Thanks for the info. Because of this issue encountered on our lab servers we decided to roll them back to 8.0r8.1 and then upgrade from 8.0r8.1 to 8.0r11. When we did that upgrade we didn't have to remove the node verification files. However when we attempted to upgrade two of our production severs from 8.0r8.1 to 8.0r11 we DID have to reset the files. Very strange. I hope this isn't the new norm. ... View more

Excellent. Thank you, Kita. ... View more

Kita,   No need for a ticket. I did some further investigating and it's working correctly. I was under the false assumption that the MTU configured on the virtual interface was equal to the MTU configured on the SA. You were 100% correct. The MTU on the virutal interface was set at 1400 and the MTU on the SA was set at 1500. I was able to craft packets up to 1400 bytes and send them through the tunnel with no fragmentation.   Thanks! ... View more

No.  A ticket is not needed. ... View more

Thanks for the suggestion. I tested with VPN passthrough enabled and then with it disabled. It doesn't make a difference.   I did notice that the issue only seems to affect Network Connect traffic. Traffic handled by the rewriter or the Juniper RDP client are unaffected and work fine as long as Network Connect isn't running.   Verizon was under the impression that this is an MTU issue, but they can't explain why it only affects one particular firmware on one particular device. They're now focused on getting a new firmware from Novatel, who makes the MiFi's with the issue. ... View more

Hi df,   There is some information in this KB12912.   Regards, ... View more

Dcvers, your solution worked! Thank you.   There was a caveat though, which is why it took so long to confirm.   We found that the filter didn't actually take affect until it was disabled once and then re-enabled in the GUI. JTAC is investigating this quirk right now.   For anyone else out there that implements this fix be aware that JTAC recommended to modify the default filter URL to be more specific to our URL as opposed to the *.* that it contains. ... View more

Perfect. That's exactly what I needed. Thank you! ... View more

Yes, the embedded hob and ssh applets needed to be resigned to prevent the blocking message.  This was resolved in 7.4R9   http://www.juniper.net/techpubs/software/ive/releasenotes/j-sa-sslvpn-7.4r9-releasenotes.pdf (Number#19) ... View more

JTAC has provided an update on this issue. They confirmed that the method to determine the OS in Windows based computers has changed from an API to a WMI query.   From JTAC: "We have recently migrated from APIs to WMIs for detecting OS Version. This is because previous API which we were using (GetVersionEx) is deprecated in windows 8.1 onwards. Hence we started using WMI queries. (GetVersionEx API which is replaced with WMI query to support windows 8.1)".   In addition JTAC referenced this KB and Hotfix from MS regarding the WMI corruption that some of our users are seeing: http://support.microsoft.com/kb/2257980   ... View more

Hi PVP,   i am trying to download the ESAP 2.4.6 but seems like i don't have sufficient permission. is there any other way to get it.   my email address is [email protected]   regards Munish ... View more

Not sure how you are completing the login through the Network Connect application as it expects to make a VPN tunnel; however, it is theoretically possible to work. what is the behavior you see when you connect through the browser on these failing machines? ... View more

The default version cannot be removed from the SA.  The files provided by JTAC are the later version of JWT which the issue is resolved.  The same license should apply. ... View more

Thanks, Ken. I appreciate the information. It has been very helpful. ... View more

Thanks for the info. ___kevpeterson.com was a great resource. I wish I would have known about this site a year ago. Anyway, the info on his blog gave me a few different ideas on how to determining our licensing strategy. Thanks! ... View more

we were running in the problem with 6.5R5. the problem occurs when the active node is not the leader. The virus signature update is performed every time by the leader an we were running several times in the described problem. The only chance for us is to manually failover the Active Node to that one Node who is also the Leader. Can you agree the above statement, that the problem only occurss when the active node is not the Leader Node ? Did you solved the problem with an OS update ? ... View more

We are seeing the same thing on our SA2500 running 7.4r7....  Still needed UnsafeMode. -S ... View more