Hi Paul, The error means that the device is being overloaded. The best course of action is to determine if the ssg5 is definitely the source of the traffic, and then to figure out why it is spamming the IC. I would open an SSG JTAC case to have them troubleshoot the connection issue with you. Regards, Rich ... View more

Since you are using 2008R2, you will not be able to perform "Machine Authentication" as per our PSN: http://www.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2010-09-936&viewMode=view The only workaround is to use a static username and password for the machine auth, or a certificate in order to authenticate the machine accounts. You can also contact your account representative to see if there are any other options available to you and your organization. Regards, Rich ... View more

Just a couple of clarifications to make on Raveen's comment: Assuming that you are not using Server 2008R2, please see the details below: The AD Auth Server must be configured with the NETBIOS domain name of the network, this can be found by browsing to: Control Panel --> Administrative tools --> Active Directory Users and Computers --> Right click on the Domain Name at the top of the tree and select Properties. The value in the field for Domain Name {pre-windows 2000) is what you should enter in your Auth Server. Do not be concerned if the "Test" button returns an error, as long as the rest of your configuration is sound, this will work for you. The defaults which are used for the AD server are typically all that is needed for a user authentication to be processed correctly. If you are still having trouble after following these instructions I suggest opening a JTAC Case for further assistance. Regards, Rich ... View more

Hi Luca, While we do not have the means to automate publishing within the application itself, if you are running the Global Enterprise Edition, theoretically you could leverage the LDAP Configuration Interface within SBR to export the entire config to an ldif file and then script the import to the other servers via the LCI. We don't have any technical documentation for performing this configuration but, I do not see why it would not work. Do you have GEE? If so, I can supply you with some basic commands to export and import the configurations. Automating the process would be up to you though, One other thing to mention is that this method would not be supported so if it did not work, we would only be able to provide "Best effort" support. Regards, Rich Luca wrote: We have three Steel-Belted RADIUS servers running in our network. Currently for them to replicate, I need to go to the primary and publish the config. Is there a way to get them to automatically replicate? ... View more

Hello Panos, I took a look at the logfile which you have attached and can see several issues occuring. Aside from the expired trial license, the most concerning log entry is that the DCF system failed to start. Is this machine joined to a domain ? If so, please try to re-join it to the domain, the dcf errors appear to be related to the Windows Domain module. You would need to speak with a customer care agent to determine your Support Eligibalilty, they can be reached at (888) 314-5822. Regards, Rich panos wrote: Hi Ashish, I am attaching today's log file here in case you have an idea (System date is not accurate). I can see that the licence has expired and I also get some other erros. Am I entitled to open a GTAC case if my licence is expired or do I have to renew it first? Thanks. Regards, Panos ... View more

Hello Sethu, The older versions of SBR do not have a webpage that you can use to launch the administrator, you'll need to download the admin installer from http://www.juniper.net/support/products/sbr/ee/5.4/#sw Let us know how it works for you. Regards, Rich ... View more

I would test the setup with a very simple shared secret, I suggest setting it to 12345 on both the SBR server and the Switch/Router and then test it again. If it works, the issue may have been with the length of your shared secret or, a mis-typed key. Regards, Rich ... View more

Hi Adines, You should be able to deploy the installer through either methods. The only thing that I would be weary of is if the tool you are using to deploy the clients is rebooting the endpoints before the install has completed. There are a series of install logs that you can check to see if any obvious causes for the problem are logged. The files are as follows: C:\Program Files\Juniper Networks\Odyssey Access Client\install.log C:\Program Files\Common Files\Juniper Networks - Each of the components will be in a subdirectory and will also have an install log within which may shed light on the issue. If you cannot find the issue/solution on your own, I would suggest opening a JTAC case. Regards, Rich ... View more

Hey Guys, This functionality does not currently exist, but I think that it would make for a great "Enhancement Request". I recommend speaking with your account reps to have the ER created. Regards, Rich ... View more

Hi Andre, You are correct, there is no idle-timeout that can be configured on the IC. Regards, Rich ... View more

Hello SA, I recommend contacting a Juniper Sales rep or a Juniper Partner for assistance with this item, a link to our contact page is: http://www.juniper.net/us/en/how-to-buy/ Regards, Rich ... View more

Kamran, Dev has refined our handling of L3 authentication requests to help prevent the overload condition you described. This fix is based on PR470726: Webserver/SBR improvements to handle overload conditions. UAC versions UAC3.1R5, 4.0R1 and 4.0R2 and later should handle the load better for you. If after upgrading to UAC 4.0R2 you are still seeing this issue, please open a JTAC ticket ASAP so that we can find out the root cause and have it addressed by Dev. Thanks and regards, Rich ... View more

Hello Vault, The only ways to accomplish this would be through the methods that you mentioned. The settings update file would be the easiest way but, as you mentioned the device/OAC would need to be restarted. You could file an Enhancement Request with your account team to have a feature added that would support your requirements however, this would need to be included in a future release of the client. Regards, Rich ... View more

Hello Telnet, I would suggest speaking with your account team in regards to this request. Regards, Rich ... View more

Hello Zio, SBR will support the 64-bit Windows OS in released 6.1.4, this should be out by mid-November. Hope this helps. Regards, Rich ... View more

