- Pulse Secure Community
- :
- About papageno_
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
since
10-29-2017
10-29-2017
papageno_
Contributor
53
Posts
1
Kudos
2
Solutions
06-23-2014
02:02:AM
Hi Kannan Thanks for the suggestions - we had already seen and tried both of these. The problem I am describing is that we are unexpectedly seeing traffic sourced from the cluster VIP address on the VLAN and not from the VLAN interface on the active node. This is not what the RSA server is expecting, as sdconf.rec is defined with both the node's VLAN interface addresses. Time sync is not an issue. Both the RSA server and the SA cluster are synced to the same NTP source. Customer has deleted node secret on the RSA server several times, as well as deleting and re-creating the node definition. Each time we create and import a new sdconf.rec, but the result is always the same. As for KB26789, I am not sure how old this is, but it is just not possible to install two sdconf.rec files to a clustered IVE. Maybe it once was, but it simply can't be done now. In any case, we are following the method described in the Solution section to the letter. (By the way, has anyone got any idea what the graphic in KB26789 is there for???). We never get to see a node verification file, because the RSA server does not allow the SA to authenticate its first client.
... View more
06-19-2014
05:50:AM
Has anyone seen an issue where an SA sources traffic to the RSA ACE auth server from its cluster VIP address and not the physical interface address? A customer has a problem where this is happening and they are getting "node verification failed" because of it. The history is that the RSA authentication was working previously, with the traffic sourced from the physical interface addresses. However, they converted the internal interfaces to vlan-tagged, and set up a route to source the RSA server traffic from one of the VLAN interfaces. Now the traffic is coming from the cluster VIP on the right VLAN, but not from the real member VLAN interface addresses. Is this a known issue - I can't see it documented anywhere.
... View more
05-15-2014
02:12:AM
1 Kudo
My customer requested them through their Alcatel account. If it helps, I attach the file I received.
... View more
09-20-2013
07:48:AM
Further info. The NC installer works fine on the same PCs as long as SVW is not running (i.e. logging into a role that does not require or initiate SVW). After NC is installed, we can run the SVW with NC together, it's just the installer that gets stuck, and only if SVW is running. We have allowed custom applications in SVW to no avail. Any thoughts?
... View more
09-20-2013
07:38:AM
Client is running SVW from IVE version 7.3R7. For easy recognition, they set the desktop background in SVW to a brown color, distinct from their standard blue background. They allow the users to switch between the normal desktop and SVW for business reasons. Often, but not always, when the user switches between desktops, the normal desktop picks up the SVW color. This can be rectified by right-click-->refresh on the background, but it is an annoyance. Client devices are Windows 7 64-bit, Has anyone else observed this behaviour in SVW, and if so, is there a fix? Any help gratefullly received.
... View more
09-16-2013
10:26:AM
Hi all I am having difficulty getting Network Connect installed on a Windows 7 device after initiating Secure Virtual Workspace. The SVW installs and runs fine, and the NC installer runs (autolaunched on login), takes a long time, then the installation window closes but the web page it was launched from sticks on "Please wait... Launching Network Connect". According to Control Panel, NC is not installed and no NC application is running. I tried installing NC from the installation file downloaded from the IVE, and the 64-bit version installed OK. However, when I log into the SA from inside the SVW, it is immediately de-installs NC and attempts to re-install it with the same issues. Once the PC has got into this state, if I click on the Home button in the home page, then click on the Network Connect button, I am requested to approve Java to run NeoterisSetup then JuniperSetupClientInstaller.exe, and the Home page displays In order to continue the operation you need to install a setup client. Please click here to install setup package. You must enable either ActiveX or Java to run the downloaded setup client. Once the setup client is installed, please click here to continue. Please click here to login to the realms without Host Checker. If you do not want to proceed, please click here to go back. After a few moments, we get The OS is Windows 7 Enterprise SP1, with IE8 (default 32 bit, though 64 bit is installed). Both 64-bit and 32-bit Java are installed. I have disabled all host IPS, firewalls, etc. Any ideas?
... View more
06-03-2013
02:18:AM
Hi Zanyterp Thanks for the feedback. Maybe I'm not making myself very clear. When the SVW initialises, the user's browser in the real desktop gets redirected to the page as shown in the attached image. On the protected desktop, everything works fine and the user's browser opens on the authentication page. However, the customer is asking if the content of the page shown below can be changed, as it can be confusing to users. I have looked under Sign-in Pages and under the appropriate User Role UI options, but there seems to be no way to change the content of this page, or get the IVE to present a custom page to the browser in the real desktop. (NB we have to allow users to switch to real desktop during SVW sessions).
