45B28332' indicates that the ESP communication channel is expiring. I would check the following: 1. Have your IT admin check the Pulse Connect Secure gateway for the idle and max timeout values for the role assigned to you when using Pulse Linux client. (it is possible you are assigned a different role when accessing from windows which has a longer timeout value) 2. Note the timestamp of a disconnect. Have your IT admin check the 'user access logs' for your ID around that timestamp. This may indicate why your session was dropped. 3. If the timeouts are the not the issue the next step will be to start tcpdump on your machine's physical interface and also on the virtual VPN interface/adapter. Once timeout occurs check the tcpdump captured on physical interface and check the ESP packets (usually UDP 4500) If the ESP packets have stopped arriving from gateway it could indicate an issue where an intermediate device (firewall) has closed the UDP socket. This is not exhaustive list, let us know what you find out. Thanks ... View more

The answer depends on the access method/client you are using (Pulse Secure provides multiple client options to RDP to a backend server) For example if you are using a HOB java applet for RDP access then refer https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB22869 I suggest you contact your company's IT team that manages the Pulse Connect Secure gateway device (vpn server) as they will be familiar with how to enable audio. ... View more

Sounds like your issue is general realm selection and not specific to iOS. Can you check you have mapped Sign-in URL to the correct realm and are picking the correct sign-in URL while signing in? ... View more

So when you get the username/password/realm form and enter your username/password/domain in the form does it not work? Unfortunately there is no setting on client side (as an end user) that you can make which will allow you to perform Single Sign On or credential caching. However your IT team that manages the server (PCS gateway) can easily configure single sign-on and/or credential caching across sessions. ... View more

Please try with default sign-in page first, if that works you know the issue is isolated to the sign-in page your are using. ... View more

Can you try converting your certificate to .spc format (for certificate file) and .pvk (for private key file)? Note: If you ever start deploying/testing a newer release/platform of Pulse Secure VPN solution I recommend you look at using the Pulse client for your remote access needs. The user experience is mostly seamless and has less friction with browser/os dependencies. ... View more

I'm quite sure there is no strict check for verisign issued cert as such, its more about the format, etc so if the cert your provider issues is exactly the same as what verisign provides it should work. Have you tried importing and received an error? BTW what appliance are you on SA2000/4000 or 6000? I would strongly recommend looking at upgrading as these platforms don't get security patches any more. ... View more

Hi - Its hard to guess what may be transpiring without any errors, logs, etc. It sounds strange that nothing happens when you click login. Have you used the feature to customize sign-in pages? If yes I would check the custom sign-in pages or try with the default sign-in page. If you have not customized the sign-in page using your own custom sign-n page package then I recommend installing some form of http sniffer (like httpwatch) to see what the browser is doing when you click sign-in. Is the request being sent to the SSL VPN server? I'm assuming you do not see anything in the user access logs? ... View more

My guess is you have a pre-auth HC policy. This could result in a scenario where, the PCS server, when it received the host checker policy result the realm selection was not yet made so the realm is 'unknown' to the server at this point. ... View more

And under sign-in policies there is a setting labelled 'Restrict access to administrators only', make sure that is unchecked. Though if that was the case login from android would fail as well, unless you logged into the admin session on Android. ... View more

Another step - on the MAC device where it fails open a browser window and type the same URL and see what the experience is. ... View more

Hi - On the server (PCS VPN gateway device) check the 'Sign-in Policies' to ensure the URL/host you configured does not have the admin realm attached to it and only has the user realm. Once that is fixed and if it still does not allow you to sign-in the server side logs are the next place I would check for possible clues. ... View more

I'm glad it helped, I'm sure you are aware but I'll mention it incase you missed it. With the setup you mentioned as alternative a potential downside is that end-users may always go the sign-in page that is configured for local database (local auth server) even if the LDAP/Radius or other external Auth server is available. ... View more