About mooo_

mooo_ · ‎05-04-2011

Yes, this was with split tunneling enabled ( instantproxy file I've checked was in Juniper networks folder somewhere in Documents - not sure if there is more of those .pac stored during session) Regarding to function return values - for proxy it is always proxyname:8080 . We use 8080 for all our proxies - 8080 should be default value for many proxy vendors...

mooo_ · ‎05-03-2011

Well, I've tested with split tunneling and it works perfectly. PAC file used by IVE is containing one regular function FindProxyForURL(url, host) followed by conditions for DIRECT & PROXY access. This function should return direct or proxy_ip: port instantproxy is smoothly different... It begins with function FindClientProxy(url, host) - not sure if this one has any purpose : function FindClientProxy(url, host) { return "DIRECT"; Next is function FindServerProxy which contains all the expresions from the original PAC : function FindServerProxy(url, host) And last is : function FindProxyForURL(url, host) { if (shExpMatch(host, "IVE_URL")) { return "DIRECT"; } else { return FindServerProxy(url, host); } I assume that it is done this way to distinguish traffic destined to IVE and the rest of connections.

mooo_ · ‎05-02-2011

Hi guys. Just wondering if somebody had similar issue... I have users connecting from Internet via NC to company IVE cluster. PAC file is in place so they can access public webpages through Bluecoat proxies. However they cannot open ICA connections to regular public Citrix servers when connected through NC. Problem is that these ICAs are working when they access it directly from company intranet - they use the same PAC file as NC is using... Colleague did some captures and found out that ICA traffic is routed from cluster directly to Citrix server instead of sending it to proxy... So it seems that Citrix client is not able to get PAC file correctly from IE - but only when connected through netconnect. I can bypass this easily by allowing traffic on firewall or enabling split tunneling but this would be considered as security policy violation as all user Internet traffic should pass proxy... So trying to find some other solution... Cheers

mooo_ · ‎10-18-2010

Thank you so much for explanation :)

mooo_ · ‎10-14-2010

Hello I'm going to upgrade our 6500 Active/Passive cluster with central manager. If something happen and I will need to do a rollback... do I need to break the cluster before the rollback ? Guy from JTAC told me that I need to do so, but I can't find any mention about this anywhere in the documentation... As far as I know the rollback should affect the whole cluster so I don't see any reason to break the cluster. Thanks for help

mooo_ · ‎10-14-2010

Hello We are troubleshooting some problems we have with hostchecker and when I wanted to check client side log file dsHostChecker.log I have found out that there is none in Host Checker folder. checkbox Host Checker is turned on in Log/Monitoring/Client Logs/Settings on SSL box Also there is entry in the registry under HKEY_CURRENT_USER \SOFTWARE\Juniper network\Host Checker\Debug\dsHostChecker\ LogFile(value) - dsHostChecker.log(value data) SSL box is 6500 running 6.4R4 (build 14811) Any idea what the problem could be? Thanks

Re: NC/PAC file <-> Citrix problem

Re: NC/PAC file <-> Citrix problem

NC/PAC file <-> Citrix problem

Re: HC client-side logs missing

6500 cluster rollback

HC client-side logs missing