About Maex

Maex · ‎02-06-2022

Hello, that was my understanding of the lockdown mode, but in my config the blocking is only really executed when the Pulse Secure Desktop Client says "Connecting....". Before the "Connecting" state all traffic is allowed, not only the traffic I allow via the exceptions rules. BR Markus

Maex · ‎02-01-2022

Hello, we are having following need: Case 1: Client is connected to the company LAN and connects to an internal VPN server. All traffic is routed via the VPN and a only few services are allowed. Works fine. Case 2: If the client connects to an NON company network, for example a private router, the connection should be locked down and only a few targets should be reachable (we define them in the "Lockdown mode exception rules" section). We are using "Location awareness rules" to check if the client is connected to the company network or not (we us the action "Resolve address"). Lockdown mode is working fine, if the Pulse Secure Client is currently in action initiating the VPN connection, but the lockdown mode is disabled if the Pulse Secure Client is idle (does not need to connect, because he is NOT on the company network). As i see in the manual, this is an expected behavior: "...because Lock-down mode prohibits connectivity only when the Pulse client is in the process of creating a network connection...". The only solution I found is to delete the location awareness rule check, so the Pulse Secure Client continuous tries to connect to the VPN. But this is not a clean solution in my eyes... Anyone having an better idea how to stay in lockdown mode until the client is connected to the company network? Thx! BR Markus

Maex · ‎04-20-2021

Hello, just imported the XML on our A/P cluster, no problem, no switch/-failover. The success of the blacklist ist viewable on "Status - Activity": 5 patch(es) are configured for rejecting harmful URL's. After running the integrity check tool... Pulse Secure Article: KB44755 - Pulse Connect Secure (PCS) Integrity Assurance ...which has to be done on each node, a normal reboot of the current node is executed. This leads to a normal cluster failover with the used settings (ARP-Timeout + 5 seconds AFAIK). BR Maex

Maex · ‎04-20-2021

Hello, the KB says that the XML import "...disables the Pulse Collaboration". Is this for sure, or do we need to untick Secure Meeting on every user role. Thx! BR Maex

Maex · ‎04-14-2021

Hello, we have installed the PDC for our internal clients via SCCM. Current version on the clients is 9.1.10.5655. Since the server upgrade to 9.1R11.3 our clients get the offer to upgrade the PDC on every connect, but we did not set the Default components 9.1.11.8389 as active but the manually uploaded version 9.1.10.5655 (as on the client). So the client must not pop up the upgrade window. We actually disabled the web upgrade feature, but need this for other users where we cannot use the SCCM installation method. Any idea how to fix this? Also the installers section does not show the same version (9.1.10.5655) as the the components section (9.1.11.8389). As of the revision number of the MSI, downloaded from the installers section, it is really the 9.1.10.5655 Awful week :-( BR Maex

Maex · ‎04-12-2021

The KB got updated: Pulse Secure Article: KB44781 - Multiple functionalities/features fail for End-Users with a Certificate error.

Maex · ‎04-12-2021

Hello, very bad situation. We opened a ticket. The root cause is also the expired code signing certificate (April 12th 2021). We asked if it will also impact the Pulse Secure Client L3 connections, perhaps tomorrow morning, but the answear was not really clear. Same situation in the latest Version 9.1R11.1, the same certificate is used there.

Maex · ‎05-18-2020

Good Morning. We are using the lockdown mode for our VPN connection (machine or user), but need some "Lockdown mode exception rules" to be able to reach the mobile client from our office LAN for supporting purposes. But as it seems, these "Lockdown mode exception rules" are not working for the machine tunnel but only for the user tunnel? In detail, the inbound rules are not working, I can see outbound traffic towards my office LAN. We are running on 9.1R1 (build 1505). Are there any logfiles recording the accepted and blocked connections? Thanks! BR Markus

Maex · ‎12-13-2018

Hello. Since the update to 9.0R3 the "Allow new TOTP user registration to happen via external port" has to be checked also for the normal logins on the external interface, not only for the first time registration. Looks like a bug. Can anyone reproduce this issue? BR Markus

Maex · ‎06-10-2016

Hello, since the upgrade from 8.1R6 to 8.2R3 we get UAC prompts for nearly all component upgrades (Network Connect, Pulse Secure Client, ActiveX, ...). I read that this behaviour also was found in the 8.1 path and was fixed in 8.1R9 "PRS-339308 - Admin privilege prompt occurring after upgrading to 8.1R8 with an earlier Installer Service version on the client PC." Is this also fixed in 8.2R3? Will the "Juniper Installer Service" be auto-upgraded to the new Version? I found that the Service is now called "Pulse Secure Network Service" and the original installed service disappeared. We currently still deploy v7.1.0.19525 to all our notebooks. Is this too old for the current 8.1/8.2? The "Juniper_Installer_Service_FAQ.pdf" says: "11) I installed Installer Service on many laptops when it was introduced in 4.1.1 Build #6951, now I have upgraded IVE to 5.2 R3 release. Do I need to upgrade the installer service? The installer service is compatible with all IVE versions and does not require any upgrade." Is is better to jump to 8.1R9 and then to 8.2R3? Thanks! BR Markus

Re: Lockdown Mode

Lockdown Mode

Re: SA44784 - Does workaround XML import cause clu...

Re: SA44784 - 2021-04: Out-of-Cycle Advisory: Puls...

Re: Post-9.1R11.3 upgrade client-side steps

Re: Terminal Service does not work for Home Office

Re: Terminal Service does not work for Home Office

Lockdown mode exception rules

TOTP failure

Admin Account Problems after upgrade from 8.1R6 to...