Do you have users that use cell cards or tether their phones? That's really the only time we see this. Our company relies too heavily on mobile connections, so session roaming was pretty much a "must-have" for us. Have you looked in the logs at the users' IP's to see what ISP's they may be using? ... View more

I noticed nobody had responded to you yet, so I figured I'd at least give what I've seen on the forums previously. Perhaps someone will elaborate. As far as installation packages go, Juniper only gives the Network Connect client, Installer Service, and Host Checker. As far as I know there are no methods for building a package for the RDP client. ... View more

Sounds like he wants to check the domain that a machine may be joined to. Our implementation currently uses Host Checker to retrieve the following registry key Registry Subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ Name: Domain Type: String Value: domain.com As for configuring Host Checker to run prior to login, Kevin may have to speak more to that. Our policy is attached to Role Mapping for particular realms and runs after login. I'm not sure how to configure it to run elsewhere. ... View more

In a simple setup like yours, your IP filter would probably just match what you configured in your resource policy. In multiple appliance/site configurations, the filter is one way to break apart which appliances can assign which addresses. As for the external port, many environments require that web traffic only enter the network in a particular segment, and would prefer that both their VPN clients and rewritten traffic from the IVE don't reside in that zone. But for simple implementations you can certainly just one-arm the appliance. ... View more

In our pilot, the WYSE terminals have Windows Embedded installed on them. They boot to a local Windows session, the browser auto-opens to the Juniper login page, and the user signs in. After that, they get a list of their applications right in that Juniper window, and launch their XenDesktop session from there. This method requires an OS on the terminal capable of launching a Citrix shortcut just like any other PC would. It may not be quite as slick as the next scenario, but it retains all of the benefits thin clients (other than perhaps having to pay for Windows licensing). The way I think you and your Citrix consultant my be thinking is that the terminal boots to its basic OS which has the Citrix integration feature installed. This would be configured to point back to your environment to automatically load the XenDesktop session, more like a PXE boot scenario - where instead of pulling the boot information from DHCP it pulls from the Citrix configuration on the thin client. If this is what you have in mind, I *doubt* the reverse proxy could handle it, and there isn't a Juniper feature to directly support this as far as I know. There may be a design using the new Pulse client that I'm not thinking of, however. ... View more

This is an EXTREMELY common thought among Citrix consultants. Having formerly been one, I know that the culture around Citrix engineers is to design things verbatim according to Citrix's implementation documents. There are a few reasons for this, but that's for a different discussion. We currently have a pilot running using the Citrix Listed Applications feature, accessed from remote WYSE Winterms. Are you currently having a problem or are you just wondering if it is possible? - Ryan ... View more

This is configured under Session Options. For the default style applied to all roles that don't have their own options defined, click User Roles > Default Options > UI Options. To create a separate style for a particular role, go to the role's main page and check the Session Options box which tells it not to inherit the default session options. Hit Save, then simply click on UI Options under the General tab near the top of the page. ... View more

I'm assuming you're wondering about configuring resources themselves under either the Role itself or Resource Profiles. Generally, you can achieve the same thing both ways. But what I've found to be best is to make something a Resource Profile if you will be assigning it to more than one Role. If you make Resource Profiles for everything, you'll end up with an enormous list of profiles and a bunch of 1:1 [Role:Resource Profile] mappings anyway. So for example, we have a lot of partner/vendor roles configured, where there really isn't much duplication of resources. They all access different things, so this is where we generally put resources within the Role itself. For our internal employee resources though, we generally make Resource Profiles so that they can easily be assigned to multiple Roles. To more specifically answer your question about roles being a user thing and profiles being more global, the answer is "kind of." While you can map a specific user(s) to a role, it is just as often done by AD or LDAP groups. Resource Profiles aren't "global" per se, since you still need to assign them to roles. But like I said, it's easier to assign Resource Profiles to multiple roles. ... View more

This is the SSL VPN forum, for SA appliances. Your question would probably be better posed in the ScreenOS Firewall forum. ... View more

I'm not sure how the SA is supposed to know you have a port translation in front of it... That's actually the point of a port translation, for the back end device not to know that it is being done. To even have a chance for this to work you'd have to have an intelligent port translation in place, like a proxy firewall handling this. Your best option is probably to contact JTAC support and verify that the default port isn't changeable, or attempting this with a proxy firewall handling your NAT. ... View more

@rswinter wrote: You could check the running services... My Vm server and workstation are both running three services named "VMwareService.exe, VMwareUser.exe, VMwareTray.exe". This is because you installed the VMware drivers in your VM (which not all users do). Also, this doesn't apply to VM's in VirtualBox, VirtualPC, or any other VM environment. ... View more

And strangely enough, as part of their OS 4 announcement for iPhone/iPod Touch, they're claiming "Cisco and Juniper SSL VPN support." It'll be interesting to see what they mean by that. ... View more

I didn't realize that the iPad/iPhone allowed additional network connections, so yeah perhaps that is a possibility. On a related note, apparently Apple announced multitasking support in it's OS 4 for iDevices this morning so perhaps Juniper will have more options in the near future. ... View more

Speaking specifically about Network Connect and Apple's "i" devices, I can't imagine how they could possibly make a functioning vpn client. Something that deals specifically with the web portal is far more likely in my opinion. If you look at other iPhone/iTouch/iPad VPN apps, none of them are true VPN connections. Fortinet's is a dumbed-down version of its web portal as well. The major hangup would likely be the fact that none of the "i" devices allow multitasking. So even if they could create such an app, as soon as you try and back out of the "VPN app" window, there goes your connection! Like I said though, perhaps they can do something with an app for the web portal. But you're looking specifically for the Network Connect client, and given the limited API that apps are given, I can't see how this could be done. ... View more

@jickfoo wrote: Why did you switch to ESP ? I think ESP Is prone to more connectivity issues. I would often see messages in the logs of the traffic failing over to SSL. Thanks, Justin Of course you're going to see messages in the logs about traffic failing over to SSL. Anywhere that UDP 4500 isn't open out of the network - i.e. many hotels, conference centers, customer/vendor sites, etc. We did notice a significant improvement in speed and reduced load on our SA6500's when we implemented ESP. Specifically, file transfers and NetBIOS traffic saw the biggest improvement. ... View more

We're having a disconnect issue as well, but we are currently in an Active/Active deployment with load balancing in front of SA6500's. We're on 6.5r3.1, and are using Radware load balancers to NAT traffic into our network. So this may or may not be related. We see disconnections after one minute when using ESP, pure SSL is fine. Network Traces show a FIN-ACK being sent from the client address to the IVE, and the session will disconnect and fail to reconnect. ... View more