The SA uses SSLv2 compatible client HELO to when it initiates an client SSL connnection to a backend server ... View more

Qualys SSLLabs reports 7.4R13.2 as vulnerable on SA6500 but on MAG-4610 !! ... View more

  JuniperCompMgr.exe is downloaded and run from C:\windows\TEMP\   00178,09 2014/11/30 14:22:59.117 4 SYSTEM dsAccessService.exe dsInstallerService p1676 t6F8 verify.cpp:46 - 'dsVerifySignature' verifying signature on C:\windows\TEMP\JuniperCompMgr.exe 00196,09 2014/11/30 14:22:59.127 4 SYSTEM dsAccessService.exe dsInstallerService p1676 t6F8 verify.cpp:219 - 'dsVerifySignature' C:\windows\TEMP\JuniperCompMgr.exe signed by Juniper Networks and verified 00160,09 2014/11/30 14:22:59.127 4 SYSTEM dsAccessService.exe dsInstallerService p1676 t6F8 verify.cpp:236 - 'dsVerifySignature' verifySignature complete with result 1   This version detect the OS as Windows 7 64bit cpp:864 - '***' JnprComponentMgr.exe cpp:865 - '***' cpp:866 - '***' Sun Nov/30/2014 14:22:59 Romance Standard Time cpp:867 - '***' Build Version: 8, 0, 3, 44471 cpp:868 - '***' Product Version: 8, 0, 3, 44471 cpp:869 - '***' Operating System: Windows 7 (64bit) cpp:870 - '***' Service Pack: Service Pack 1 cpp:871 - '***' Internet Explorer Version: 9.0.8112.16421 cpp:872 - '***' User Name: SYSTEM cpp:888 - '***' mfc42.dll: 6.06.8063.0 cpp:894 - '***' msvcrt.dll: 7.0.7601.17744 win7sp1_gdr.111215-1535) cpp:900 - '***' wininet.dll: 9.00.8112.16421 (WIN7_IE9_RTM.110308-0330) cpp:906 - '***' ws2_32.dll: 6.1.7600.16385 (win7_rtm.090713-1255) cpp:909 - '***'   Then JuniperCompMgr.exei is restarted with a command line argument. If a local copy is installed on the system, this version is preferred. Unfortunately this local version is set to run is "Windows XP" compatibility mode     00243,09 2014/11/30 14:22:59.210 3 SYSTEM JuniperCompMgr.exe JnprComponentMgr p11208 t2BCC JuniperCompMgr.cpp:199 - 'JuniperCompMgr::handleRequest()' lpCmdLine=C:\Users\XXXXXX\AppData\Roaming\Juniper Networks\Setup Client\JuniperCompMgr.ini /restart 00332,09 2014/11/30 14:22:59.210 3 SYSTEM JuniperCompMgr.exe JnprComponentMgr p11208 t2BCC JuniperCompMgr.cpp:206 - 'JuniperCompMgr::handleRequest()' Find /restart, re-launch: ["C:\Program Files (x86)\Common Files\Juniper Networks\JSCDT\JuniperCompMgr.exe" C:\Users\XXXXX\AppData\Roaming\Juniper Networks\Setup Client\JuniperCompMgr.ini]     JuniperCompMgr.exe started from "C:\Program Files (x86)\Common Files\Juniper Networks\JSCDT"  sees  a Windows XP 64bit OS, so the upgrade process ends (as Windows XP 64bit is not supported)     dsWinLogserviceApiLib.cpp:863 - '***' ************************************************************* dsWinLogserviceApiLib.cpp:864 - '***' JnprComponentMgr.exe dsWinLogserviceApiLib.cpp:865 - '***' dsWinLogserviceApiLib.cpp:866 - '***' Sun Nov/30/2014 14:22:59 Romance Standard Time dsWinLogserviceApiLib.cpp:867 - '***' Build Version: 8, 0, 3, 44471 dsWinLogserviceApiLib.cpp:868 - '***' Product Version: 8, 0, 3, 44471 dsWinLogserviceApiLib.cpp:869 - '***' Operating System: Windows XP (64bit) dsWinLogserviceApiLib.cpp:870 - '***' Service Pack: Service Pack 2 dsWinLogserviceApiLib.cpp:871 - '***' Internet Explorer Version: 9.0.8112.16421 dsWinLogserviceApiLib.cpp:872 - '***' User Name: SYSTEM dsWinLogserviceApiLib.cpp:888 - '***' mfc42.dll: 6.06.8063.0 dsWinLogserviceApiLib.cpp:894 - '***' msvcrt.dll: 7.0.7601.17744 (win7sp1_gdr.111215-1535) dsWinLogserviceApiLib.cpp:900 - '***' wininet.dll: 9.00.8112.16421 (WIN7_IE9_RTM.110308-0330) dsWinLogserviceApiLib.cpp:906 - '***' ws2_32.dll: 6.1.7600.16385 (win7_rtm.090713-1255) dsWinLogserviceApiLib.cpp:909 - '***' ************************************************************     Check the properties of C:\Program Files (x86)\Common Files\Juniper Networks\JSCDT\JuniperCompMgr.exe. For some reason (can someone explain why), this exe is running is Windows XP compatibility mode.           ... View more