... View more
05-24-2013
11:08:AM
Hi all I have SVW configured for some users and working fine. However, the customer is asking whether there is any way to change the page that appears in the unprotected desktop's browser after the SVW is initalised, that says "You do not have permission to login. Please contact your administrator." As far as I can see, there is no configuration possible on this. Have I missed anything? IVE is version 7.2R4 Any help gratefully received...
... View more
05-14-2013
03:39:AM
Hi JayLaiz Thanks for the hint. It looks likely, I agree. Unfortunately my test environment is running on DTE, and therefore on the latest published code, so my customer will have to take it on trust that the problem will be fixed when I configure it on the production systems. Many thanks
... View more
05-09-2013
09:30:AM
Hi all In my test environment, login to a realm/role works fine with IE but not with Firefox. The problem comes immediately after the user is authenticated, and the SA redirects it to its home page. The SA issues a number of redirects that work with IE, and although they are the same, Firefox does not seem to pick up the second redirect, but gets stuck at "/dana/home/starter0.cgi?check=yes" (see policy trace below). If I then manually change the URL in the browser to "/dana/home/starter.cgi" the home page resolves (after the last redirect). Has anyone else seen this behaviour? Is there a workaround? The SA is running 7.2R4, and Firefox is 20.0.1. If I run a policy trace on the (successful) IE session, we see info - [10.1.2.11] - user(realm)[role] - 2013/05/09 17:02:29 - Session created, redirecting user to start page. Sign-in done. info - [10.1.2.11] - user(realm)[role] - 2013/05/09 17:02:29 - Automatically redirected from page "login" to the next start page "/dana/home/starter0.cgi?check=yes" before starting the session. info - [10.1.2.11] - user(realm)[role] - 2013/05/09 17:02:31 - Automatically redirected from page "starter0" to the next start page "/dana/home/starter.cgi" before starting the session. info - [10.1.2.11] - user(realm)[role] - 2013/05/09 17:02:31 - Automatically redirected from page "starter0" to the next start page "/dana/home/starter.cgi" before starting the session. info - [10.1.2.11] - user(realm)[role] - 2013/05/09 17:02:31 - Automatically redirected from page "starter" to the next start page "/dana/home/index.cgi" before starting the session. With Firefox, instead, we see info - [10.1.2.11] - user(realm)[role] - 2013/05/09 16:57:08 - Sign-in successful, creating session info - [10.1.2.11] - user(realm)[role] - 2013/05/09 16:57:08 - Session created, redirecting user to start page. Sign-in done. info - [10.1.2.11] - user(realm)[role] - 2013/05/09 16:57:08 - Automatically redirected from page "login" to the next start page "/dana/home/starter0.cgi?check=yes" before starting the session. info - [10.1.2.11] - user(realm)[role] - 2013/05/09 16:57:08 - Automatically redirected from page "starter0" to the next start page "/dana/home/starter.cgi" before starting the session. info - [10.1.2.11] - user(realm)[role] - 2013/05/09 16:57:22 - Automatically redirected from page "starter" to the next start page "/dana/home/index.cgi" before starting the session.
... View more
04-30-2013
08:12:AM
Hi all I'm trying to set up SVW for access to some services (and preventing screen capture as per an earlier post on the subject). Some of the servers are Windows Terminal Servers and these seem to work fine using a defined Terminal Services profile available to the role. Users can get to the terminal servers from inside the SVW, but not from the main desktop, and they can't copy data from the SVW sessions back into unsecured territory. So far so good. Some of the servers are not accessible using Terminal Services, so I am trying to configure access to them either through Pulse or WSAM. First problem is that Pulse does not connect after signing in to SVW and I get a message that Pulse is not compatible with SVW (see attachment). Is this true - I am running 7.2R4 VTE in my test lab? Next I tried configuring server access via WSAM instead of Pulse. This works fine from inside SVW, but it also works just as well from outside it. Is it possible to tie WSAM down so that only traffic from inside SVW is allowed? If so, how? Any help gratefully received.
... View more
03-19-2013
07:13:AM
Hi Zanyterp Many thanks for the helpful response, which hit the nail right on the head. I now have it configured correctly and everything works fine, including suppression of screen capture. (I've tried using the Windows PrtSc key, plus a couple of frame grabbers, and none works.) Many thanks again.
