- Pulse Secure Community
- :
- About jickfoo
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
since
11-12-2015
05-29-2018
jickfoo
Occasional Contributor
16
Posts
1
Kudos
4
Solutions
05-09-2018
10:14:AM
Did that not happen because I am in the same boat now. I need the R7 software to upgrade to 8 and beyond. Why hide it ? What can I do ?
... View more
12-14-2017
07:59:AM
I've been trying to get a Citrix VDI Session working through the IVE (or whatever it is called now). When I run a trace it appears that Pulse is trying to post to a scripts directory that is incorrect. When I run a vdi session from a standard Citrix front end, it goes to a different, custom script directory. The trace shows: HTTP/XML POST /scripts/wpnbr.dll HTTP/1.1 Server responds with: HTTP 404 Not Found Anyway to change that path or customize the VDI Setup at all ?
... View more
12-11-2017
06:50:AM
It is configured as a simple Radius Server. Nothing more. It's a whole lot of magic how it works on the back end. Just setup Imprivata as the Authentication Server, and your LDAPS Server(s) as the User Directory/Attribute server. (dont ever set up ldap as the secondary server). Make sure to configure the ips, shared secrets and ports on both the imprivata and Pulse secure side. Use the Default Sign in page. Thanks for the responses.
... View more
11-02-2017
11:16:AM
Anyone ever implement Impivata's Confirm ID as a push token authenticator ? We need to use this for authentication in conjunction with Active Directory. As far as I can tell it's very much like Duo but there is no specific documentation on how to implement. Thanks, Justin
... View more
Labels:
04-15-2016
06:37:PM
Hi All, I know this is an old post but I have the same question. I have Storefront inside. I setup the IVE, I get to the login page and even got the SSO working, that was a headache .. by the way, for sso, the resource is: https://yourserver.yourdomain.com:443/Citrix/YourCitrixName/ExplicitAuth/Login and your Post URL is: https://yourserver.yourdomain.com:443/Citrix/YourCitrixName/ExplicitAuth/LoginAttempt didnt see that documented anywhere. ANYWAY, how the heck is this supposed to work ? I get Connecting... This may take a few moments.. forever. If I need to use JSAM or something I'm not sure its worth it. Thanks, Justin
... View more
04-15-2016
10:15:AM
Requests we're coming from the VPN interface DNS was set to search Device DNS first, but since split tunneling was off these settings did not take affect.
... View more
04-15-2016
10:12:AM
1 Kudo
Thanks for all the responses. The issue was that they did not hand out a distinct DNS Server in DHCP Settings. Instead they set it to user the DNS Settings of the IVE. This doesnt overwrite their local search suffixes. And because split tunneling is off, it thrashes for a long time trying to query their local Active Directory dns suffix records. Thats why if they were to plug into the dsl and not get suffixes, it would work. I ask them to change it to hand out distinct dns servers and suffixes.
... View more
03-18-2016
07:33:PM
Just to add something to the mix. I set the MAC up to use a static ip address and I removed suffix DNS Search Domains. The problem goes away. So the question is, when I connect to pulse and I get a new ip address from the VPN, why is Pulse still using my local DNS Search Suffixes ?
... View more
03-18-2016
06:16:PM
I've seen this on multiple machines now and its really odd. My MAC sits on my network and the DNS Servers are set to our AD Domain Controllers. I use Pulse to connect to our parent company and I try to map a drive. I look at a wireshark trace while I'm doing this and I see my machine desperately trying to find authentication servers on our internal DNS. It's doing thousands of lookups against _Tcp.Sites.domain.edu , _Ldap.domain.edu, all those weird and odd DNS records that Microsoft adds in. The parent company has split tunneling off so all of these requests are simply dropped. I dont understand why its not querying the parent company DNS Server for auth sources. It does a quick lookup for the servername but thats it. The weird thing is, if I use completely public DNS Servers like 8.8.8.8, 8.8.4.4 , it works fine first time, every time. Any idea what could be happening ?
