Is there a limit to the amount of bandwidth a single SSL VPN connection to an SA-4500 can use? We ran into an issue today where a user was trying to upload a large file, in the processes of doing so the CPU spiked from a normal 8% to a high of nearly 30%, during this time the SA device appear to freeze up and all NC session/rdp link began to freeze and lag. When the user was uploading, he was uploading at around 500Kb/s. We are in a corporate office with a 50MB/s line and the SA device is hosted in a datacenter no more than 20 miles away, so we can get great speeds to the device. I am wondering if we are getting too good of speeds. Ther user was connected using ESP AES256/SHA1 with no compression. The device is connected to the network with 1GB Internal and External Ports and total device throughput never got about 800Kb/S. ... View more

I have a pair of SA4500s in active/passive running mulitple IVS instances. One of the instances the active directory authentication just stopped working. Users are able to authenticate still, but the group based role maping is reporting no roles. When I try to test my configration I get: Error while joining domain XXXXX. Possible causes: - The specified administrator credentials do not properly authenticate. - The specified domain or domain controller may not be valid. I have tried recreating the AD domain account, creating a new AD domain account, deleting all the computer objects created in the domain, even setting up a new AD Auth Server and I get the same message everytime. Nothing changed network wise that is preventing this from working, i can confirm the traffic is getting to the AD server. I have setup the IVE computer names to be specific names when joined to the domain, but for some reason those names are not working and it appears to be alwasy Vc00c. This computer object is being created by the service account used to join the SA device to the domain. ... View more

I have started getting random rdp session connection failures for random users on a clusered SA-4500 in active passive. When a user tries to launch an RDP link, they get a session timeout error and are unable to connect. This happens all RDP links including citrix web links. The issue seems to be user related, not computer related. The users can try different computers and still get the same error. However other users who use the exact same role and have the exact same role mappings, are able to connect without issues. Also if you use Network Connect to get to the servers you are able to access them fine. Only happens with web links and it seems to be user specific. The issue is happening to me now as well, I am the admin of the SSL VPN. Friday I was having no issues, I knew of other people having the issue, when I came in today I am now unable to launch RDP sessions. Nothing was changed on the SA device and other users are able to launch the exact same RDP sessions without problems. Weve done all the basic trouble shooting of unistalling Juniper stuff, updating java stuff, rebooting. Even tried new computers. When I look at my firewall logs, I can see the servers sending TCP - Reset commands when I try to connect to them. I am running 6.5R2 and I have looked through all the relase notes and known issues, this does not appear to be listed. I have a case open with Juniper, but has anyone else experienced this issue? ... View more

I have been getting reports of random disconnects over the SSL VPN from users lately. The setup is a pair of clustered 4500s in active/passive with virtual systems on 6.5R2. The device averages about 150 users a day with minimal CPU usage. I have been able to correlate the reported network drops to times when I am making system changes like adding routes/vlans or things like changing a DNS server IP address in a virtual system. A couple of times while adding routes, the cluster actually failed over. One time when this happened the cluster tried to fail over, but the active member wouldnt release the VIP ip address and the fail over got stuck in limbo, disconnecting all nework connect sessions, untill i failed it back. I am not seeing anything in the logs when the disconnects happen, I have worked with Juniper to try and resolve the issue, but they are useless. It only seems to happen to specific users as well, not all users are effecting, only a few random users and always the same random users. They can work fine for a day and then the next day I am doing work and get disconnected left and right. I am planning to upgrade to 6.5R8 Next weekend if you think that would help. ... View more

I am trying to setup my SA700 with IVE 6.5R2 to allow DMI inbound and outbound, but i cant get the inbound working in the first place.  Ive done all the steps required to get it working, I can ssh to the port and get a login screen.  When i type in an admin username and password, as soon as the password authenticates i get kicked out of the SSH session.  The SA device is showing that the user logged in and connected fine with no errors in the logs. Error: "Server Unexpectedly Close the Network Connection" UPDATE: Ok so i gave up trying to SSH to the internal port.  I went through the setup steps to add the device in NSM.  I have two problems, my logs are showing Close - TCP RST for each time the DMI agent tries to connect to NSM server on port 7804.  Could this be because my NSM doesnt have the correct IVE version?  My NSM only has up to 6.4 and Im running 6.5?  In NSM with 6.4 selected it says the device is an SA-2000 instead of SA-700. Info DMI24505 2010-01-13 07:04:41 - ive - [127.0.0.1] System()[] - Outbound DMI Agent lost connection at host: XX.XXX.XX.XXX, port: 7804. Info DMI24507 2010-01-13 07:04:41 - ive - [127.0.0.1] System()[] - Outbound DMI Agent connected to host: XX.XXX.XX.XXX, port: 7804. ... View more