My new laptop has to run with the latest kernel, otherwise there are more issues with hardware e.g. cannot adjust screen brightness. Hence I cannot revert to an old version of kernel to get around this Pulse secure VPN issue.    ... View more

are you logging in using the pulse client or logging in through the web and clicking on "start"? ... View more

Can you send the MSI install logs to me for a quick review? ... View more

as @Ray indicated, the host checker requirements on the realm or role do not have rules in place for macOS clients. it is possible that there are additional rules beyond encryption and AV that need to be adjusted ... View more

We opened up a thread about the same issue at http://communities.juniper.net/jnet/ and we're awaiting for Juniper comnunity's response.    An excerpt of the SRX logs follows. I can easily copy and paste them directly from a PuTTy ssh window or save them locally o nthe gateway and then pull them out using WinSCP.   Apr 14 10:48:53 Location1-FW01 sshd[82257]: Failed password for yt from 51.255.174.164 port 39604 ssh2 Apr 14 10:48:53 Location1-FW01 sshd[82257]: Received disconnect from 51.255.174.164: 11: Bye Bye [preauth] Apr 14 10:48:53 Location1-FW01 inetd[1715]: /usr/sbin/sshd[82257]: exited, status 255 Apr 14 10:49:11 Location1-FW01 sshd[82259]: (pam_sm_authenticate): DEBUG: PAM_USER: root Apr 14 10:49:14 Location1-FW01 sshd[82261]: (pam_sm_authenticate): DEBUG: PAM_USER: venom Apr 14 10:49:14 Location1-FW01 sshd[82259]: (pam_sm_authenticate): DEBUG: Updating lock-attempts of user: root attempts: 1235 Apr 14 10:49:14 Location1-FW01 sshd: SSHD_LOGIN_FAILED: Login failed for user 'root' from host '58.242.83.36' Apr 14 10:49:14 Location1-FW01 sshd[82259]: Failed password for root from 58.242.83.36 port 39404 ssh2 Apr 14 10:49:15 Location1-FW01 sshd[82259]: (pam_sm_authenticate): DEBUG: PAM_USER: root Apr 14 10:49:15 Location1-FW01 sshd[82261]: (pam_sm_authenticate): DEBUG: Updating lock-attempts of user: venom attempts: 14 Apr 14 10:49:15 Location1-FW01 sshd: SSHD_LOGIN_FAILED: Login failed for user 'venom' from host '177.131.121.50' Apr 14 10:49:15 Location1-FW01 sshd[82261]: Failed password for venom from 177.131.121.50 port 34488 ssh2 Apr 14 10:49:15 Location1-FW01 sshd[82261]: Received disconnect from 177.131.121.50: 11: Bye Bye [preauth] Apr 14 10:49:15 Location1-FW01 inetd[1715]: /usr/sbin/sshd[82261]: exited, status 255 Apr 14 10:49:15 Location1-FW01 sshd[82259]: (pam_sm_authenticate): DEBUG: Updating lock-attempts of user: root attempts: 1236 Apr 14 10:49:15 Location1-FW01 sshd: SSHD_LOGIN_FAILED: Login failed for user 'root' from host '58.242.83.36' Apr 14 10:49:15 Location1-FW01 sshd[82259]: Failed password for root from 58.242.83.36 port 39404 ssh2 Apr 14 10:49:19 Location1-FW01 sshd[82263]: (pam_sm_authenticate): DEBUG: PAM_USER: nexus Apr 14 10:49:20 Location1-FW01 sshd[82259]: Received disconnect from 58.242.83.36: 11: [preauth]   I'll update this thread again if and when I get somewhere with the Juniper community.   Thanks Stavros ... View more

kmm today, I see another obscure thing when I run VPN client , then ms eadge is working normally, unlike google chrome ... View more

VPN server will use Internal port to source the egress traffic. Client can use the External port to connect to the VPN server, however, the traffic initiated by the client will be forwarded to the internal network using the Internal port.   Client traffic >> Internet >> DMZ >> External port >> VPN >> Internal port >> Intranet/Intranet.   Please allow the Internal port of the VPN server (resides at the DMZ) to communicate with the Internet/Intranet zones, so that, the VPN clients can connect to Internet. ... View more

Use NSlookup when connected to 3G network to get the public IP of the VPN server and try to connect using the IP address instead of hostname. ... View more

