About Stewart_

Stewart_ · ‎04-08-2014

There is a tool here which confirms our version running 7.4r8 is affected: http://filippo.io/Heartbleed/ I'm just about to log a support ticket to see when this will be available.

Stewart_ · ‎04-30-2012

*bump* I'm keen to know whether this is possible as well. The DTE is invaluable for testing new releases before rolling into our production systems.

Stewart_ · ‎01-16-2012

Thanks! Just updated mine to 7.1r5 and it works a treat. Wish more companies would have this policy around offering trial versions. It's so valuable having this setup in a LAB environment and testing upgrades / changes there first.

Stewart_ · ‎01-11-2012

Hi Guys, Just a quick question, is it possible to upgrade the DTE version of ssl vpn with a new package? The download I got was 7.0r2 but I'd like to go 7.1 to play with the new features in dev. I guess I could just clone the VM and try, but I'll try save myself the hassle if someone knows :) Cheers, Stew

Stewart_ · ‎12-21-2011

As this was a new implementation, I hadn't actively sought users to test this yet. Is it worth while grabbing a phone on the old iOS version to see if the issue exists there?

Stewart_ · ‎12-19-2011

I'd already stripped it down to just one role mapping to remove complexity. Client version is " Junos Pulse 3.0.2.15113" and iOS version is 5.0. Cheers

Stewart_ · ‎12-14-2011

Hi, Does anyone have pulse roaming working? I want users to be able to bounce between wifi, 3g and from a dormant device to one which is being used and have the VPN reestablish. When changing from 3g to wifi or vica versa I note that the VPN icon dissapears briefly, then pops up again. The thing is, if I look in the juniper logs I can see the connection hasn't been reestablish...there are no connections from the new IP. I also try clicking on a VPN resource (ie bookmark) and it times out. If I load junos pulse again there is an error message saying the vpn connection failed. I have enabled roaming on the role. I see there some mention of issues in an old thread here: https://forums.pulsesecure.net/topic/pulse-connect-secure/57958-junos-pulse-on-wifi That was a long time ago, is there still no fix? Cheers

Stewart_ · ‎12-08-2011

Thanks for the information, I was starting to think this may have been the case. Cheers (ask your tecnies to add it in for us please and I'm pretty sure the cisco any connect supports it!...I could be wrong) :)

Stewart_ · ‎12-08-2011

Hi Guys, Does anyone know if it's possible to have on demand vpn (on an ipad) that uses both a certificate and requires AD credentials? I have it working nicely with just a cert, but would also like to have the user prompted to enter their details. It works fine in Pulse, but I want this to be seemless. Ie they start an app, on demand pickups up the DNS name, kicks off the VPN client and asks the user for auth. Possible? (or is on demand cert only) Cheers

Stewart_ · ‎12-08-2011

Hi. I've spent the last 4months on this stuff so have a fairly good grasp. The only way we could verify users as being corportate ipads/iphones was through the use of certificates (which have already been mentioned). We use mobile iron to enroll users using SCEP to an internal PKI server. Mobile iron enables policy control on mobile devices like app restrictions and password policies. On the Juniper I check for particular certs and do both cert only authentication and mixed mode auth where users also need to type in their AD creds (for more secure apps). Just playing with on demand VPN at the moment - works a treat but I dont think you can do mixed mode auth. I'm about to put a thread on here to see if it's possible as I'm hesitant to use certs only as you can export them from a device and put them somewhere else.

Stewart_ · ‎11-04-2011

Hey Guys, Hardware renewals rolling around again this month, just wondering if it's worth dropping in something in the place of our SA4000's. I understand these are EOL now, I dropped JTAC a line to find out when these will be supported until. Have any of you upgraded these to 2500's (is this even an upgrade?) or the 4500's ? Cheers

Stewart_ · ‎09-13-2011

I note there is a method of setting it up using proxy bypass as documented here. Is this required? I'd prefer not to have to setup the virtual hosts if possible.

Stewart_ · ‎09-13-2011

Hi Guys, I'm running SSL VPN 7.1R3_ and are trying to publish a sharepoint 2010 web resource. Basic functionality seems to work OK but when users attempt to upload a document they get the attached error. I understand there is a fairly comprehensive list of features which are and aren't supported but a basic document upload should work. Has anyone had some experience in setting this up, any tips? Cheers

Stewart_ · ‎09-07-2011

Agreed! Great information. We have a radius server so hopefully we can achieve the same thing. Our domains do not share a commmon sufix or prefix, but I don't suppose that shouldn't matter too much. I guess I could just provide the whole base DN in the reply: JohnDoe Auth-Type := Local, Cleartext-Password := "password" Reply-Message:="dc=aaa,dc=domain,dc=com_" Then use Base DN under auth server as "<[email protected]>_" Hopefully this will work too._

Stewart_ · ‎09-07-2011

Just a thought, are there any other options by using some sort of intermediary device which is able to do the lookups across multiple domains. ie Radius?

Stewart_ · ‎09-07-2011

cheers guys. Fer more questions! zanyterp_: In terms of having multiple realms for each of the AD's, am I correct in assuming the best way of presenting this would be either a single URL with multiple user-selectable realms, or multiple URLS with each one pointing to a realm? RexPGP_: Have you been able to get this working? I can get the AD guys to change a group to Universal if you think it will make a difference?

