OK, scratch my last message: it works just fine.    As it happens, I wasn't waiting long enough once the network charms bar (if that's its name) had disappeared post-auth, before doing my testing.   For about 10 seconds, DNS resolution is hit and miss.  Once the network icon in the system tray has turned from a wireless signal meter into a computer icon, it seems to all be good.   This makes me a happy bunny - well done Juniper. ... View more

I can confirm that the powershell route lets you specify the URL (and Realm/Role if you want) to the configuration.   However, my setup still isn't working.   The role has: - an NC Access Control Policy allowing access to everything (i.e. Allow *:*) - an existing connection profile (so IP pools, routing etc are all good appliance-side) - Split-tunneling is disabled in the Role. - DNS settings are set to prefer the appliance DNS settings before the client device.   All of this works just fine with ordinary latops and Pulse on iOS.   Under Windows RT, I get a connection established with the appliance, and an IP address allocated from the expected pool.  However: - I have no working DNS resolution - tracert -d to an address in the corporate network just *'s out - tracert -d to an address on the Internet works   Which leaves me utterly and completely baffled.   Any clues before I summon up the effort to submit a JTAC case through my reseller?   --Chris ... View more

That's *really* interesting - and gives me hope.  Although it doesn't behave that way for me...   When you say you set up a realm with no host checker, and it prompts you for the realm, did you actually mean that it propted you for the role?   What version are you running on the appliance?   --Chris ... View more

Well, some form of Pulse client is indeed now baked in:-   Swipe from the right to get the charms bar, tap "Settings", "Change PC Settings", "Network", then "Add a VPN Connection" - choose "Juniper Networks Junos Pulse" from the VPN provider list.    The puzzle, for me, is that it only captures server *name* (not URL), username and password: with nowhere to enter the realm.  (I don't know the situation ref additional authentication, as I can't point my RT device at the realm where I've got that enabled...)   So without being able to specify the realm, I'm hosed!   I'm guessing there's some magic format for the server name or username that will allow this to be specified.  I really can't imagine that it's been omitted... surely?   --Chris ... View more

For what it's worth, I seem to have the host checker working with Lion but not Secure Application Manager (which chokes saying:- "This browser does not use the Cocoa Java Plug-In. 1) Make sure that the JVM 1.4.1 or later is installed 2) Check that this browser supports Java for Cocoa (such as Safari)" To get the Host Checker working, I just had to enable the "Enable applet plugin" tickbox in Java Preferences. Safari needs restarting if these settings are changed. (Oh, this is on 7.1R2 IIRC). --Chris ... View more

You could try planting a certificate on the iPad via a profile (using whatever corporate management tool you have), then check for that cert at the realm/role level depending on how you want to slice & dice things. I've got as far as testing that it works, but didn't get further as that was my annual 20 minutes of blue-sky thinking time used up. Cheers, --Chris ... View more

In your user realm, go to the "Authentication policy" tab, then "Host Checker", and set the policy to "Evaluate", unticking "Require and Enforce". The host checker won't launch until successful authentication. You can then use role restrictions to steer people to roles depending on which host checker policies passed, or use custom expressions to map people into roles depending on the value of the hostCheckerPolicy variable. --Chris ... View more

"You are correct that user-created bookmarks are Windows-only (ActiveX control); however, you should be able to define a bookmark to always use Java when you create the bookmark as an admin (there is a radio button that allows for the applet to always be used and one for use as a fallback). Is this not what you are seeing?" This is exactly what I'm seeing, and it's exactly the behaviour that I think is a bit of a mess, particularly when you're trying to deliver the same experience to users regardless of their client platform. It seems very odd to me that I can force admin bookmarks to use the applet (no use to me, since I actually need the users to create their own bookmarks) but I can't click a tickbox somewhere to force user bookmarks to behave the same way. As it is, I have to write two sets of documentation, and say "If you're using Windows, do this, if you're using Mac OS/Linux, do something else". It doesn't create a good impression, especially when half the userbase know very well that Java can be used to deliver a consistent cross-platform experience. I will bundle all of this up into an enhancement request when I get the time. [Edit: I'm the original poster - I've just got my accounts crossed up as I have one for IDP and one for IVE...] ... View more

I know what I'm about to suggest doesn't answer - directly - your question, but have you considered using the Host Checker to check for your standard set of corporate compliance apps (e.g. AV, asset management, things like domain membership, and so on?) Sure, it's not quite as airtight as checking for client-side certs, but on the other hand, if you don't make it clear to users what you're checking for, it's relatively hard for them to "collect the whole set" and fool your host checks. I use the host checker in evaluate mode, then use rules & expressions in role mapping to steer people appropriately. Cheers, --Chris ... View more

Markus, I know you've asserted that you're switch environment is fine but the evidence you present does suggest factors outside the SAs, especially given that it was all working fine for most of a week and both members are behaving the same way. Certainly no issues here with our 7.0 units, although I confess I don't have a cluster. Questions I'd be asking and checking would be:- What's the CPU usage on the cluster members? Are you seeing slowdowns accessing the admin interface? Are the stats on System->Network->Overview clean? Have you checked all the counters/stats on your switch ports (that connect to the SAs, and to the devices acting as default gateways, if not the switches themselves)? Any ARP clashes, particularly for the internal and external default gateways configured on your SAs? Are you sure you have no loops in the network? Have you checked all the infrastructure between you and the SAs or between the SAs and the environment where your target services are? I'm guessing that's ground you've explored in detail already however... Good luck - it'll be interesting to know what the issue was once you do nail it down. --Chris ... View more

Check the tech press for coverage of the App Store approvals process - it's enlightening :) ... View more

My thoughts - no claim to be correct about this. The algorithm that the SecurID token implements is thought to be public, and if you google it, you can find code that claims to implement it in software. This isn't news. Since any crypto or auth system should not rely on the secrecy of the algorithm for its security, this shouldn't worry anyone unduly.  We could speculate that the worst case is therefore that the seed record/token serial and customer records have been stolen. i.e. an attacker knows the range of token serials allocated to a company, and their associated seed records. In that scenario, a successful attack would comprise:-  - finding an RSA-authenticated entry point for that customer (i.e. their SSL VPN, mostly trivial to do)  - determining a valid username and working out the token serial/seed record that is associated with that user (probably through social engineering)  - sniffing, brute-forcing or socially engineering the PIN Some or all of lockout policies, PIN complexity, suspicious activity monitoring, secondary authentication and robust user education should make this highly unlikely.  At least - that's where my thoughts are right now. What other scenarios have you all been thinking about? ... View more