Not certainly. Any chance on providing the debug logs for review? ... View more

Is there a difference in the check used? No Is it redundant to check for a machine certificate on both the realm & role? maybe, but that is a call you & your security team need to decide. doing it at both allows you to check if it is present at the realm and have role mapping rules that allow or disallow access based on if that certificate is present. as far as the error goes: is it on all machines or only some? does the connection in your connection set enable machine store for the certificate? ... View more

that error typically is due to the target server not being allowed in the ACL (either due to hostname or port restrictions). it could also happen if there is a firewall or route restriction that prevents access. ... View more

How are you connecting to map the drive: WSAM, Pulse SAM, VPN? ... View more

as @Ray mentioned, that is a generic message and does not indicate a failure with the client? are there any obvious differences in the Win7 clients that are working and those not (e.g. AV, FW, other VPN clients, virtualization softwares)? ... View more

I believe it's called OpenConnect client which can be used to connect to Pulse Secure server from a Linux machine not Cisco's AnyConnect! Is that correct? One setting (I know), which does this type of blocking is the browser (user agent) based restrictions enforced on the user realm. Take for example, you can configure the user agent string as *Pulse-Secure* Under, Users --- User realms --- Authentication policy --- Browser --- enter the pulse secure client string --- Allow. Which causes all the clients except pulse client including web browsers and OpenConnect client from connecting to VPN. Note: If we can pass custom user agent as Pulse-Secure using OpenConnect client initiated connections, which is like potentially masquerading the connections as they're coming from the Pulse Secure client, then the realm level restrictions will not work. Keep that in mind. ... View more

https://support.apple.com/en-gb/HT209149 •Resolves Wi-Fi connection issues that may occur after upgrading to macOS Mojave.   I upgraded my MacOS to 10.14.4 (Mojave) this morning. I am testing if Pulse Secure 9.0.3 (1667) and 10.14.4 (Mojave) and "Sleep Mode" and Wifi behaves differently now.   ... View more

https://support.apple.com/en-gb/HT209149 •Resolves Wi-Fi connection issues that may occur after upgrading to macOS Mojave.   I upgraded my MacOS to 10.14.4 (Mojave) this morning. I am testing if Pulse Secure 9.0.3 (1667) and 10.14.4 (Mojave) and "Sleep Mode" and Wifi behaves differently now. ... View more

DNS needs to be functioning so that the DC(s) can be identified. Default values should be fine. And, as @Ray said, toggling back is a button click. ... View more

Hi @mantonini,   What happens if we exclude PulseSecureService.exe and HostCheckerService.dll file from the Antivirus realtime/on-demand scan engine?.   PulseSecureService.exe - C:\Program Files (x86)\Common Files\Pulse Secure\JUNS\PulseSecureService.exe   HostCheckerService - C:\Program Files (x86)\Common Files\Pulse Secure\TNC Client Plugin\HostCheckerService.dll   If possible, please exclude the entire folder/sub-folders "C:\Program Files (x86)\Common Files\Pulse Secure" and check the behavior.   Thanks, Ray. ... View more

try the microsoft tools, pulse is not in the list of install or uninstall program list, choose the default one, nothing found. ... View more

what type of ACL are you using? ... View more

@andrew.hughes Is the Pulse client UI status stuck at "Disconnected" even after providing valid credentials during the login? ... View more

both @ggarcia & @Ray are correct for ease of administration. however, there is a hack that you can do that will allow role-based MFA _if_ you are using a SAML provider that has custom bookmark links. i know Okta allows this to work; I do not know if the others have the same capability. what happens is that you create a bookmark on the SAML provider, get the embedded link, and put that as the custom start page; the redirect on the SAML bookmark points to the redirected page on the PCS (e.g. https://vpn.corp.com/dana-na/home/index.cgi) ... View more

Do you know if the system is configured to have TLS 1.2, FIPS, or NDcPP enabled (these do not work on centOS)? which version of Linux are you using? does the UI-based connection succeed? ... View more

Glad to know that the setup works. :) Thanks for the update. ... View more

Intel i7 laptop (Dell XPS around 2015).  New client I assume. Have only ever used Pulse secure client with the white S icon and green up arrow. My support department are getting me to go through a bunch of Pulse secure client versions (Ray found a support log indicating some versions have issues with Win10), but nothing seems to make a difference. It will work fine a couple of times, then later require a lot of attempts (nearly always connects fine after 2FA but then doesn't actually work with any of my connections). Totally random.  ... View more

JuniperSetupClient is a old component (32bit) provided by Juniper Networks, which is not compatible with Mac Mojave OS as it will only support 64-bit applications.   Any specific reason on why you're trying to install JuniperSetupClient on a Mac 10.14?   NOTE: Pulse Client 5.3R7, 9.0R2.1 and above are compatible with Mac Mojave.     ... View more