About r@yElr3y

r@yElr3y

@chiwanpark @je-vv OpenSSL 1.1.1f + curl 7.74

r@yElr3y

Thank you for the feedback.

r@yElr3y

@Mistouf so user authenticates before host checker i.e. post-auth check should not timeout and ask for reauthentication, since the user is already authenticated. Can you please open a support ticket with us as it'll require client/server side logs to reviewed? What happens if the user manually updates the AV before connecting to VPN? In that case, do we still see the Pulse client trying to update the AV which is already updated?

r@yElr3y

@zxcv1234sa Oh... do you still see the old download center portal in my.pulsesecure.net? I thought the portal was completely switched to LADC one for everyone..

r@yElr3y

Does it take more than 2 minutes to complete the AV update process? When the user/pass prompt appears.. before or after host checking?

r@yElr3y

Updated curl to 7.74 in my Ubuntu 19.10 and 9.1R10 Pulse Client seems to work fine...! Can you please upgrade the Pulse Client to 9.1R10 and check the behavior?

r@yElr3y

@wuyangff95 Please try repairing the Pulse Client installation. Do a search for "Repair Pulse Secure" in Windows and run the repair utility. Let me know if the repair doesn't fix it.

r@yElr3y

@Jpurple17 Sounds like the extend session feature might be disabled on the VPN server side. BTW, do you see the "Extend session" option listed when right-clicking on the connected session in Pulse Client? If not listed, then it's disabled in the VPN server. If listed but not prompting to extend, then the session extension notification is disabled on the server side. In either case, you would need to contact the VPN admin team or IT helpdesk to report.

r@yElr3y

jroth@binghamton.edu It is not supported. We cannot export TOTP data from the VPN server.

r@yElr3y

@amermet Did you get a prompt to reauthenticate while reconnecting? or does it get reconnected automatically? Do you see the behavior when using a different network like mobile hotspot?

r@yElr3y

@Pierre It is expected to see such behavior if the WiFi or LAN adapter gets disconnected/temp. turn off by Windows OS. In such cases, Pulse Client should automatically reconnect but still some apps that are responsive to network changes will notify the users or users intervention is needed.

r@yElr3y

@jonathanw84 Answer would be...yes, we have to configure a rule for other OS to avoid failure events or use separate realm for other devices/OS.

r@yElr3y

@Mistouf Pulse Client should re-evaluate the machine after downloading the virus definitions (expected behavior). My understanding is that the Pulse Client will be checking if the download has been completed with some random timer (& continue to recheck), then connect to VPN automatically. Based on your issue description, there might be problem with that status check. BTW, is it stuck with "U pdate in progress,once update done you will connected to network pulse secure" message???

r@yElr3y

@Pierre Have not tested or saw similar issue reported to Support. Is it possible open a ticket with us to investigate this behavior further?

r@yElr3y

@abro0004 FIPS mode in Pulse Client will be enforced by having the connection store (connstore.dat) updated with value FIPSClient: "true" Did you choose NOT to save the configuration while uninstalling the Pulse Client? if we continue with default (YES), then the FIPS setting will be retained. # VPN server's connection profile can also be changed to have a secure Algo. like ESP AES256/SHA256, and that should also resolve this issue.

r@yElr3y

einar.bjorgvinsson@marel.com Sounds like a control channel disconnect caused by some ISP or Firewalls if the TCP channel doesn't send any data for more than 5 to 10 mins, which is true in the case when VPN connection is using ESP data channel i.e. TCP control channel will be only having keepalives sent back-forth b/w client and VPN server. Do you see ESP payload sent out from your physical interface? If possible, please switch the VPN data channel to SSL (config change on the server side) and check the behavior.

r@yElr3y

@Jforio08 Route print shows that the user is getting Full Tunnel access role from the VPN server. If the user is not able to access any resource after connecting to VPN, then please check the VPN's ACL and reverse route for the VPN user traffic. If the user should not get VPN tunneling, then we have to check the VPN server configuration and remove that feature.

r@yElr3y

@zb Pulse Application Launcher (PSAL) is not meant for standalone operation or launch. PSAL will be used only to launch the installed Pulse Secure components (if not, it will send notification to Pulse Setup Client to download and install the same). If you have Pulse Client installed, then please start the client and connect to VPN directly from the client, no need to open PSAL application.

r@yElr3y

@zxcv1234sa I see 9.1R10 listed,

r@yElr3y

@Dioma Assertion is not yet Valid means VPN server thinks that the Assertion's valid has not started, please check your VPN server time settings (System >> Overview >> Date & time settings) and fix if you have time skewed more than 5 minutes.