... View more
03-17-2013
12:35:PM
Many thanks for the feedback and the suggestion. To be honest, I'd never come across SVW before, so I've tried to get it running on my DTE installation, just to see what it can do. It looks promising, but there seems to be only very limited documentation and guidance on how to set it up. I've configured it so that the SVW is applied on user login, and this triggers SVW to start. However, you get asked to log in again from inside the SVW - is this normal. Once logged in, you can still execute the Windows terminal server session from your own desktop (as well as from inside the SVW). Any hints would be welcome. Is there anything more than the SA Admin Guides?
... View more
03-15-2013
05:59:AM
Hi all I am migrating an existing secure access deployment from BluecoatRA to IVE. The BluecoatRA system is configured to prevent users taking a screen capture during a session, and the customer expects this in the new solution. Is there any way to do this? The applications to be delivered are simple Windows Terminal Services, and we can prevent the copying of information from the server host with configuration on the server, but it doesn't prevent a user taking a screen snapshot locally on the client. Any way to stop this using the SA? Any help gratefully received.
... View more
03-04-2013
02:19:AM
Hi SVK It's not configured at all at the moment. I have been asked to set it up, but the work hasn't begun yet - there are lots of issues I need to clarify before I can begin work. I understand the endpoints will be running the full ICA client, though. Does that make it harder? Many thanks
... View more
02-21-2013
03:26:AM
I have been asked to set up an IVE (version 7.x) to allow access to users with disabilities, so find it difficult to enter user authentication credentials. Is there any way to interrogate the connecting user's clients for certificates or cached credentials on the IVE connection? Not sure whether the access method will be via WSAm, JSAM, Pulse, or Network Connect at present - depends on the availability of any such features. Any thoughts gratefully received.
... View more
11-12-2012
02:24:AM
Hi Zanyterp Many thanks for the helpful response. It answers the question I asked, no doubt, but raises another one... If EES is being deprecated, what is the preferred solution? I am looking at EES because the SA devices I am being asked to implement will be in an environment that has no internet access at all, and therefore cannot download AV and patch updates from download.juniper.net for Host Checker. EES seems to be the perfect answer. Is there another? Regards
... View more
11-09-2012
07:51:AM
I am looking at using EES, but there seems to be very little information on how it is managed... What is the EES license model on the SA series? Does the license have to be installed on the client or on the IVE itself? If it is centrally installed on the IVE, how does it account for license utilisation - is it concurrently connected devices or the number of devices that have deployed the EES software, and how would that be accounted for? Any help gratefully received.
... View more
09-28-2012
08:45:AM
Hi all I believe I have resolved the issue now. The key lies in the UAC Admin Guide where it says: You must explicitly create policies for each operating system you want to allow. For example, if you create a Windows Host Checker policy. But you do not create one for Macintosh or Linux, users who sign into the IC Series device from a Macintosh or Linux machine do not comply with the Host Checker policy and therefore will not be able to access the realm, role, or resource on which you enforce Host Checker. I therefore added a policy for Mac devices into the Host Checker policy that is applied to Windows devices, even though the roles I want to assign to the Macs do not have any Host Checker requirements for them. The Macs are now being admitted to these roles, even though the cannot communicate Host Checker status.
... View more
09-21-2012
02:35:AM
A customer has UAC controlling 802.1x access. I am seeing odd behaviour regarding host checking (HC) for different types of endpoints - can anyone tell me if it is normal? There is one realm which has a number of roles within it. Some of the roles require HC, some do not, so HC evaluationis enabled at realm level. The roles that require HC all have the same HC policy, which only has restrictions for Windows devices configured. All other device types have no HC restrictions. A Windows device with an HC-capable supplicant (Odyssey) can authenticate to any role, depending on HC outcome. This is what I expect. A Windows device with the native 802.1x stack can not authenticate to a role requiring HC restrictions - which is what I expect - but it can authenticate to a role that has no HC restrictions for Windows devices. An Apple device running the native 802.1x stack can not authenticate to a role with HC restrictions defined (even though the restrictions are for Windows devices only). The UAC logs "Host Checking is not possible with this protocol" The strange thing, to me, is the difference between outcomes 2 and 3. Both are using protocols that cannot provide HC, so how is it that a Windows device can get into a role inside the realm that has no HC restrictions for Windows devices, but an Apple device can't get into a role that has no HC restrictions for Apple devices? Is there some information passing inside the 802.1x that allows the UAC to differentiate on the client OS that accounts for this? Is this normal, or should I be going to JTAC with it?
