Support for TOTP like Google authenticator was added in PCS 8.2R5, see the following for more information:   https://docs.pulsesecure.net/WebHelp/Home.htm#PCS/PCS_AdminGuide_8.2/Using%20a%20Time-Based%20One-Time%20Password%20(TOTP)%20Authentication%20Server.htm   https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB40172/ https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB41050/ https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB40823/   You can contact our Sales team via https://www.pulsesecure.net/contact-us/  ... View more

  If your personal devices can connect with a browser to the university gateway but your laptop cannot on the same home network then that suggests the issue is with the laptop.   Can you connect from your personal phone/laptop from the company network? ... View more

This is correct, https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB43717/ covers this issue with the Microsoft update adding a tool that removes the Pulse driver. ... View more

I have not heard of similar issues, does the Windows Event logs show what is delaying the log off?  Could it be due to the PC trying to contact the Domain controller and that is only reachable when the Cred Prov tunnel is up? ... View more

You will not achieve the speed you have with the raw connection as you are encrypting and tunnelling traffic via Pulse to a VPN gateway.    The speed you can achieve will depend on many factors such as how many other users are connected to the same gateway and the overall bandwidth in use by all the users on the gateway, it is also possible for the administrator to use badwidth restrictions on the connection.   It would be best to raise the performance issue with the gateway administrator and they can review if you are achieving much less throughput than other users or not.   If there does seem to be an issue with your connection speed then they can open a Support case to help troubleshoot why you are achieving less throughput than other users. ... View more

Is it the device certificate that is generating the untrusted erorr or is it due to the CA and/or intermediate certicate in the chain being untrusted?    http://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB40704/ has some steps to follow to determine what is failing in the certificate chain.   If the device certificate has expired then you will need to generate a Certificate Signing request (CSR) and submit it to a Certificate Authority (CA) who will issue a new certificate, see http://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB29002/ for detailed steps.   If the problem is the device certificate chain then you will need to ensure that the CA and intermediate certificates are valid and correct under    System > Configuration > Certificates >  Device  Certificates >    Intermediate   Device   CAs , http://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB17134/ has an example for importing a missing intermediate certificate. ... View more

The Pulse Secure Host Checker uses ESAP packages to detect Anti-virus products and their status.  These are built using OPSWAT SDKs so whenever a product fails to be detected correctly we need to obtain the ESAP diagnostic file via a Pulse Secure Support case (kb.pulsesecure.net/articles/Pulse_Secure_Article/KB28146/) and report any errors to OPSWAT who then create the fixes in their SDKs which are then picked up by us to create a new ESAP package.   There are two current Problem Reports (PR) open for Host Checker failing to detect Norton Security suite v22.12.0.104 in the v4 SDKs (PRS-361134 and PRS-361149) which are both waiting on OPSWAT to come up with a fix. ... View more

SHA256 is currently not an available option when generating a CSR on the PCS device, the CSR can be created externally and the private key and certificate imported, see https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB29228/ for more information.   There is an open Enhancement Request (ER) to add SHA256 support to the CSR generation on PCS, please contact your Pulse Secure account team and ask to be added to the request for ER CSC-I-124. ... View more

For upgrade issues with Pulse and the installer service due to the rebranding from Juniper to Pulse Secure see http://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB40222/  ... View more

Connection Sets should be created and edited only on one device and then copied/pushed to other devices.   PCS8.2R3, PPS5.3R3 and Pulse Desktop 5.2R3 have improvments to help with managing connection sets, https://www.pulsesecure.net/download/techpubs/current/714/pulse-connect-secure/pcs/8.2rx/Pulse-Secure-pcs8.2r3-pps5.3r3-pdc5.2r3-whatsnew.pdf   "Simplified Large-scale Deployments (5.2r3) • The 8.2r3 PCS gateway, the 5.3r3 PPS gateway, and the 5.2r3 Pulse Secure desktop client contain enhancements that help system administrators adhere to large-scale configuration best practices, and simplify diagnosis of deployment issues."     Before these versions the behaviour was that when the Save/Activate button is clicked, the configuration is saved on the server  and  the configuration is pushed to the clients. Pushing the configuration to the clients can cause them to disconnect and reconnect all at the same time, possibly leading to a connection storm.   With the Large Scale Deployment changes clients will update the connection set when they connect next time after the change has been saved in the connection Set.  There is a button 'Update Clients...' on the Connection Set page which will force the selected Connection Set to be pushed to all connected clients, causing them to disconnect and reconnect.       ... View more

