About Ray

Ray

Is it happening on all the machines? What is the Client OS? MTU value sent by the VPN server would be seen in the debuglog, can you please provide a copy of that?

Ray

Using the Windows run as different user should do the trick. Please follow the below steps from the logged into user profile when connected to VPN: Right click on any simple application file/shortcut by holding the SHIFT key >> select Run as different user >> Authenticate with the new user account >> Close the application and logoff, you should see the new profile created.

Ray

No, local export option is the only possibe way. We can send the logs as syslog message to your log servers.

Ray

You can use the jamcommand program to update the connection store, no need to reinstall the Pulse Client for updating the VPN connections. Run jamC ommand with the . pulsepreconfig file as an option/argument. For example: On Windows: C:\Program Files (x86)\Common Files\Pulse Secure\JamUI\jamCommand -importfile < pulsepreconfig file> If the Pulse client is running when you run jamCommand, the new Pulse connection or connections appear immediately. Reference - https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB44037 NOTE: Make sure the new preconfiguration which you'e using has the updated connection details.

Ray

@sdenham Tried the same thing in my lab and noticed similar results, wherein the jamcommand program when executed with /suspend <GUID> did not suspend the desired VPN connection, rather it just suspends the Pulse UI process which would not killing the VPN session. But in case of Windows, there is another utility called PulseLauncher.exe which is capable for connection manager to suspend, resume, stop and delete the connecitons. https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB23158/?kA1j0000000FjG0 - KB article C:\Program Files (x86)\Common Files\Pulse Secure\Integration\pulselauncher.exe pulselauncher [-version|-help|-stop] [-url <url> -u <user> -p <password> -r <realm>] [-d <DSID> -url <url>] [-cert <client certificate> [-usesystemcert] -url <url> -r <realm>] [<-signout|-suspend|-resume> -url <url>] [-t Time(Seconds min:45, max:600)] Unfortunately, PulseLauncher is not available for macOS :( Nevertheless, I am glad to know that this is not stopping you from working, Thanks to your IT team. -- Ray.

Ray

Thank you, glad to know it helped. :)

Ray

OK. Please reinstall the Windows 10 and check the behavior.

Ray

Looks like there is an issue with "SSOCredentials" function which I believe would be present under UIModelPreLogin plugin and Pre-login functionality might be enabled on the Pulse Client which is causing the Windows LogonUI process to check the SSOCreds function everytime when logoff or logon to the machine for triggering the VPN connection. Do you see "Connecting" before the Windows welcome message everytime you login into Windows i.e. right after entering Windows logon credentials? Can you try repairing the Pulse Client installation (search with repair pulse keyword in the windows search) and check the behavior?

Ray

No, we cannot. It is hardcoded to standard port by default.

Ray

Open task manager, go to process tab, find the Pulse Secure tray process where you will find the authentication window child process. Right click and choose Bring it to front or maximize and see if that brings the window.

Ray · Re: Norton 22.20.2.57

ESAP 3.5.9 (latest) has support for Norton Antivirus 22.x, hence please check with your VPN administrator and request to upgrade the ESAP version if the server is not running the latest one. Please confirm if you are able to find the exact product name of Norton in the below guide: https://www-prev.pulsesecure.net/download/techpubs/current/1975/pulse-connect-secure/esap/3.5.x/ps-esap-3.5.9-supportedproducts-v4sdk.pdf (I've assumed the OS is Windows, if not, you can find Mac AVs by searching) - Page #47 shows the list of supported Norton products (Windows).

Ray

Hi @micber68, You can see the hostname of the user workstations connecting to the VPN server, only if the users are using Pulse Secure Client to connect. Relevant logs would be recorded under System >> Log/Monitoring >> User access. Please check "VPN Tunneling" option is enabled by going to Settings tab. If yes, then you can use any of the below line as a Query (enter it in Edit Query >> Update) to see the results: msg='*hostname*' id='NWC23464' Hope it helps you. -- Ray.

Ray

@NicolasDeloyer Please check this KB - https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB43833/?kA1f1000000fz7V and try the suggestion solution#1.

Ray

@nasa_dan Yes, it does. Do you observe macOS crash when having Pulse Client installed? What is the version? It should be resolved in 9.0R3.2 and above version of Pulse Clients - https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB44015/?kA1f1000000PGhS

Ray

@amit From the logs, it seems like jnprvamgr (Juniper Network Virtual Adapter Manager) driver installation is getting timed-out which is very weird, as I have seen jnprvamgr gets installed in many cases where jnprva would be time-out and mostly the issue is related to third-party S/W or drivers. Can you please PM the pnputil /e and driverquery /FO list /v output by running it in cmd? preferrably, append these outputs to a text file using the redirection operation >> (outputfile.txt).

Ray

Host checker caching should do the trick by saving the results for few days (it applies for all host checker policies). Please take a look at the documentation: https://docs.pulsesecure.net/WebHelp/PCS/9.0R1/Content/PCS/PCS_AdminGuide_9.0/Configuring_Host_Checker_Caching.htm

Ray

Are you able to access the Internet sites without any issues? All Intranet sites are not working when connecting to iOS devices or some i.e. one?

