Definitely. When you're defining the WSAM resources, just define the two hosts (with whatever ports are necessary). Only traffic for those hosts should then be directed over WSAM. The resource policies will also need to be in place to allow the traffic through the SSL VPN. ... View more

MAG should work just fine in that setup. Give it a public hostname/IP that allows tcp/443 access through the SRX and then Pulse will be able to connect so that you can access internal resources. Users will need to launch Pulse from their iPhone/iPad before accessing internal resources, unless you use Cert-based authentication on the MAG - then they can use a feature called VPN on Demand to auto-launch Pulse when accessing certain hostnames/IPs. ... View more

You can view the XML configuration export just like any other XML file. (It can be quite large though.) ... View more

I'm pretty sure this is not possible. ... View more

Have you done an upgrade recently? If so you may want to try recreating the OWA resource profile. I've occasionally ran into issues in the past where OWA SSO stopped working after an upgrade. What version of code are you running? ... View more

One place you could start is running tcpdump off of both IVE's. You could first verify that the external packets are reaching the active IVE, and then verify that the internal request and return packets are being sourced and received on the active IVE as well. The problem might be related to stale MAC entries for the internally assigned NC IP's on the directly connected internal switch once a failover is triggered. ... View more

Thanks for all the info. Limitations around failover all sound reasonable. I'm happy to hear that multi-site is possible for any cluster pair in A/A. ... View more

That's good to hear. Is each box on a different WAN & LAN subnet (and not on a shared network, bridged between sites)? Have you tested failover with uninterrupted user connectivity? Thanks, Andrew ... View more

I'm not talking multi-unit clusters (more than 2), but multi-site clusters where 2 units are installed in physically separate locations with independent IP information. The SA-Series HA Clustering datasheet lists the following as features: ¥ Multi-unit clusters and cluster pairs for HA and redundancy across the LAN - Cluster pairs supported on SA2500 and SA4500 - Multi-unit cluster or cluster pairs supported on SA6500 ¥ Multi-site clusters for HA and redundancy across the WAN From that list one would assume that multi-site clusters are an option for all SA appliances, but wording in the document text says: In addition, multi-site clusters allow the SA6500 SSL VPN Appliance to be deployed at different locations and even on different IP subnets, while maintaining state information by synching over the WAN and operating on a single usage license. I couldn't find documentation clearly stating whether or not multi-site clusters are supported on all SA appliances or just the SA6500. ... View more

Thanks for the reply Lionel. Firefox on Mac OS is indeed the primary subject of my post. (I can't stand using Safari.) I was having success with HC & Firefox 3.5 on Mac 10.6, but once Firefox updated to 3.6 that stopped working for me. ... View more