- Pulse Secure Community
- :
- About mtessier_
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
since
10-29-2017
10-29-2017
mtessier_
Frequent Contributor
121
Posts
0
Kudos
2
Solutions
06-16-2015
02:20:PM
Thanks for the info. Because of this issue encountered on our lab servers we decided to roll them back to 8.0r8.1 and then upgrade from 8.0r8.1 to 8.0r11. When we did that upgrade we didn't have to remove the node verification files. However when we attempted to upgrade two of our production severs from 8.0r8.1 to 8.0r11 we DID have to reset the files. Very strange. I hope this isn't the new norm.
... View more
05-26-2015
09:06:AM
Sadly, I'm not going to be able to give you a concrete answer on this one, but I may be able to point you in the right direction. I believe that some HTML5 connections are based on web sockets. Support for HMTL5 features varies by the backend Pulse OS on your MAG. I don't know if the Pulse OS can fully support storefront with the HTML5 Citrix client yet, nor do I know what version would be requried. I'd suggest opening a JTAC case and discuss it with them to see if they have a recommendation. You may even want to restate this question as a new post since it's not really related to the original topic. That way more folks in the forum would get to see the question. Good Luck.
... View more
05-20-2015
08:07:AM
I've upgrade two MAG-4610's from 8.0r8.1 to 8.1r3. In both cases, RSA authentication was broken following the upgrade. We resolved the first one by clearing the node verication file on the RSA server and on the MAG and letting it get recreated. I completed the upgrade of the second MAG this morning and I believe I'm facing the same issue. Just wating for our RSA engineer to check the logs and clear the file. Has anyone else run into this? I've never had an upgrade break RSA auth before.
... View more
04-21-2015
12:48:PM
We're in the same boat. We're planning on pushing out the Pulse Desktop client to several thousand machines. It would be very helpful to know when the patched version will be available.
... View more
03-13-2015
10:31:AM
Interesting. If your organization manages the client endpoints I think that this could be managed at the endpoint through whitelisting / blacklisting. Otherwise you may have some luck using Host Checker deny rules based on the ports, files or running process associated with Tor. Depending on how savvy your Tor users are, they may be able to circumvent these types of rules over time. I'd avoid relying on the user agent strings as these are pretty easy to change and fake. Honestly, I think that this should be part your information security team's responsibility and that they should figure out how to block Tor at the Firewall layer (assuming you have firewalls between your SA/MAG and the Internet). Maybe they could add the addresses of known Tor exit nodes to their Bogons lists or a an explicit deny list.
... View more
03-04-2015
03:41:PM
Any word on whether we need to be concerned over the FREAK SSL vulnerability? Apparently this was patched in OpenSSL version 1.0.1k. https://threatpost.com/new-freak-attack-threatens-many-ssl-clients/111390 https://nakedsecurity.sophos.com/2015/03/04/the-freak-bug-in-tlsssl-what-you-need-to-know/
... View more
03-04-2015
03:33:PM
Kita, No need for a ticket. I did some further investigating and it's working correctly. I was under the false assumption that the MTU configured on the virtual interface was equal to the MTU configured on the SA. You were 100% correct. The MTU on the virutal interface was set at 1400 and the MTU on the SA was set at 1500. I was able to craft packets up to 1400 bytes and send them through the tunnel with no fragmentation. Thanks!
... View more
03-02-2015
03:01:PM
One of our users has reported an issue with an application that they believe may be MTU related. I've been doing a little research and it appears that packets passing through the VPN using Network Connect get fragmented if they are above 1400 bytes. I found this value by pinging across the tunnel with the Do Not Fragment bit set to on and an increasing payload. I found that packets over 1372 are getting fragmented. Add to this amount the overhead of ICMP (28 bytes) and you get an MTU of 1400. Poking through the forums, I found another post that confirmed that the Juniper tunneling adapter adds 100 bytes to each packet's header. Doesn't this mean that we're left with an effective MTU of 1400 bytes on packets from the Net Connect / Pulse endpoints? If so, wouldn't it be optimal to set the MTU on the IVE / MAG down to 1400 to avoid fragmentation for Net Connect / Pulse? Ref: https://forums.pulsesecure.net/topic/pulse-connect-secure/38191-problems-with-windows-7/highlight/true#M7327
... View more
02-10-2015
10:06:AM
I tried to make a user access log filter with a start and end date filter. It appears that the year 2015 and any years after are missing from the drop down. I can understand not having 2016 in there, but 2015 is kind of important.... The access log, event log and admin log filters all stop at 2014. I'm using an SA6500 with 8.0r8.1. The system date and time are correct. Am I just doing something wrong here?
... View more
01-23-2015
08:10:AM
Hi Roberto, I think this might help. There is a Network Connect Launcher utility that can be called by command line, batch file, etc. https://www.juniper.net/documentation/en_US/sa8.0/topics/reference/general/secure-access-nclauncher-overview.html
... View more
01-23-2015
08:03:AM
Thanks for the suggestion. I tested with VPN passthrough enabled and then with it disabled. It doesn't make a difference. I did notice that the issue only seems to affect Network Connect traffic. Traffic handled by the rewriter or the Juniper RDP client are unaffected and work fine as long as Network Connect isn't running. Verizon was under the impression that this is an MTU issue, but they can't explain why it only affects one particular firmware on one particular device. They're now focused on getting a new firmware from Novatel, who makes the MiFi's with the issue.