Hi Vincent, Unfortunately MS does not provide the functionality necessary to authenticate Web Users against a radius server. Unless you are an ASP programmer with experience in RADIUS and MS APIs, the only solution that I can think of would be a 3rd party product such as http://www.tcpdata.com/radiis_overview.shtml I hope that this helps you in some way. Regards, Rich ... View more

Assuming that you have setup SBR as an Agent Host with the RSA server, you should only need to clear the "node secret created" box in the Agent Host properties and then grab a fresh copy of your sdconf.rec file. In SBR, stop the service, delete the sdconf.rec and sdstatus.12 file from your \Windows\System32 directory and then place your new sdconf.rec file in there. Start the service and then test an auth, I would expect SBR to begin forwarding the requests again and, the node secret should be created after this auth. Regards, Rich ... View more

Hey Joe, This has not been tested but I would setup regmon on the endpoint and see what changes occur when the other NIC is connected. Perhaps with that information you could setup a Registry Host Check on the IC to detect the addition of these other keys and then act on them. Regards, Rich ... View more

Hello Gaurav, There is no configurable setting to modify the amount of concurrent LCI connections that can be made however, due to the possibility of introducing corruption to the SBR database, our mutex prevents more than one change from being processed at a time. That being said, you can initiate more than one connection to the LCI but, don't expect to see any performance gains by doing this. I hope this helps. Regards, Rich ... View more

Hello Raja, I would suggest that you open a ticket with JTAC, this sounds like a bug. Regards, Rich ... View more

Hello, Although I have not run UAC 2.2 in quite a long time, my suggestion would be to upgrade to at least UAC 3.1r5 and then test to see if you are still having trouble. If the issue persists, then I recommend that you open a ticket with JTAC for analysis. The download page for UAC 3.1 packages is: https://www.juniper.net/support/products/uac/3.1/#sw I hope this helps. Regards, Rich ... View more

In addition to allowing nt4 crypto, you will have also have to configure the DC to send LM &NTLM responses as it has been disabled by default in Server 2008 and our Samba code requires it. Regards, Rich ... View more

Hi Aeroplane, Both of your concerns can be addressed by configuring Custom Host Checker policies for your endpoints. I would recommend a Custom File policy to detect what products and versions are installed. For instance: Internet Explorer 8 uses C:\Program Files\Internet Explorer\iexplore.exe. By viewing the properties for that executable and selecting the version tab you will see that it is version 8.0.XXXXXX. These settings can be entered in your Host Checker Rule and will be evaluated and/or enforced on your endpoints. To verify that a PC is a member of a domain, I suggest using a Registry Setting Custom Rule. Domain membership info is stored in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\domain. I would check this key on a domain machine and then just create the rule and enter the information as you found it in the registry. I hope this information is helpful. Regards, Rich ... View more

Hi There, That definitely sounds like a bug in the code, I recommend opening a case with the Firewall JTAC folks. Regards, Rich ... View more

Our EX switches don't display this issue... ;-) ... View more

Hi JP, I am the engineer that was working on the issue that this thread pertains to. The issue was found to be related to our documentation and the fact that UAC requires the NETbios domain name to be configured in the domain name section of the Auth Server. Although this implementation will generate an error when the test button is pressed(a bug), this configuration will allow all authentication protocols to be used successfully. Regards, Rich ... View more

Hi Adith, UAC/OAC does not currently offer this functionality, if this is something that you wished to pursue you could either contact your account team or open a case with JTAC and let them know that you would like to create an Enhancement Request. We may be able to get that feature rolled into future releases if you go that route... Regards, Rich ... View more

Hi Joe, At this time we have only QA'd 802.1x with the Superstack 4400 and the stated build of firmware. That being said, UAC should function just fine in any environment that is following the 802.1x standard. Regards, Rich ... View more

Hello Horsefeathers, Assuming that you are creating an active/passive IC cluster, there will be a Virtual IP address which must be used by all of the devices on the network so that if an event occurs which initiates a node-flip, the devices will still be able to communicate with an IC. The endpoints will not be automatically populated with this new information though, you will need to either push a settings update file or, force the users to login to an agent-realm which is configured to install the Agent that is configured with the new settings. We strongly advise against running OAC agents which are of lower build than the IC. Although most functionality will not be affected, I've seen instances where ipSec tunnels would not initiate due to the version discrepancy along with some other "strange behaviors". That being said, you can certainly disable the "Upgrade Notification" that the users would see by browsing to Maintenance -> System -> Options and then unchecking the box for "Enable automatic upgrade of UAC Agents" I hope this addresses your concerns. Regards, Rich ... View more

You're welcome Husni. I thought of something else that you should consider as well, if you decide to use the Sign-in page to install the UAC client, beware that you should have the users connect at certain intervals so that the IC does not become overloaded with traffic as the clients are downloaded. 3000 users connecting and downloading the client simultaneously would definitely not be a good thing. Many of our customers use Microsoft SMS to push the clients as well. If you decide to go this route, I recommend just using the standard install options and do not try to force a reboot at the end of the install as this has been shown to cause issues due to the asynchronous nature of the installer. To address your question, the only difference between the two products is that OAC requires individual licenses and the UAC client uses a baked-in site license. ... View more