I'm probably asking the same question that dozens, if not hundreds of others have asked...   When using the SA as a reverse proxy, how can I enforce session termination after the user has closed their browser?  I've tried the disable persistent session option, no joy with any browsers that support multiple tabs.   Even if a user has multiple browser windows open, with only one associated with the SA, if they close the SA application window, they can open a new window and bypass the first factor authentication.  Any suggestions would be greatly appreciated.   bws ... View more

I have the sinking feeling I already know the answer to this, but without going into really elaborate coding in the resource policies, is it possible to use the SA as a ptp on ports besides 443? Reason I ask is that I have an web base application that allows for secure file transfer to the hosting website. For the most part all communications are conducted via 443, but when there is an upload, a java script gets triggered and redirects the file transfer session to ports 5000-5002. Here's the kick in the pants, I can't change the application on the inside, nor can I change the ports on the outside. Any suggestions would be greatly appreciated. V/r, bws ... View more

First of all, I don't know if I placed this in the right forum, so if not, my apologies. My rather odd quesiton is as follows: Is it possible to have two different virtual host names that point back to the same internal backend url? Given that the SA barks when I attempt to apply this, my keen deductive abilities are leaning towards no. However, I have to ask. Here's how the whole mess works: User 1 logs into website A, where they are challenged by 2 factor authentication. Once passed, website A provides them with a dynamically generated list of files they can access. User 2 (of a different business entity) also connects to website A and follows the same login process, however the website they are presented with, even though it has the exact same back end host, has a different external virtual name. Yes, I think it's idiotic too, but I didn't design the system and the individual who originally implemented it is no longer with the company. So, in order to buy a little more time for someone else to develop something new, I've been asked to see if this can be fronted by the SA. Sadly, the only way I can get it all to play nicely is if I use an alias for the internal site on one virtual host and the internal hosts FQDN on the other virtual host. Thanks in advance for any suggestions and I really do apologize for such an idiotic question. bws ... View more

OK, I'll admit that I'm very green when it comes to Juniper VPN Appliances and remote access for PC's. However, I'm really curious about a few things. My current remote access environment, the VPN client launches prior to the login, so we can do the machine authentication portion of the Windows security model. Once the VPN session is established, then the user can log in, as if they were directly attached to the corporate LAN. Everything that i've either read or seen so far seems to be ssl and browser based, which is not exactly what I'm looking for. Is there an actual software client that can be installed, using a variety of authentication types, like x509 certs, RSA tokens or smartcards? Thanks for indulging me and my dumb questions. ... View more