... View more
01-21-2015
12:17:PM
We've found a very strange issue with our Verizon 4620LE MiFi's running firmware version 3.30.13. Around late December they no longer allow Network Connect to function correctly. We're seeing severe packet loss. Most DNS lookups fail. Persistent pings work for a while and then start failing. Web pages fail to load or only partially load. Other Verizon MiFi devices are not experiencing the issue. Other Verizon 4620LE's with older firmware are not experiencing the issue. Verizon suspects an MTU issue but is pretty much stumped. I'm curious if anyone else has experienced an issues like this.
... View more
01-13-2015
08:44:AM
We use the Premier Java RDP Client for Macs that connect to our VPN. It's the one that is semi-integrated into the SA / MAG. It is licensed separately and works very well. Like you, we do not allow non-corporate devices to have layer 3 access to our network so Network Connect and Pulse are not an option. My only complaint is that user created RDP bookmarks are not compatible with the Premier Java RDP client. So if a uer logs into the VPN with a Windows PC, they can create custom RDP bookmarks and access their remote PCs and servers with the built in Win32 Juniper TS client. If they then log in with a Mac they are forced to use the Juniper TS Launcher to remote control their servers and PCs, which means that they have to carry around their host names or IP addresses. Note that this is a JavaRDP applet only. It does not speak Citrix Metaframe / XenDesktop remote access protocols. You would need Citrix Receiver for that.
... View more
01-05-2015
06:31:AM
John, I still have at least one user reporting this under 2.7.4 as well. I believe the fix for Avast 2015 got bumped to 2.7.5 which I'll be implementing in our production environment in two days. I'll post the results. Release Notes for ESAP 2.7.5: Issues Fixed in ESAP2.7.5 OPSWAT issues fixed 1. CheckRTP for Kaspersky Internet Security 2013 (13.0.1.4190) fails with General Error (PRS-319590) 2. Detection fails for Avast 2015 free anti-virus(PRS-319569)
... View more
12-11-2014
01:32:PM
Yeah.That explains why we didn't see the issue on our 4500s. Kita, any ETA on the arrival of the patch? Thanks.
... View more
12-09-2014
01:45:PM
Kita, I have the same result as flip_pipe. I've uploaded a config and SSL Labs scan to case 2014-1208-0983.
... View more
12-09-2014
06:52:AM
SSL Labs / Qualys reported 8.0R6 (build 32195) as vulnerable as well.
... View more
12-08-2014
02:55:PM
Just got an email about this. https://community.qualys.com/blogs/securitylabs/2014/12/08/poodle-bites-tls I'm concerned that this vulnerability may require a client side patch to browsers as well since TLS 1.2 seems to be the latest version available in IE, Safari and Chrome.
... View more
11-12-2014
06:57:AM
I am also seeing this issue under ESAP 2.7.2. The user logs indicate that it's not recognized. The user has Avast! 2015 Free (2015.10.0.2208).
... View more
11-10-2014
08:18:AM
Dave, is this a user defined RDP bookmark or a server assigned RDP bookmark? Unless something has changed, user defined RDP bookmarks will always attempt to use the Juniper Win32 RDP appled which will not work for Mac - hence the message.
... View more
11-10-2014
07:59:AM
Would it be preferable to just set the RDP windows to full screen for your users? If so you can set the parameter in the HTML for the Hob applet. <param name="WINDOW" value="<<fullscreen>>">
... View more
11-07-2014
11:27:AM
Thanks, ruc. I noticed that the article doesn't speak to Safari 8. I'm not 100% sure, but I believe that Safari 8 came with Yosemite.
... View more
11-05-2014
10:53:AM
Kita, what is the state of official support for Yosemite at this point? Are we still waiting for a new IVE / Pulse version before we can open JTAC tickets for OSX 10.10?
... View more
11-05-2014
10:37:AM
Dave, I believe I have the same version of Java installed on one of my Macs and I haven't see that issue. I'll double check tonight. Can you attach a screenshot and indicate what version of the IVE OS / Pulse you are running?
... View more
11-05-2014
10:32:AM
We have confirmations from our users that Kaspersky 2015 is being detected properly by ESAP 2.7.2.
... View more
10-16-2014
07:38:AM
A couple possibilities come to mind. Most of thet network settings on a clustered pair are not synched. It's possible that one of your SAs may not be able to resolve or route to the back end Citrix server. I'd first check the logs for any clues and then I'd use the SA's Ping, traceroute, and Nslookup commands to validate that the Citrix server is reachable. ( Maintenance > Troubleshooting > Tools > Commands ). Make sure that you don't have any bad static host entries, routes or ARP entries hanging around too. Similarly if your clustered SA's are not connected to the same switch / router / firewall, it's possible that they are trying to take a different path to get to the Citrix server and one of those paths may be broken. If this is the case the troubleshooting would be the same, but the fix would be external to the SA.
... View more
10-14-2014
08:08:AM
We considered doing that as well. Unfortunately going down to 2.6.8 removes support for the following. Windows [Bitdefender] Bitdefender Antivirus Plus (18.x) [Kaspersky Labs] Kaspersky Internet Security (15.x) [Symantec Corp.] Norton Security with Backup (22.x) [Agnitum Ltd.] Outpost Antivirus Pro (9.x) [Panda Software] Panda Cloud Antivirus (3.x) Mac [Intego] VirusBarrier (10.8.x)
... View more
10-10-2014
08:13:AM
I see. I was hoping not to have to do the legwork myself, since I can't seem to obtain the 13.x and 14.x versions of the product to test with from Kaspersky. They only let you download the 15.x version. Can you fill us in on what other products are affected?
... View more
Latest Tags
No tags yet
© 2017 Pulse Secure, LLC. Use of this website assumes acceptance of our Legal Notices and Privacy Policy.
Pulse Secure has updated its Privacy Policy effective June 28, 2017.