The secondary devices in UK and Singapore are not used in any way. shape, or form via our network, load balancer, etc. yet we see users boucning over to them in the Juniper logs. -> You see users boucing in the logs, did you take a network capture on these "inactive" devices to see if there is real user traffic ? We have SA 6500s in US and UK and SA 4500s in Singapore and in all cases, nearly all users are using Network Connect so we cannot turn off acceleration per your detail. -> Does DNS resolution of SA cluster gives the same result before and after the NC tunnel is established? ... View more

Did you try to set the portal variable <% SET portal = 'My Portal' %> ... View more

http://kb.pulsesecure.net/InfoCenter/index?page=content&id=KB2641 The enforcement of 'purpose check' before importing a certificate has been removed in IVE OS versions 4.2R1 and above. The 'purpose check' could have been reintroduced in 7.1R2 ? ... View more

You should try 7.1. It has a much better handling of the ActiveX installation. ... View more

Do you have traces logs errors messages ? ... View more

If you have an XML backup of 6.3, you can do a diff between XML files from 6.3 and 7.0. Then try to locate the changes en 7.0 and selectively export these changes in XML format. Then rollback to 6.3 and try to import XML files from 7.0 to 6.3 . If you have split changes in "small" XML files it will be easier to adapt export from 7.0 to 6.3 . (XML schema has probably changed between 6.3 and 7.0). ... View more

Could you post the error messages ? My case number for this problem is #2010-0829-0093. ... View more

Do you use "Virtual ports" or vlan ? ... View more

On the fisrt page (LoginPage.thtml) only prompt for "first" username and password. __ <% IF prompt.promptText == 'username' %> ... <% IF prompt.promptText == 'password' %> ... the second page will be displayed automatically (SecondaryLoginPage.thtml) <% IF prompt.promptText == 'Additional username' %> ... <% IF prompt.promptText == 'Additional password' %> ... ... View more

We have problem access terminal server bookmarks for some users after upgrading from 6.5R2 to 7.0R1. For these users, the "Juniper Terminal Services Client" always fails to upgrade/install. The setup ends with "An unexpected error occurred" dialog box. The problem occurs on WinXP, Vista with IE, Firefox or Chrome but only for a few users (different accounts on the same computer can successfully install JUST ) The debuglog.log shows errors (JTAC case opened but still no helpful answers) 00272,09 2010/08/30 21:42:10.215 3 User JuniperSetupClient.exe JuniperSetupClient p3652 t680 dsSetupComponent.cpp:326 - 'DSSetupComponentApplication::getLaunchCmd()' cmd: "C:\Users\User\AppData\Roaming\Juniper Networks\Juniper Terminal Services Client\dsTermServ.exe" /OldInstall 00274,09 2010/08/30 21:42:10.215 3 User JuniperSetupClient.exe JuniperSetupClient p3652 t680 dsSetupComponentMgr.cpp:356 - 'DSSetupComponentMgr::verifyApplication()' verify "C:\Users\User\AppData\Roaming\Juniper Networks\Juniper Terminal Services Client\dsTermServ.exe" /OldInstall 00264,09 2010/08/30 21:42:10.215 3 User JuniperSetupClient.exe JuniperSetupClient p3652 t680 dsSetupComponentMgr.cpp:369 - 'DSSetupComponentMgr::verifyApplication' application: C:\Users\User\AppData\Roaming\Juniper Networks\Juniper Terminal Services Client\dsTermServ.exe 00239,09 2010/08/30 21:42:10.231 1 User JuniperSetupClient.exe JuniperSetupClient p3652 t680 dsVerifyHelper.cpp:184 - 'DSVerifyHelper::verify()' Enter: C:\Users\User\AppData\Roaming\Juniper Networks\Juniper Terminal Services Client\dsTermServ.exe 00182,09 2010/08/30 21:42:10.231 1 User JuniperSetupClient.exe JuniperSetupClient p3652 t680 dsVerifyHelper.cpp:184 - 'DSVerifyHelper::verify()' CryptQueryObject() failed, error: 0x80092009 00285,09 2010/08/30 21:42:10.231 1 User JuniperSetupClient.exe JuniperSetupClient p3652 t680 dsSetupComponentMgr.cpp:422 - 'DSSetupComponentMgr::launch()' Failed to verify StartupApp: "C:\Users\User\AppData\Roaming\Juniper Networks\Juniper Terminal Services Client\dsTermServ.exe" /OldInstall ... View more

