I am posting the steps again to help clarify how I resolved this issue.   Download the Symantec CA at https://knowledge.symantec.com/support/ssl-certificates-support/index?page=content&actp=CROSSLINK&id=INFO2550 (The expiration date should be 2021) Download the attachement called "Symc_Cross_Root.txt" and rename to "Symc_Cross_Root.cer" Open spotlight search and search for "KeyChain Access" In left pane, click System From the taskbar, click File > Import File Navigate to System_Cross_root.cer and click Open You should see the certificate name "VeriSign Class 3 Public Primary Certificate Authority - G5" (expires 2021) now appears.  Double-click the certificate From the certificate information window, click the arrow by "Trust" From the "When using this certificate" drop down, select "Always Trust" The certificate should have a blue + icon now which confirms the certificate is now trusted by the system. ... View more

Hello Hartmut,   This does look like a bug with the rewrite engine.  However, 7.1 has reached end of engineering for bug fixes.  Currently, we are providing 7.1 releases for only security issues as some hardware are still under support until 2016.  Since SA-4000 can only be upgraded to 7.1, the only recommendation I can make is try to utilize pass through proxy configuration or use SAM / NC or Pulse.   Please note, we have migrated our forum to https://forums.pulsesecure.net/topic/pulse-connect-secure. ... View more

At this moment, I do not have an ETA I can provide to you, but we are currently discussing possible solutions to help prevent and provide further notification when the cache size is too large.   Yes, I am referring to both options under External User Records Management.   If you have any further questions, please post to our new forum at https://forums.pulsesecure.net/topic/pulse-connect-secure ... View more

Currently, there is no way to set an SMTP trap on this value.  We plan to provide this in a future release to help better monitor the system and help avoid this issue.  The best recommendation is to configure User Record Management to avoid the build up of user records which usually consume a large portion of the cache over time. ... View more

Are you connected via ethernet?  I do not think is something we officially tested and would require an enhancement request. ... View more

I think the main question to answer is how was the client certificate installed.  A common mistake is installing a certificate that is no designed for client authentication or installing a certificate without the private key.  Could you provide the steps you used to request and install your client certificate? ... View more

Yes.  All devices should have the same configuration.  To ensure this is correct, you will want to perform a XML export of the Pulse connection sets and import this file to all other SA devices in your environment.  This will ensure all devices have the same ive/server-id and avoid any conflicts. ... View more

Does anyone have a case number I can refer to?  I have not heard of any issues with 8.1RX. ... View more

In the preconfiguration file, there are two GUIDs (ive and the server-id).  The server-id GUID ties the connection to a specific SA device.  The ive GUID is the identifier of the connection.   ive "xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx" { connection-policy-override: "true" connection-source: "preconfig" friendly-name: "connection-name" guid: "xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx" server-id: "xxxxxxxxxx-2363-4810-b43a-2f510a3d5028" uri: "xxxxx.juniper.net" version: "2" }   When Pulse connects to a SA device, it will confirm if the server-id matches or not.  If it does match, it will validate all ive guid stored on the device.  Any matching GUID will be updated.  Any mismatching GUID will be removed.  If the server-id does not match, it does not update any of the ive connections on the Pulse client.   Note:  If a connection is manually created, these will not be removed as there will be no ive GUID tied to these connections. ... View more

Hello Martin,   The following form is sent to our support team which will forward all feedback to the appropriate internal team. ... View more

No certificate should be removed from the SYSTEM ROOT.  We should only need to add the VeriSign G5 (expires in 2021) in the SYSTEM keychain. ... View more

We are working with the vendor to add support for BitDefender 6.x.  Currently, they are still root causing the problem.  Until a fix can be provided, you can check for the bit defender process or file. ... View more

Upgrading with the same major release (8.0RX to 8.0RX) is fine.  If you are upgrading between two major releases (8.0RX to 8.1RX), we documented the upgrade paths in the R1 release notes. ... View more

What connection method are you seeing that using SSLv2? Rewrite, SAM, etc? ... View more

Thank you for the confirmation.  I would not recommend remove any certificate from the SYSTEM ROOT store.  This could cause other issues as the G5 root is used as a trust anchor for a majority of issued VERISIGN/SYMANTEC certificates.  I foudn that adding it the G5 intermediate to the SYSTEM store is enough to workaround the issue.     We are investigating this issue to see if there is any fault on our side and we will continue testing this scenario with each beta release. ... View more

The cert you have added is not correct.  It is showing the expiration date is 2036.  Please grab the one from the following URL:   https://knowledge.symantec.com/support/ssl-certificates-support/index?page=content&actp=CROSSLINK&id=INFO2550   It should state it is valid until 2021. ... View more

Add the following intermediate to the SYSTEM store and change to "Always Trusted"   https://knowledge.symantec.com/support/ssl-certificates-support/index?page=content&actp=CROSSLINK&id=INFO2550 ... View more

It should exist under SYSTEM, not SYSTEM ROOTS.  Do you have a G5 root existing under SYSTEM?  If so, mark this as ALWAYS TRUSTED. ... View more

Not the system log.  The debuglog.log under /var/log/Juniper Networks/Logging. ... View more

Can you please review the debuglog.log and confirm if you are receiving the following messages:   00163,09 2015/06/25 10:23:12.159 1 root dsAccessService dsAccessService p0076 t386F verify.cpp:62 - 'dsVerifySignature' SecStaticCodeCheckValidity failed. (status=-67050) 00221,09 2015/06/25 10:23:12.159 1 root dsAccessService dsAccessService p0076 t386F accessPluginLoader.cpp:113 - 'AccessService' plugin /Applications/Junos Pulse.app/Contents/Plugins/JamUI/uiModelService.dylib, invalid signature 00189,09 2015/06/25 10:23:12.159 1 root dsAccessService dsAccessService p0076 t386F accessPluginLoader.cpp:607 - 'AccessService' trying to create instance on plugin uiModelService while in state 1   If so, I went into my system keychain and found the G5 root was set it as "TRUSTED".  This seemed to resolve the issue. ... View more

Hello All,   Thank you for the feedback on this issue.  It looks like an issue with the Beta 2 release.  I was running Beta 1 without any issues with Pulse.  Once I upgrade to Beta 2, I am able to replicate the issue.     I will be discussing this internally to see what is the problem here.  While we do not officialy support the Mac OS X 10.11 release yet, please feel free to raise any ticket with support if you see any further issues with the beta releases. ... View more

Can you open a case so we can review the pulse logs?  It looks like host checker may be failing, but I cannot tell for sure without reviewing the pulse logs. ... View more

You can configure authorization only access to allow access to exchange.  This feature exists in the SA2000 so you should be able to test the solution before getting the MAG. ... View more

Yes, we should be sending a DHCP release. ... View more

No problem.  I found your email contact and send you a email directly.  Could you please respond with the requested information?  I will try and help get this information to the correct contacts within Pulse Secure. ... View more

SSL acceleration is only a configurable option in the SM-360.   In regards to load testing for L3 tunnel, it will depend on two major factors:   Distribution of packet sizes Distribution of ESP vs SSL tunnels Depending on the distribution, this will affect the max throughput the device can handle.  Since all end user will not be sending the same amount of data at a given point in time, this does not easily equal to specific number of concurrent users.   For example, if you have a lot of idle tunnels, we may be able to increase the number of concurrent users.  However, if we have active tunnels with a large amount of data being sent, we will see a decrease in the number of concurrent users. ... View more