I once found a Juniper document suggesting this:   launchctl unload /Library/LaunchAgents/net.juniper.pulsetray.plist ... View more

I opened a JTAC case for an official response, but the best I got out of the engineer currently is that they're aware of the issue and their security team is reviewing it. ... View more

We only tested with the https://ourvpn.ourdomain.ourtld URL, no differentiated sign-in pages.   We did not have any host checker or posture checking at this test. Authentication is basic password/RADIUS.   Amusingly, when using a web browser to log in, it still offers the standalone Pulse installation, despite having an in-box client. With the standalone client installed, it works.   I'll go ahead and open a JTAC case to figure it out, thanks. ... View more

This is helpful, since it's exactly the problem we face as well -- since Juniper seems in no hurry to make a Linux version of Pulse available (yes, we've talked to the account team and others), and now Mavericks only supports Pulse, we've had to split our client base. Unfortunately, depending on our users profile they may end in one of several roles (determining which virtual interface they're on, not really mergeable attributes), so it looks like we'll need to duplicate all of our roles now :-( ... View more

Thanks, that's what I figured.   It has to do with compromised accounts. Since we do not limit maximum session duration, just locking the account allows someone to remain online if they established the connection before the compromise was discovered.   (And yes, I realize this is asking to solve blatantly obvious policy/organization issue with a technical workaround.) ... View more

Having requested this from our account team for years now, I think I can repeat the earlier statement someone made that Juniper appears to have no interest in supporting 64-bit Linux.   The other pain point is the lack of Pulse client for Linux, so right now it appears there won't be any IPv6 support for Linux either, 32 or 64-bit. ... View more

I do. And as said, it doesn't return an error; the input boxes go away, and it just sits there without getting to the desktop. (Aside from the user confusion factor of having the same prompt for different credentials.) Just to add: The System log, Application log and Security log on the system show no entries at all corresponding to the login attempt. That's windows logging for you, I suppose. They show my previous and subsequent logins using the user tile, rather than the Pulse tile. ... View more

No solution here, but we'd like at least the the NC and Pulse connections as well. Right now, as far as we know, the only way to know how many users are connected is to log into the web interface of the box, and that's kind of ridiculous. (On the other hand, kudos to Juniper for easily giving you the MIBs for other stuff on the box.) ... View more

Has anyone else run into trouble with this? I see the tile, the connection is established (see it on the SA, IP assigned etc.) but the Windows login process (Windows 7 Professional) remains in the "Pulse is connecting to X" screen with a cancel button, and never proceeds to actually log the user in. Policy tracing suggests things are going just fine, session created, roles mapped etc. Incidentally, as far as I can tell, the user must select "switch user" to see the Pulse tile. Even if the option to start as part of the login process is selected if the user just uses the Windows default of the previously logged in user, the VPN never triggers. Is there a way to work around that? ... View more

@NULL wrote: Hi Jspanitz, the solution for you is probably to limit the Supported Antivirus Solutions in the HostChecker Rule. Have a Try and enable only 1-5 different Antivirus Vendors for Check. If you then can connect without any problems try to evaluate which Antivirus Vendors do get used most by your Workforce/Customers/Partners. So you can enable Check only on those few really needed Antivirus Systems, and your problem should be solved. regards NULL Not sure why the KB article number doesn't show up above, but I'm assuming the reference was to KB21443? Anyhow, do you know if it is necessary to have AV AND firewall selected, or will the issue appear when all AV are selected, but no firewalls? If it affects AV checks even without the firewalls, that's yet another major problem for us... ... View more

The upload speed issue only seems to occur when NC addresses are outside of the local subnet of the SA interface, and for some reason when using external DHCP the NC changes the netmask to a /32. There's no issue with DHCP per se (aside from an issue with the secs field which is being fixed), it's just a possible/likely cause to trigger the speed issue. ... View more

Very poor upload speeds when using NC on a mac, and NC addresses are assigned by an external DHCP server. ... View more

We were told that it would be in the works a year ago when we purchased the product. The new account team claims this was no true, but we're one more fairly large customer that has definitely requested it from two account teams now. ... View more

This is additionally ironic as we have a case open for Network Connect for Mac where Juniper claimed OS X Lion would fix it. If "fix" means "it's not supported, so it's not broken anymore" I suppose they did. ... View more

We've seen this, reverse lookup identified Verizon as the ISP. The user claimed they were in a wired office environment rather than on 3/4G. We never did get to the bottom of it, but enabled roaming for them. The IP's weren't even remotely close either. ... View more

Got help from Juniper TAC. Mac speeds being slow is a known issue, KB19197_. I'm not sure why I didn't find this during my search of the KB. The workaround with ipchains doesn't appear to stick, though, contrary to what the KB article states. ... View more

Just to clarify when I say unusable, doing the same file transfer without the VPN: 26 Mbps. With VPN: 500 kbps. ... View more

What happened with your case, out of curiosity? We're running 7.1R2, and just discovered Mac upload speeds on Network Connect are completely unusable. ... View more

We too have been trying to find a way to give the user a clear visual indication that their NC connection has been successfully established -- directing them to a custom page would certainly work. I am, however, a bit unclear on how to do that. Any advice would be appreciated. ... View more

We have a similar problem. Outside consultants require the use of NC to get to our systems, and they're complaining that another one of their clients also has a similar requirement, but runs a different code release, so they have to constantly upgrade/downgrade their clients to be able to connect. I'm not aware of any way to get around it, but is there any sort of solution for people who do have to connect to multiple SA appliances that are running different code releases? ... View more

No, sorry, no solution. Let us know if you come up with one, though! ... View more

I understand that Pulse is client software, but in IVE 7.0 under roles->NC there's a pair of radio buttons for selecting NC or Pulse for client connections; in 6.5R4.1 there isn't. I could see that connecting to 6.5R4.1 with a separately downloaded Pulse client might just be an undocumented feature, but the other thing missing from that IVE screen is the "JunOS Pulse Settings" tab -- would the Pulse client for 6.5R4.1 just use some default settings that aren't changeable, unlike 7? Or is this just for the 6.4 train, not 6.5? Or, possibly more likely, is there something obvious I'm missing? ... View more

User error, as usual. Packet capture clued us in on random RST flags, which clued us in the fact that someone had reused one of the test-IVE's VLAN IPs, and the duplicate host would, whenever it won the ARP contest, reset the connections. Lesson on documenting setups, even in lab environments. :-) Thanks for the help! ... View more