Hi, is it possible to integrate Microsoft`s NAP within Host Checker. Is HC able to understand and to handle SoH? Kind regards g ... View more

Hi, i have one very basic question. i want allow remote nc users access to an intranet webserver with the ip 10.2.2.2 on port 80. An ACL entry like -> tcp://10.2.2.2:80 should be the right way. Is this correct? I ask this because i got confussed after reading the chapter "Use Case: Network Connect Resource Policy Configuration" in the Secure Access Configuration Guide 6.5 on page 667. It seems that in this real world example they explain to use the address range of the nc client IPs in the ACL. Is this example from the admin guide maybe wrong? kind regards ... View more

hi, does anyone know if i can use iexplore.exe as an wsam application. the goal would be to control http/s traffic from remote clients via company proxy. i tried to implemet this scenario in an test environment, at the beginning it seems to work well, but in the end i had many times a " frozen" wsam -> only an reboot helped and at the time when blue screens occured on my client -> i gave up. my question now. supports juniper, iexplore.exe as an wsam application, or is my way just wrong and not doable. kind regards g ... View more

Hi all, i have problems finding a proper way for patching our company notebooks during their vpn sessions. Our remote clients are all windows7 enterprise notebooks with underprivileged system accounts. Because of company policy only patched clients are allowed the full access role at the startpoint of an vpn session. . If the client becomes out of compliance because of an missing patch during an vpn session he remains in the "full access" role and has only to download the patches from company wsus. For internal lan connected workstation we use the update mechanism in the way that downloaded patches gets only installed during the shutdownprocess Because we do not want to interrupt users with an possible necessary and user unapproved reboot after an installed patch. For the remote connected clients we tought about an similar way. .) At the begin of each vpn session, HC on the role mapping level is checking for missing patches. .) If one is missing the client becomes mapped to a validation role. .) In this role wsam starts and runs a startscript on the client -> wuauclt.exe /detectnow . ,) Clients gets connected to wsus and download the missing patches. The problem at this point: The patches are only downloaded, but not installed -> an reboot would install the patches, but wuauclt gives no return value. this mean i can not detect the point when the patchdownload is finished to initiate an reboot -> which would start the install process. i know that some other tools exist which could download and install and even reboot the client but because wsam runs as an underprivileged system account i can not use them. if i set an global wsusrule to download and install patches, i run in the problem that mobile clients within the companylan could be restarted without user approval because an automatic installed patch update needs an reboot. Maybe someone of you guys solved an similar problem or just has an tip for me. Every help is realy welcome. Thanks in advance and kind regards. gerry ... View more

hi, i like to implement nc (ive 6.5r3) for windows 7 and vista clients, and do some research at the moment i found this note http://kb.pulsesecure.net/index?page=content&id=KB9678 &actp=LIST_POPULAR is this still a point in the newer ive version - propably yes! i am in the decission for wsam or nc -> i actually would need nc but  to disable this microsoft security feature makes me not happy. kind regards  ... View more

Hi everyone, we use Microsoft WSUS for patching Client OS. We do not deploy all MS Patches to our Clients, we only deploy intern approved Patches .. This means that the patch version information from the juniper staging site is not helpful, because it includes patches we would never deploy. To use it togehter with HC for our roadworriers, means to manually edit the item "scan for specific patches" at the IVE, each time we deploy new updates. I like to avoid these job and use WSUS patch version information somehow within the IVE, as own staging site - is this possible? Regards ... View more