Yes, this is correct.  It would not be recommended to merge roles in this scenario.  I would put a stop rule for the specific role and put this at the top of the list so it will only get the disable split tunnel feature.   ... View more

Since this is from a private ca, these ca would not be installed on the SA by default.  My recommendation would be to install the private ca under the Trusted Server CA list to resolve this issue. ... View more

Hello Brian, Take a tcpdump when you are replicating the issue.  If you do not see a packet leave the SA internal port, you can say it is an issue with the SA device.  If this is the case, we would need to enable debugging on the SA device to clarify if there is an issue with the RSA implementation. ... View more

I have not heard of any issues with checking a file path, but I have heard of issues with Clam AV no longer passing HC after 7.2 release.  There were some changes performed by OPSWAT after Juniper 7.2 release which caused issues with the Clam AV product no longer being detected properly.  Can you please provide your support case #?  I would like to review the logs to see if this is the same issue or not. ... View more

Can you a screenshot of what you look like to remove?  I believe you are referring to the url being displayed under Connections within Pulse UI? ... View more

Thank you for the information.  I have not seen any reported issues for Splunk 6.0, but it looks like Splunk made a change which requires a change in the rewrite engine to resolve the issue. Please open a JTAC case and provide JSAM access to the Splunk resource so JTAC can replicate the issue. ... View more

Hello DF, I have not heard or seen any reported issues with Gogo.  Ideally, JTAC would need the debug logs from the client machine with packet captures from the customer machine (physical and virtual), SA (external and internal interface with filtering for customer source ip and nc ip), and enable debug logs with nc event codes.  This may be a bit difficult considering the end user will be on a flight to gather this data, but a starting point would be the debug log from the client machine. Here is a document what ideally JTAC would need: http://www.juniper.net/techpubs/software/ive/guide s/troubleshooting/How_to_Performance_Logs_for_NC_P ... ... View more

Yes, subscription-base user license should be sold in 1 to 3 year packages for SA and MAG devices.  Yes, meeting license (Junos Pulse Colloboration) are sold as a subscription-based license similiar to the user licenses. Pricing will need to be discussed with the Juniper sales department ... View more

Is host checker being utilized through the browser or through Junos Pulse? ... View more

The only other way that I've seen this work is using ldap attribute to assign a static ip address via ip pool.  (in case you are looking to expand to more users) http://kb.pulsesecure.net/InfoCenter/index?page=conten t&id=KB12536&actp=search&viewlocale=en_US&searchid ... ... View more

Hello Natasha, Yes, we are aware of any issue with start up script with Pulse 5.0Rx.  We are working on a resolution. ... View more

This page is not customizable, but you can make a change in the User Roles > UI Options > Start Page to Custom Page.  This is where you can point to your own start up page where you can make your own changes to. ... View more

The following KB was created for this scenario: http://kb.pulsesecure.net/InfoCenter/index?page=conten t&id=KB29002&actp=search&viewlocale=en_US&searchid ... ... View more

Creating a cluster will not cause any disconnect, but joining the cluster may depending if the VIP is transfered between the two nodes.  To ensure the VIP states on the exisiting node, modify the sync rank higher (in the cluster settings) on the existing node.  This will tell the device to consider the existing device to be the VIP first before the other device. No additional licensing is needed on the boxes unless you considering increasing the load on the cluster to above the existing license installed on the box.  The recommendation is to ensure both devices in the A/P cluster have the same number of licenses.  When the two nodes are joined to the cluster, it will add both licenses from the two nodes to calcuate the total number of users allowed for the whole cluster. ... View more

Leasing is only done in increments of at least 25 user licenses.  This is to avoid constant chatter between the license client and server. ... View more

The best solution is to install the root CA (on the SA device) that signed the ssl certificate to avoid the following message.  I have not heard of any issues between 7.3 and 7.4 in regards to untrusted certificate.  Is the ssl certificate signed by a private ca or a public ca? ... View more

Is 7.1 and 7.4 two separate devices?  If so, you will need to ensure you export the Junos Pulse connection sets from 7.1 to 7.4 using XML import/export.  This will ensure the server-id in the connstore.dat are the same.  When the server-id matches, this will push down the pulse configuration to the pulse client.  If this does not match, this will only create the connection on the pulse client, but will not push any additional configuration within the connection set. This was designed so only the "home" device pushes pulse configurations.  Any additional connection to any other SA device will only create the connection. ... View more

You should see radius packets between the SA internal port and the radius server.  If not, I am assuming communcation between the SA and radius server may be encrypted via SSL which is the reason why you do not see anything.  Since this is the case, the only way to know if the SA is sending data is enabling debugging on the SA.  Please open a jtac case and provide case number.  I can try and assist through those channels. ... View more

It looks like it has the right key usages.  Can you take some screenshots of what appears in the Certificate options within Pulse app?  I would suggest opening a case as well so we can review the Pulse logs and public key of the certificate to get a better understanding why the Pulse app does not recognize your certificate. ... View more

Hello Travis, You'll want to post your NSM question to the corresponding forum to get the proper audience. http://forums.juniper.net/t5/Security-Management/b d-p/SecurityManagement ... View more

Do you have the complete chain installed under "Trusted Client CAs"?  If the same client certificate is being provided in both scenarios, the only other potential issue is how the SA/MAG is evaluating the certificate chain causing the failure. Do you have a case open for this issue?  Ideally, JTAC will need to review a system snapshot with certificate event codes to confirm this theory. ... View more

It would be release noted if there was an issue.   ... View more

Hello After1, I believe you can modify the nc signin page specific for the standalone nc client.  Would this help your scenario?  ... View more

What is the key usage on the certificate?  Is it valid for client authentication?  Do you have a open case with JTAC so I can review the public key of the certificate you are trying to use? ... View more

Failover is not needed.  The configuration is to configure URS to point to each other.  For example, Node 1: Configured for server/client This client: Primary Server=node2 This server: Peer&Client=node2 Node 2: Same configuration, but point them to node 1. Ensure you set the Enable User Record Sync on each Authentication Server with the same name or the setting above will not do anything. ... View more

Here is a comparsion chart between Pulse and NC: http://www.juniper.net/techpubs/en_US/junos-pulse4 .0/topics/reference/a-c-c-nc-comparing.html ... View more

The recommendation would be to upgrade the device that does not own the VIP. When the upgrade is complete, it will automatically upgrade the second device and fail over the VIP to the other device. During this time, user sessions will be automatically transferred over but this will cause a short disconnect for SAM and NC/Pulse users as these applications will automatically reconnect to the new node as well. If end users are utilizing applications through SAM or NC/Pulse that do not support auto connect features (like putty) they will need to reconnect these applications when the tunnel is connected to the new node. In short there should be minimal downtime when sessions are transferred between the two device but be aware of the reconnect scenario. ... View more

Yes, you are correct.  Pulse Desktop 4.0R7 does support Windows 8.1.  Is this the version you have tested with? ... View more

Was there any failover attempt?  It is possible these sessions were not successfully transferred when the VIP was failed over.  The other possibility is end user are accessing the device directly via the external and internal port.  Passive node can still service users regardless if it owns the VIP or not. ... View more

Thanks for the feedback, mmartin. I will discuss this internally to see if we can remove this from the policy trace to avoid the confusion for other customers. ... View more