You should use the applet found in message 17. https://forums.pulsesecure.net/topic/pulse-connect-secure/41741-proper-rdp-applet-full-screen#M7819 ... View more

Does it works with the standard applet ? I use this code to run the modified applet in fullscreen <applet code="net.propero.rdp.applet.RdpApplet.class" codebase="<< CODEBASE >>" archive="log4j-java1.1.jar,properJavaRDP-1.1.jar,properJavaRDP14-1.1.jar,java-getopt-1.0.11.jar" width="640" height="480" name="ProperRDP-FS" align="top"> <param name="code" value="net.propero.rdp.applet.RdpApplet.class"> <param name="codebase" value="<< CODEBASE >>"> <param name="archive" value="log4j-java1.1.jar,properJavaRDP-1.1.jar,properJavaRDP14-1.1.jar,java-getopt-1.0.11.jar"> <param name="cabbase" value=""> <param name="name" value="ProperRDP-FS"> <param name="width" value="640"> <param name="height" value="480"> <param name="align" value="top"> <param name="Server" value="<<HOST>>"> <param name="Port" value="<<PORT>>"> <param name="fullscreen" value="yes"> </applet> ... View more

Bulletin PSN-2009-10-540 PSN Issue : Client vulnerabilities found and fixed through a combination of internal and external proactive security testing: - A security issue has been identified that could allow an unauthenticated remote attacker to compromise your system and gain control over it. - A policy checking issue in Secure Virtual Workspace. (not applicable to UAC) - A security issue has been identified in Juniper Installer Service that could allow an unauthenticated remote attacker to compromise your system and gain control over it. Solution: Upgrade is recommended to the following or later releases: - SA (IVE): 6.0R12; 6.1R8; 6.2R6; 6.3R5; 6.4R2; 6.5R1 - UAC: 3.0R2 ... View more

Machine certs can't be used directly by users. What could be done: * run the host checker for machine cert but don't reject user if the test fails * use the host checker result (there is a predifined variable) to map roles. See http://www.juniper.net/techpubs/software/ive/guides/howtos/How_To_Host_Checker.pdf page 25 to create role-mapping rules based on a userÕs Host Checker status. ... View more

Pulse client for iPhone in iOS 4.1 ? http://kevpeterson.com/?p=344 ... View more

Do you have configure outbound DMI connection ? ... View more

Do you have configured the DMI connections in System -> Configuration ->DMI Agent ? ... View more

@zanyterp wrote: That is correct; there was a change made in 6.5 for when the JuniperSetupClient was pushed out to users; the 30-second delay was done to allow users time to see the ActiveX prompt and accept it and if they did not then push out the Java applet. Is it possible to reduce this delay ? ... View more

It can happen when users are not allowed to install the Juniper installer Activex control in IE. After 30 seconds, IVE will switch to a Java applet. But this scenario is not related to any change of version, it's purely a client side problem. Delay related to ActiveX should happen with non IE browsers. ... View more

Did you try to put samaccountname=<USER> as filter in "Finding user entries" section and remove "groups" in Query Attribute in "Determning group membership section" ... View more

I have successfully test your full screen applet. Thanks ... View more

Use AD server as the first authentication/ Use ACE server as Additional authentication server and for username field select "predefined as <USER>". ... View more

Go to "Auth. Servers" -> youtLDAP server -> Determining group membership. You can even select the netsted group level (3 by default) ... View more

What kind of authentication server ? Radius, LDAP, AD ? Our MS IAS (radius) server expect that passwords are encoded with Windows-1252 codepage but the SA send "Content-Type: text/html; charset=utf-8" in the logon page headers. So users with specials character could not logon in our domain. (tcpdump shows that special character are encoded as double byte in utf-8 while Windows-1252 use single byte encoding). We have then switch to LDAP authentication, it seems to have solved the problem. ... View more

6.5R3.0 is available Release notes: http://www.juniper.net/techpubs/software/ive/6.x/releasenotes/Juniper_Networks_NetScreen_Secure_Access_Release_Notes_65R31.pdf ... View more