Ray

Can you share the debuglog.log file link as a private message, so that I can have a look?

Ray

Can you please uninstall the Antivirus and test again?

Ray

No worries, these articles should help you out: KB40127 - Obtaining/converting the PCS device certificate for use with the Pulse Secure client on Linux KB40200 - How to verify the server certificate with Pulse Secure Linux

Ray

Can you capture the packets on both physical and virtual interface and confirm how the DNS packets are being sent or are you receiving the DNS response for the DNS queries which are being sent out from the macOS workstations?

Ray

Hi @koos147, Machine tunnel using machine authtentication will not work in latest version of Windows due to encrypted LSAs which can be done using a registry hack (not recommended by MS). If you have a machine certificate installed on the user computers, then all you need is to create an cert server auth instance on the VPN server by navigating to Authentication >> Auth servers >> Choose Certifcate server from the drop down >> Add >> Modify the parameters, if need >> Save changes. Obtain a copy of the CA certificate and upload it under Configuration >> Certificates >> Trusted client CA.

Ray

@Poonam22 : It's a generic error message which could be caused due to various reasons, please replicate the issue and provide the debuglog.log files (upload to any filehosters and share the link as a Private Message) from C:\ProgramData\Pulse Secure\Logging or C:\Users\Public\Pulse Secure\Logging folder for review.

Ray

Can you try the setup using Passthrough proxy configuration and certainly, it might fix these issues. XML messages might be the fallback mechanism (XML HTTP Requests - XHR polling) used by your web application, in case if it's using NodeJs (can be disabled as well) or that might be normal XML data. Reference: https://www-prev.pulsesecure.net/download/techpubs/current/434

Ray

Do you see any errors in the browser developer tools like Console, Network sections which capturing the behavior? This would be possibly tell if the browser is not honoring the auto-launch redirect sent by the VPN server.

Ray

Not that I aware of, certainly. However, you can reach out to our accounts/sales team to get insight about the development of the new Pulse Client and its roadmap.

Ray

Please delete the Cisco CDP driver which might present on the machine even after uninstalling the IP communicator software and try again. >> Execute the following command on the cmd and check for Driver package provider : Cisco and notedown the oemX value pnputil /e >> Delete the driver using this command: pnputil /delete-driver oemX.inf /force. >> Reboot and check the behavior.

Ray

Pulse Secure Access Service must be disabled on the macOS workstation, which will not reversed even by uninstallation process. Please check the behavior after executing the below command from terminal while having the Pulse Client installed on the machine and let me know if it helps. sudo launchctl load -w /Library/LaunchDaemons/net.pulsesecure.AccessService.plist

Ray

Hi @SoSa, Yes, you can deploy VLS in Active/Passive cluster mode. It is supported starting from 9.0R1 code. New Features in 9.0R1 Release: License Server HA High Availability Support for License Server on PSA, VMware ESXi Hyper-V and KVM (Only Active/Passive Cluster supported) Thank you, Ray.

Ray

AD domain join/reset join fails and you don't see any Samba related packets like DNS, Kerberos were recorded on the TCP Dump and it is brand new device....🤔🤔🤔 Gotcha! Please navigate to Authentication >> Auth servers >> Toggle the button that says "Enable Traffic Auth Control" >> Set the type to Global -- Internal port >> Save changes and Try performing a basic verification test/reset join and see if it works. I know it sounds funny but worth giving a shot 😉. Fingers-crossed...🤞🤞🤞

Re: unexpected MTU value

Re: How to Keep VPN Connection alive when switchin...

Re: [PSA-3000] Scheduled user summary report

Re: add a new connection on existing install deskt...

Re: CLI Interface to Pulse Secure to Suspend/Resum...

Re: Gather machine name info

Re: Unable to install Pulse Secure on windows 10 H...

Re: Error on logonui.exe after installation of new...

Re: Can set the syslog on PSC to a non standard UD...

Re: Desktop Client Minimized to Taskbar but Cannot...

Re: Norton 22.20.2.57

Re: Gather machine name info

Re: Can connect to Pulse Secure but no network acc...

Re: macintosh crashes with pulse secure

Re: Pulse install rollback

Re: Host Checker and Windows Update

Re: Connection to intranet web site issue for ios

Re: Internal Error Detected...!

Re: Pulse install rollback

Re: (Docker linux container) I cant connect using ...

Re: VPN connects but DNS fails in Catalina

Re: certificate based machine authentication

Re: Pulse App Launcher- Failed to Contact Server o...

Re: Web Resource with websockets

Re: Pulse Secure Application Manager Not Auto Laun...

Re: Pulse Client for MacOS 10.15.4

Re: Virtual adapter does not get removed upon disc...

Re: Failed to connect to the Pulse secure service ...

Re: VLS cluster

Re: Unable to Add and AD Auth Server