Stewart_ · ‎09-06-2011

It seems rather weird this doens't work. Is this from "the horses mouth" so to speak or is this just your experience? The thing is, the SA shouldn't need to search the other DN's as its the AD which has this nested group/recursion/transient trust? If the little tool I run is able to determine that I exist in a nested group, why can't the SA!?

Stewart_ · ‎09-06-2011

Still not having any joy with this. stine: How do you mean you need to enable it at the auth server level?. I have attached my setup. I have tried all sorts of combinations of Filters, Member Atttributes, and Query Attributes. No luck. I have blanked out the DC values (sensitive!) but the rest is 'as is'. Within this AD I have a Group 'AD1'. In that is group 'AD2' which exists on the second domain. I have created a user realm which looks for user 'X' in AD1. With the nesting I assume the AD1 will check it's group for user 'X', see it has a nested group and look there elsewhere. I have used an AD tool which runs the query and confirms that the user exists within AD1 by virtue of being in nested group AD2. The thing with the Base DN is that its completely different on both the AD's. How do you write a base DN which will work for both AD1 and AD2?

Stewart_ · ‎08-11-2011

Hey Guys, I work in an environment that has 3 AD domains. We have one AD in our extranet, and two in our LAN. I'm wanting to have all authentication from our IVE's hitting the extranet AD's and have cross domain nested groups to the other domains. At the moment I have server profiles for each of the 3 AD's - from a security/simplicity point of view I'd like to get rid of this and use just the one. I have created a LDAP server profile for the extranet AD. I have created a group on that AD and it contains a external group on another domain. I have placed a user in the nested group, but authentication to that user isn't working. Has anyone got this sorta setup (cross domain nested groups) working? Any tips? When using standalond groups/users on the same auth server it works fine. It's just the nesting which doesn't seem to be working. I have configured the 'Determining group membership' section and everything seems to be in order there. Any help well appreciated!

Stewart_ · ‎06-01-2011

I have just tried to setup XenDesktop and have got the same error message. I've had nothing but problems with all these new features on SSLVPN (Junos Pulse is just as bad IMO). Anyone managed to get it working yet?

Stewart_ · ‎05-19-2011

Thanks guys, works like a charm. Didn't occur to me that I would need to create an access policy, did that, launched an RDP and it works! Now just to try and work out why the standard web bookmarks don't work reliably (or at all really) through junos pulse. I can load up chrome/ie from a PC and connect, and use the same sign in page and the bookmarks, but it doesnt work on ios. Pretty weird. A few others have reported the issue in these forums but I haven't seen a fix.

Stewart_ · ‎05-19-2011

Hello, has anyone got Pulse working with an iphone and RDP? Any tips on setting this up? I can't seem to get it right. I have created a Terminal Services session_ for the host I want to connect to & installed a RDP app for iphone. I connect, and then fire up the app, try connecting and it doesn't work. I have opened a firewall port to allow the outbound tcp3389 connection.

Stewart_ · ‎05-18-2011

I'm having the same issues as some others in this forum, running 7.0r5. I login using pulse, click the first link and it usually rewrites, if I go back to the main page any try any of the links (including the one I just tried before), the redirects dont work and all pages just show a blank page. I can go to the same login page in any other browser and they all work fine. Same with safari on the phone. It's something to do with pulse for sure. Anyone manage to get fix this?

Stewart_ · ‎02-11-2011

Hi Guys, I'm moving domains from x.com to y.com soon. While I know I can setup a CNAME record for x.com to y.com so all users who access the old URL will be redirected through to the new one automatically. However, I would prefer to have a page show them a quick message to say that the domain has been updated, and that they should change their bookmarks, and then redirect them after 10 seconds. Does anyone have a smart way of doing this ? Both the two domains are two physically diffeent SA devices, but I have migrated all the old roles onto the new domain & device. Any help appreciated. Cheers

Stewart_ · ‎02-11-2011

Thanks for the responses, I was unaware about this new MAG device. I'll look into them. Cheers

Stewart_ · ‎02-11-2011

Hello, I'm in the process of migrating all of the rules of one ssl vpn device to the other, for a consolidation project. I was wondering, is there anyway to determine whether a particular sign in page has been used in X days or months? I have had a play around with the client loggins page but I cannot ever find reference to the exact sign in page which has been accessed. Anyone know of a good way? Thanks, Stew

Re: Please confirm whether your firmware is affect...

Re: DTE upgrade 7.1R5 to 7.2R1.1

Re: SSL VPN DTE Upgrade

SSL VPN DTE Upgrade

Re: iOS Pulse Roaming

Re: iOS Pulse Roaming

iOS Pulse Roaming

Re: Pulse on demand VPN

Pulse on demand VPN

Re: Pulse with SA

SA4000 Upgrade

Re: Sharepoint 2010

Sharepoint 2010

Re: Nested AD groups - Cross domain

Re: Nested AD groups - Cross domain

Re: Nested AD groups - Cross domain

Re: Nested AD groups - Cross domain

Re: Nested AD groups - Cross domain

Nested AD groups - Cross domain

Re: XenDesktop 5.1 via Virtual Desktop Profile on ...

Re: Junos Pulse + RDP

Junos Pulse + RDP

Re: How to configure SA to use Junos Pulse?

moving hostnames

Re: SA4000 Upgrade

Rule Migration