There was a change in 8.3R3:    "PRS-350911 Summary: Special characters in Danish keyboard does not work using IE."   There is no Danish keyboard map in the bookmark options, for this to work you need to select Unknown Keyboard type - can you test if selecting Unknown Keyboard will also work for your French-Swiss keyboards? ... View more

The error message in the title is covered by https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB2388 , you must have hit the soft limit as you could continue to connect.   A Role is part of the configuration on the PCS that Pulse/NC connect to and is defined by the administrator, more information is in the Admin Guide starting at https://docs.pulsesecure.net/WebHelp/PCS/8.3R1/Home.htm#PCS/PCS_AdminGuide_8.3/User_Roles_Overview.htm    The Event log is a log file on the PCS availble to the administrator that records any notable events which would include the license count being reached or failures to contact an authentication server, for example.   The Pulse client has a debug log that records messages from only the Pulse client and its components.     As there are many different configuration options available it is usually best to contact your administrator if you have any issues and they can contact us explaining what the user problem is along with what they have configured if they are not able to resolve the problem - without knowing what is configured on the PCS we can only guess and make general suggestions about reported problems as the configuration controls what the expected behaviour is.     Regards,   -- Matt ... View more

It sounds like the administator has not enabled splt tunneling so all traffic is going over the VPN to the internal network so you cannot access the internet sites if it is not allowed via the internal network.   https://docs.pulsesecure.net/WebHelp/PCS/8.3R1/Home.htm#PCS/PCS_AdminGuide_8.3/About_VPN_Tunneling.htm   "With VPN tunneling, the client’s machine effectively becomes a node on the remote (corporate) LAN and becomes invisible on the user’s local LAN; the system serves as the Domain Name Service (DNS) gateway for the client and knows nothing about the user’s local LAN."     So once the tunnel is up, the DNS servers configured on the PCS are used by the client and if they do not resolve the hostname you are attempting to contact then you will get DNS failures. ... View more

Save password is only available on Pulse Desktop not Pulse mobile, see https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB25846/ ... View more

https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB40942/ covers Pulse and iOS11.   Which version of Pulse are/were you using? The KB includes: Pulse Secure recommends upgrading the Pulse Mobile client to 6.4.0 or higher (already available the App Store) while using iOS 11. ... View more

Hi,     It would be best to discuss the various offerings with our Sales team to come up with the best deal for you, you can use https://www.pulsesecure.net/contact-us/ to request a demo; quotes etc.   Regards,   -- Matt ... View more

https://www.pulsesecure.net/download/techpubs/current/1057/pulse-client/pulse-secure-client-desktop/5.3rx/ps-pulse-5.3r3-error-msgs.pdf says the error code is: " 1501 kMsg8021xAMErrNoWindowsProfile No SSID(s) in range for connection request. Verify your wireless network configuration and SSID signal strength and then try the operation again." So the wireless adaptor cannot connect to the wireless access point. Do you have a working wireless connection? ... View more