... View more
12-18-2015
12:38:PM
Ok, I was able to get this working. I followed the guide created by my SE and as qsaiki stated earlier in this thread you have to install referencing the config file that you download from admin gui. We also path out to a branding file so the install looks like this: msiexec /i c:\temp\JunosPulse.x64.msi BRANDINGFILE=c:\temp\PulseWin.PulseBranding CONFIGFILE=c:\temp\MyPulse.jnprpreconfig /qb Thanks for all the posts. We're excited we able to do the poor mans 2-factor authentication. (id/password and device cert) Thanks, Justin
... View more
12-17-2015
01:13:PM
This issue continues. I had a call with our SE who says this is possible with machine certs. She even put it in the lab and documented it. I followed the procedure perfectly but my laptop didnt work. Try it on my desktop and it works perfect. Going nuts trying to see the difference between the two. Why would pulse be able to see the cert and once machine and not the other ? The certs exist in all of the same places and the trusted roots and intermediaries are where they should be in both. The troubleshooting and debugging for this process is weak. If anyone has any ideas please let me know. Thanks, Justin
... View more
11-30-2015
12:40:PM
Here is the final word from support. In short, you can only do machine cert checking if you have the client login as a service, which I dont want to do. You can not do machine cert checking on demand. You can do user cert checking. would like to inform you we have only two possibilites via PCS device. Possibility 1: - Enabling host checker based certificate restriction. - To enable you to configure host checker policy on the PCS device. Possibility 2: - Pulse Secure client machine certificate authentication. - User will be getting connected automatically once the machine boots up. - However, you cannot connect via browser when certificate authentication enabled at realm level. It works only through Pulse Secure client. Possibility 3: (Your actual requirement) - Certificate restrictiion should be configured on the PCS device at realm or role level and the configuration should check the machine certificate store and connects the user. - We can configure only user certificate authentication/restriction at realm or role level. I would like to inform you that the third possibility is not achievable through PCS device. It is a new feature needs to implemented on the code level, so you need to go via sales channel to add the feature support. Also I will invole the sales engineer Robin to create feature enhancement request.
... View more
11-16-2015
04:02:PM
I appreciate the response. I did that and it still doesnt work for me. I want users to launch the client on demand, not when the computer starts. Not sure if that has anything to do with it. More sessions with support are upcoming, thanks,.
... View more
11-12-2015
09:11:PM
Just to add some more info... For some reason Pulse cannot dynamically recognize and authenticate certificates in the Windows 'Local Computer\Personal\Certificates' store. Without host checker it can only read from 'Certificates - Current User' To me this seems backwards. Support asked me to export the machine cert and put it in the User Cert folder. That wont work because a.) the certs are non-exportable and b.) even if they were I cant do that for X thousands of people. I could deploy user certs to everyone but that seems like a hassle. Also, if I setup autoenroll on user certs, am I going to get a new cert every time I log into a different machine ? In other words could each machine potentially have dozens of user certificates ? I guess I could deploy the same cert to everyone but that seems weak. Help- Somebody, this hurts my head. Thanks, Justin
... View more
11-12-2015
03:25:PM
Thanks for the response. It is much appreciated. It is possible to setup and use this 2-factor auth setup using the Pulse Client ? It seems a little to me like you are describing the browser login. There may be a couple of situations where I want the machine to auto-login to the VPN at boot and login, but for the most part I will have users login with cached credentials and manually initiate the connection. This is still possible, even with cert checking ?
... View more
11-12-2015
01:12:PM
I want my users to launch the client , I want the client to check for a cert, and if they have the cert I want them to be prompted to login with id/password. If they dont have the cert I want it to fail. Is there a way to do this without Host Checker ? Without the client auto-logging them in at boot ? Is hostchecker still a major hassle ? All I remember is that it constantly caused errors during auto-installation or upgrades.
... View more
© 2017 Pulse Secure, LLC. Use of this website assumes acceptance of our Legal Notices and Privacy Policy.
Pulse Secure has updated its Privacy Policy effective June 28, 2017.