r@yElr3y

@Rmatt macOS Big Sur 11.1 will fail to pass hostchecker regardless of the rule type which is being evaluated, hence please request your VPN administrator not to enforce HC policies for macOS systems.

r@yElr3y

@Rmatt We would need to look into Pulse Client debuglogs for identifying the root cause. There are issues with macOS 11.1 version - https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB44663/?kA13Z000000fzSK macOS 11.0 has the following open issues -- HC related to OS checks --- https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB44592/?kA13Z000000fzMW

r@yElr3y

@hushkin Nice...! Thank you for sharing this info. :)

r@yElr3y

@DaveG Please prepare a test-plan before migrating from OPSWAT v3 to v4 SDK in your production setup as it might cause some unexecpted issues like AV not being supported, detected, failure to parse correct information, etc. Hence, please test the setup by activating the newer SDK on a test environment with handful number of testers. Below KBs should provide some of the key highlights when it comes to OPSWAT SDK migration: https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB40318/?kA1j0000000WywG Process based Host Check for unsupported software -- https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB22348/?kA1j0000000FjLL

r@yElr3y

@djgonzal Wireless LAN service installation should be fix this issue. If not, please do a deep clean by deleting all files, folders, registry keys related to Pulse Secure/Juniper Networks, reboot the server and attempt to install the Pulse client again.

r@yElr3y

@bobco Session Extension feature should resolve this issue. Please check with your VPN team for enabling session extension for VPN clients.

r@yElr3y

@Vinz129 Importing old version configs on to a new version is supported and should work without any issues. However, I would not import configs from 8.0Rx into 9.0Rx as we are almost skipping more than 2 branches...8.0Rx >> 8.1Rx >> 8.2Rx >> 8.3Rx >> 9.0Rx. Just to be on the safer side, I would not import configs from a version which is 2-step away from my current. So my way of doing would be export 8.0Rx >> import to 8.2Rx >> export from 8.2Rx >> Import to 9.0Rx.

r@yElr3y

@Dioma So it's IDP-Initiated SSO if you're initiating the login from the Azure portal. Can you please check the SAML response that's being sent to the VPN server and check if it's sending the correct SAML response because somehow the VPN server thinks that the Azure is sending SAML Artifact request instead of SAML POST.

r@yElr3y

@wanakule Do you see any blocked extension from "Pulse Secure" under System preferences >> Security & Privacy >> General >> Allow the blocked extension and check the behavior. What do we see in the macOS install logs while it's stuck? Please search for Console application (spotlight search) and then look for install.log under log reports or directly open it (/var/log/install.log) in any text editor. Reference - https://www.intego.com/mac-security-blog/how-to-use-the-console-app-for-troubleshooting/

r@yElr3y

@Dioma Users are being redirected to Azure for authentication when accessing the VPN server URL from the browser, and receiving this error after redirected back to VPN post authenticating with Azure, correct? Error states issue with SAML Artifact parameter missing, are we using SAML POST or Artifact method? Can you check the SAML metadata and see if you have SingleSignOn URL set as HTTP-POST and HTTP-REDIRECT value with the callback URL pointing to Azure?

Re: Linux Pulse Client does not work with curl 7.7...

Re: MD5 no allowed in FIPS modes (Error:1216)

Re: Not logged in after downloading new virus defi...

Re: Is Pulse client secure 9.1R10 released ?

Re: Not logged in after downloading new virus defi...

Re: Linux Pulse Client does not work with curl 7.7...

Re: Pulse Desktop cannot connect after accidentall...

Re: Issues with extending session

Re: Export TOTP to an external TOTP server

Re: pulse secure client continually reconnecting

Re: Pulse Secure Client Vs Connected Standby

Re: Pulse Host Checker Policy For Only 1 OS

Re: Not logged in after downloading new virus defi...

Re: Pulse Secure Virtual Adapter Vs. Modern Standb...

Re: MD5 no allowed in FIPS modes (Error:1216)

Re: Client v9.1R2 disconnects after 5-10min on Ubu...

Re: Default route issue

Re: Detected incorrect data from server (another).

Re: Is Pulse client secure 9.1R10 released ?

Re: Azure SAML issue

Re: PulseSecure not fulfilling the security requir...

Re: PulseSecure not fulfilling the security requir...

Re: Push pulsepreconfig through GPO

Re: OPSWAT v3 software EOL

Re: Windows Server 2012 installation fails

Re: Annoying timeout and reconnect

Re: Import binary user/system config file

Re: Azure SAML issue

Re: Installation on MacOS Catalina 10.5.7 frozen

Re: Azure SAML issue