"source IP sticky" is the persistence setting on the BIG-IP so connections from the same source IP get sent to the same PCS. If the BIG-IP is timing out the user session so the client is then reconnecting and gets sent to a random member of the BIG-IP pool then there is a chance they will not be directed to the PCS that has the existing user session unless persistence is used on the BIG-IP. You can enable the syncing of user sessions in a cluster but this introduces extra overheads, see https://docs.pulsesecure.net/WebHelp/PCS/8.3R1/Home.htm#PCS/PCS_AdminGuide_8.3/Modifying_the_Cluster_Properties.htm , this would allow users to reconnect without having to enter credentials. Another option is to make sure the session timers on the BIG-IP match what is configured for the PCS so the BIG-IP does not prematurely disconnect a valid session, see https://docs.pulsesecure.net/WebHelp/PCS/8.3R1/Home.htm#PCS/PCS_AdminGuide_8.3/Specifying_Role_Session_Options.htm for the Role session timers. ... View more

Kaspersy software can also cause this issue, see https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB40851 and https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB40933 . ... View more

The DNS is not resolving the hostname to an IP address so it doesn't know what to connect to: DSInet.info IVE host vpn..com resolved to , port 443 (dsinet.cpp:329) Remote Address: ip=, port=443, familiy=2 Try adding a hosts file entry for vpn.com and see if that makes it to the connecting stage. ... View more

Cisco Communicator has also been found to cause error 1205 Failed to setup virtual adapter , see http://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB40351/ ... View more

The latest ESAP is 3.1.4 and the List of Supported Products for V3 and V4 (https://www.pulsesecure.net/techpubs/pulse-connect-secure/esap/3.1.x) both list support up to Kaspersky Internet Security ( 17.x ). Are you using ESAP 3.1.4? Sometimes when a new version of an AV is released the methods used for older versions still succeed, so I would suggest trying out ESAP 3.1.4 first. If that fails can you open a support ticket and request that support for Kaspersky Internet Security ( 18.x ) be added to a future ESAP release. If you could also add to the case the diagnostic output from ESAP 3.1.4, it can be downloaded at the same location as the ESAP 3.1.4 package on our download centre, see http://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB28146/ for more details. ... View more

Hi, The remediation message means the admin has configured Host Checker to only allow access if the users have encrypted hard drives (https://docs.pulsesecure.net/WebHelp/PCS/8.3R1/Home.htm#PCS/PCS_AdminGuide_8.3/Configuring_a_Predefined_Hard_Disk_Encryption_Rule.htm). You will need to discuss how to gain access with your administrator who should inform you on what disk encryption you need to use (and what other security policies are in place for VPN access) or provide a Realm where this Host Check policy is not enforced. Regards, -- Matt ... View more

Hi Paul, It sounds like the connection to Outlook gets broken as when Pulse is established it changes the routing so all traffic goes down the tunnel. You can use split tuneling to define what subnets should and should not be accessed via the tunnel or you could set route precedence to Endpoint Routes. See https://docs.pulsesecure.net/WebHelp/PCS/8.3R1/Home.htm#PCS/PCS_AdminGuide_8.3/Defining_VPN_Tunneling_Role.htm "Note: Setting route precedence to Endpoint Routes allows users to access the local subnet regardless of whether split tunneling is enabled or disabled." Regards, -- Matt ... View more

The Junioer KB site has https://kb.juniper.net/InfoCenter/index?page=content&id=TN7 , is this what you are looking for? ... View more

If G-Suite is the SAML IDP then you can role map on the PCS using whatever attributes are returned in the assertion, similar to how you define the User Name template on the PCS SAML SP configuration (https://docs.pulsesecure.net/WebHelp/PCS/8.3R1/Home.htm#PCS/PCS_AdminGuide_8.3/Configuring_Connect_Secure_2.htm) ... View more

It is not something that is qualified but I'd expect it to work as it would be acting as a standard Kerberos client. ... View more

There was an issue where deleted certs were being included in the validity check, do you find that if you “Check Now” at System>Configuration>Certificates>Certificate Validity Check it is listing a deleted certificate that is not installed? If so the fix is in 8.2R5 and later releases. ... View more

There is currently no way to disable the HTML5 clipboard editor on PCS, it acts as an intermediary between the client and server's clipboards, are you able to disable the clipboard on the target server? ... View more