- Pulse Secure Community
- :
- About elevator4
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
since
12-29-2016
Monday
elevator4
Occasional Contributor
11
Posts
4
Kudos
0
Solutions
03-10-2021
11:41:AM
I actually never pursued this configuratio/solution as we were simultaneously looking at another platform/vendor to accomplish the end goal. The other platform is likely what we'll end up using based on progress thus far. Apologies I don't have better info for you!
... View more
02-25-2021
01:29:PM
2 Kudos
Your post caught my eye, as I've been involved in split-tunneling O365's "optimized" category on Pulse as well. Unfortunately I don't really have an answer for you (sorry), but I will share what I'm seeing as there is some weirdness (similar to what you describe). Both 52.112.0.0/14 and 52.120.0.0/14 are set to be excluded from the tunnel on our policy. Out of curiousity, I did some investigation and noticed that for users on Pulse with Split-Tunneling setup for O365, I see nbname traffic (udp 137) is still using the tunnel back to the data center [no idea if that traffic is important or used], but tcp traffic (essentially just 443) is being split-tunneled as desired (based on wireshark captures). I also see some the udp 3478-3481 traffic coming back to the data center, when I expect that to be split-tunneled based on configuration. Kinda strange. I wouldn't expect protocol (tcp, udcp, icmp, etc) to play any role in how the traffic is routed...it should just get routed all the same! Especially since it's the split-tunneling policy is set via IPv4 for this, so no FQDN bugs at play. I would say the bulk of the traffic to these 52.112.0.0/14 and 52.120.0.0/14 subnets is in fact being split-tunneled and going straight to O365 and we have performance gains because of this -- however there's still some traffic coming back via tunnel as you mentioned. Not sure why that is! Certainly would like to hear others' comments or ideas as to why.
... View more
02-17-2021
12:17:PM
1 Kudo
Similar story here. Typically cannot get much more than 20-25 Mbps on a Windows client with a 200Mbps ISP link via an ESP tunnel. Interesting comparison though is that a Mac endpoint on same ISP link gets MUCH better, approx 120 - 150Mbps. Actively working with Pulse Support on identifying what performance gains on Windows are possible.
... View more
- Tags:
- pcs
- performance
- Speed
11-03-2020
11:03:AM
1 Kudo
Greetings! Our organization is looking to deploy Windows machines remotely using Microsoft's AutoPilot feature. There is a one-time domain join requirement in which a VPN connection is required to access on-prem AD -- this VPN connection needs to be establish prior to user login (since setup / domain join is not complete yet). Intune can provison and push down configs, but I am not sure how to configure PCS/client to get a prelogin tunnel established. Is Pulse able to accomplish this? Anyone have luck with this? I've read about Credential Provider, but get hung up on the likely requirement for the endpoint to be joined to the domain (which is not true for this scenario). I've read about doing Machine login, but unsure about the config needed for this as well. This VPN tunnel is a one-time need to join the domain. Once logged in to the endpoint, the desire is to use standard user VPN setup in the Pulse Client, so I'd like anything setup for the prelogin tunnel to be removed (not seen by the user). Appreciate any insights from others that have accomplished this or simply have ideas. Thanks!
... View more
03-26-2020
02:40:PM
Excellent, thanks for the info (I will complete this during a maintenance window for sure). Will users (VPN tunneling sessions) be disconnected from the other 2 nodes already in the cluster when the node is added? I will accept your solution! But another follow-up question, what config will the new cluster member "learn" and what will I have to enter manually? If I remember correctly, I will have to manually enter Network, License, Syslog, SNMP, Archiving (?), Connection Profiles. But "cluster learned" data is: Resource profiles (ACLs), Security settings, Auth servers, Realms, Role mapping, Sign-in pages, etc. Am I right? Missing anything important? Thanks!
... View more
03-25-2020
12:49:PM
I have always been running a 2-node active/active cluster (with an external LB) with PSA-7000f appliances. With recent increased usage I would like to add an additional PSA-7000f. I'm assuming this is possible, but has anyone had experience with this? So essentially, I need to add the 3rd node into the cluster without impacting sessions on the existing nodes. If you have experience or knowledge with this, I would greatly appreciated recommendations! Thanks!
... View more
Labels:
03-24-2020
08:18:PM
I have investigated the same idea and do not believe there is an API-driven or programmatical method to do this -- I could certainly be missing something though. I will be manually disabling when concurrent usage dips below a threshhold to lengthen the life (and value) of the ICE license; in today's day and age it is unfortunate to resort to this, but I that's where I find myself.
... View more
03-07-2019
02:11:PM
Hey, thanks for the reply. Since I'm using the "Detailed Rules" option for each VPN tunneling access control policy, unfortunately there is not a description field available for each rule in these policies. There is a description field for the policy itself, but not the rules. In more recent code versions, the the FQDN field was added for each rule to allow based on FQDN -- but what we need to be added next is a comments field! Oh that would be nice to have a comment field available for each rule. Come on Pulse, add that functionality to the next code version! :)
... View more
02-12-2019
03:09:PM
I noticed on my new install of PCS 9.0R3.1 that the "Activate" button is no longer available when selecting a different ESAP package to make active. I did notice that selecting the radio button of the ESAP version of choice and clicking the "Save ESAP Changes" button does in fact activate what you select, but it's not like it used to be - and not very intuitive either. The 9.0R3 admin guide still has instructions to click the Activate button. Woops :)
... View more
Labels:
01-29-2019
12:49:PM
Hello - Anyone have experience with implementing an external or 3rd party logging server to send Pulse Connect Secure users logs (syslog)? What's your top choice? I have a decent sized active/active cluster behind a load-balancer and have historically jumped between the cluster nodes AdminUI to find the logs where the user is logged in when troubleshooting. I'm looking for an aggegrated solution that is quick to search for troubleshooting/reporting use cases. With all the open source syslog tools out there I'm sure there's something that would fit the need, just haven't gotten around to it. Any suggestions? Would something like Kibana be able to ingest PCS logs and make it easy to search & generate reports? I'd like something fairly simple to setup, perhaps spin up a VM to install it on that would double as the web frontend for searching/reporting. Anyways, just wanted to see what others have done before I venture down the road. Thanks!
... View more
07-24-2018
03:02:PM
I have a need to tag comments to individual rules on Access Control policies. Is there a method to do this? This is mainly regarding VPN Tunneling Access Control policies. There obviously is not a built-in comments field that I can see, but curious if anyone has found an alternative way to do this. Any thoughts or ideas? Even if I could flag a comment in the Resource or IPv6 resource field, that would be useful. But the syntax obviously doesn't seems to allow that :) A comments field on each rule would give me the ability to add change control numbers or general comments on the reason for the rule. I would like to get rid of a separately maintained spreadsheet for change tracking, but without the ability to have comments stored on the PCS device, this is a challenge. Anyways, figured I would see if others could related to my issue and had a solution. Thanks!
... View more
© 2017 Pulse Secure, LLC. Use of this website assumes acceptance of our Legal Notices and Privacy Policy.
Pulse Secure has updated its Privacy Policy effective June 28, 2017.
