two realms - one with 2FA (non-corporate), one without (corporate). assign both to the same sign-in URL   Corporate realm has hostchecker require & enforce policies checking for our corporate background.jpg, or a company-specific registry setting   non-corporate realm has a hostchecker policy NOT (corporate check).   assign both realms to the same sign-in URL   you should get what you want. ... View more

in the relevant hostchecker policy, do  a new rule of type "Custome: File"   give it a name (no spaces), and in the criteria box type the path & file name.   (In the case of Sophos, I use "c:\program files\sophos\sophos anti-virus\*.ide" )   Tick "required", and in the optional settings put a "file modified less than X days ago"   save that, and back in the hostchecker policy tick "require: any of the above rules"   Alternatively, rather than doing a file check you could just do a process check for the appropriate AV process - but that doesn't check when it was last updated. ... View more

Is the fact your AV definitions file has not been updated since 12/31/2013 03:12:12 related? http://download.juniper.net/software/av/uac/epupdate_hist.xml     All my hostchecker users are failing AV checks - but if i add a manual rule to check for the definition file it works fine for them.   ... View more

Did you ever get a solution for this?   We're looking to do something similar for our Ipad users (junos pulse), but at the moment it's set to "any certificate from a trusted CA" - we want to allow certificates using the CA's custom ipad template, but deny everything else   cheers Mike ... View more

@ruc wrote: I doubt that is the case as HC should allow any client with newer definitions than its own (it only blocks clients with older def versions). I've had experience of this myself when I was only doing 4 hour updates of the juniper AV signature list. If yor numbers are AHEAD of the ones your appliance last downloaded you get the "unsupported product" error message. If your numbers are BEHIND the list, you get the "out of date" error message. Also, some AV products can take a while to apply updates so during the update phase HostChecker may give random errors (eg "real time protection is not enabled). You won't always be able to tell when an AV is updating itself. ... View more

two to three months to add detection for one of the highest market share AVs? that's ridiculous. I know Juniper rely on opswat for the AV detection, but they really should start pressuring them a bit more. Sophos 10 (#3 corporate AV vendor worldwide if you trust their numbers) took over 3 months to get included Avast Free (global number 1 AV product according to OPSWAT, #2 in North America) isn't detected properly on Windows 7 Microsoft (#1 North America, #4 world wide) now two to three months away from detection. it's almost pointless using AV detection on Juniper, because you're going to have to roll your own detections to do it reliably, and that means you lose out on the proper versioning that juniper allegedly provides! Does anyone know where the Security Essentials updates are stored so I can at least make sure it's no more than a week out of date? ... View more

thanks - if they're planning on getting rid of this feature in newer hardware we'll just set the DR site as a standalone and push the configuration to it. we were hoping to leverage the sharing of licenses across the cluster so we wouldn't have to buy more for DR, but we'll just get an ICE license instead. cheers ... View more

the policy trace says applying the (correct) kerberos policy - which works fine if I use the proper server name, but not the alias. I was hoping to get away from ahving to register new Server Principal Names in AD for the aliases, but I guess I'll just have to ho hum thanks mike ... View more

Under the Basicauth/NTLM/Kerberos policies general tab, my Kerberos SSO details are: Realm Definition realm: DOMAIN.LOCAL site name: blank Pattern match: * KDC: (IP address of my domain controller / KDC) IVE Intermediation Label: esupply realm: DOMAIN.LOCAL Credential type: system SSO Policy resources: http://esupply:80 http://esupply.domain.local:80 Action: Kerberos Credential: esupply (no fallback to NTLM) Web bookmark link: http://esupply/login.aspx ... View more

Are they logging on to their client machines with credentials Citrix will accept? If so, provided they can access the XML server & the relevant citrix servers it should work for them. won't work with netconnect if they're logging on to the client machines with different credentials, but in this case you could use the web landing page & publish a terminal services profile which lists their citrix applications instead (and if they still need netconnect, autolaunch that through the web page) ... View more

for option B - is it not simply a case of ticking "register this connection's address in DNS" on the Netconnect adapter? you could probably script it with a logon script as well if you don't have easy access to the machines. I tried getting multiple scopes setup in DHCP on Windows 2003 and it failed, so I just gave up in the end and used IP pools. ... View more

yep, same here. Unfortunately, it wasn't quick enough to stop one of our heads of service complaining that he's paying through the nose for a service that's "down more often than it's up" ... View more

Thanks Matt. I've sent some debuglog.log files off to our supplier, but since it seems to be a juniper issue rather than just something we've done I don't expect I'll get a fix until after our bank holiday on monday ... View more

IM shield and P2P shields are the two others, it's probably looking for one of these (I know in one of the AVG products it wanted webmail protection to be enabled) - the AV checks seem to be complete random as to which element they actually want running when they ask the "real time protection". ... View more

addendum - <USER> and <USERNAME> are not the same thing here. We started with <USERNAME> but it didn't work. <USER> was posting just the user's ID (what we wanted) but <USERNAME> was posting domain\userid which the WI rejected. ... View more

I was getting a similar problem - never showed my Citrix applications, just constantly looping trying to load the page. I had the POST variables either in the wrong order, or missing capitalizations (changed both at the same time so no idea which fixed it) On 6.4R2 these are the settings I have for the initial SSO, but your WI setup may be different. The actual variables you need to post can be found if you do a packet capture of logging on to the webinterface successfully internally - you'll see a POST packet with all the variables you're sending "deny direct login for this resource" and "Allow multiple POSTs to this resource" are both unticked Label - Name - Value User - user - <USER> Password - password - <PASSWORD> Domain - domain - yourdomainhere LoginType - LoginType - Explicit State - state - LOGIN I've also found that if we let users log off the WI without logging out of juniper, they get the "click here to log in again" link which gives similar looping. This needs a custom SSO policy with the exact URL as the resource (not the original login URL), and additional POST variables - again, your best sniffing these off a successful attempt internally. ... View more

we had a similar problem after taking the service account used to bind out of the domain admins group. Trouble was, it worked fine until we rebooted the server, so it was about a month after making the change that things broke. took us most of the afternoon to work that one out. ... View more

ESAP 1.5.5 was released yesterday but isn't linked from the normal download page. Just take the 1.5.4 links, and change the numbers to be 1.5.5 detected sophos v.9 on my own laptop ... View more

Sophos version doesn't check just for "product version", but also "detection identities". (look under the product information bit on the sophos client) sophos release several individual IDE files a day, and if you're more than 10 behind on these files you'll be detected as out of date. It only takes a couple of days to get to the point where Sophos is out of date ... View more

could you post your custom rules for AVG9? got a number of users who were forced to upgrade last week, but I don't have a copy I can check to create them myself... Avast 4.8 works fine for us on Vista & XP - it's just windows 7 users who won't work (running 6.4R2 with ESAP 1.5.4 - I hope when they finally officially support windows 7 this'll change) ... View more