... View more
09-14-2012
01:59:AM
Hi Muttbarker Yes - that's exactly what I'm saying. The WSAM resource profile works fine through Pulse, if I have the Pulse checkbox ticked on the General tab. I can absolutely guarantee this is true, and the traffic is being carried over the Pulse connection, because I can see the traffic hitting the WSAM server from the Pulse VPN client address on the right port. However, if I untick the box, the WSAM launch icon does not appear on the user's home page, nor does it auto-launch as configured. I feel I'm missing something obvious in the configuration, as JayLaiz reports no such problem. Any ideas?
... View more
09-13-2012
10:05:AM
Hi muttbarker Thanks for the feedback - it is somewhat helpful and I have now configured the access I was attempting through WSAM via Pulse instead. However, I'm not sure your answer is the "last word" on the subject. According to my reading, it should still be possible to work with WSAM instead of Pulse, and as JayLaiz says, it works for him in 7.2r3. This KB article suggests that it is still possible to use WSAM instead of Pulse, simply by disabling the Pulse option in Role...General...Overview, and WSAM should deploy instead. I'm not sure my customer actually needs to use WSAM with the new code. They are replacing older SA boxes that do not support Pulse, but if I can get it to work it may ease the migration. So if anyone has any ideas on why WSAM doesn't appear on the user's home page, and won't auto-deploy, I'd be interested to hear them. All the same, many thanks for the input.
... View more
09-07-2012
08:18:AM
As far as I can tell, I have configured an SA4500 to auto-launch WSAM on login, but it fails to run. Can anyone suggest why? WSAM is enabled at the role level, and Auolaunch WSAM is enabled at the role level. When a user logs in to the role, the Welcome page only shows Junos Pulse under the Client Application Sessions, and WSAM doesn't launch. The user is definitely authenticating to the role configured for WSAM. I have placed the SA in the client's Trusted zone for IE, and even installed WSAM manually. The SA is running version 7.2R3 Any help gratefully received.
... View more
09-03-2012
05:11:AM
Thanks both for the advice. I will have to look into the native supplicant, then...
... View more
08-31-2012
10:20:AM
Hi all Just installed OAC (v5.40) on a MacBook 2.1 running 10.7.4 (Lion), and it works fine for 802.1x on the wireless adapter, but the wired adapter just shows "adapter not available" against its status. I've read the support docs, but there is no mention of this status - as opposed to "adapter not present" or adapter in use by another program". Anyone got any idea what it means, and more importantly, how to fix it? Many thanks in advance.
... View more
08-29-2012
05:10:AM
Hi Kalagesan I attach three radius log files for you. The difference is in the realm...authentication...certificate configuration. Hopefully, the file titles help idetify which is which, but if you need me to explain, let me know. Many thanks for taking an interest!
... View more
08-28-2012
05:54:AM
Hi all I have a number of Alcatel phones authenticating to UAC with 802.1X, using EAP-TLS. This works fine if I disable certificate checking on the user realm and role. However, if I enable certificate checking, client certificates are rejected, even though I have installed the root certificate (provided by Alcatel) into the Trusted Client CA. Have I missed something? Here is the installed Trusted Client CA page: The root-level CA in the tree above looks like this in detail on the IC6500: Issued To: Alcatel Enterprise Solutions CN: Alcatel Enterprise Solutions OU: PKI Authority O: Alcatel C: FR Issued By: Alcatel Enterprise Solutions CN: Alcatel Enterprise Solutions OU: PKI Authority O: Alcatel C: FR Valid Dates: Sep 28 10:03:42 2005 GMT - Sep 28 10:11:08 2055 GMT Details: Other Certificate Details Version: 3 Serial: 4d:04:21:18:6d:70:a1:8b:42:b0:cc:df:37:da:51:c8 Signature Algorithm: sha1WithRSAEncryption Public Key Algorithm: rsaEncryption Public Key Type: RSA Public Key Bits: 2048 Public Key: Modulus (2048 bit): 00:a8:5b:e4:6d:08:25:78:6d:51:72:6a:34:64:1d: 7e:a6:72:2d:96:fe:f9:05:a9:8c:b4:39:93:85:28: ef:3a:21:b4:ab:a3:a8:97:5e:26:3c:0a:70:46:0b: a6:14:3e:0e:4e:b0:1a:b0:41:c2:85:ae:95:fb:83: 17:77:eb:20:c6:8e:7e:e8:78:85:87:7b:a4:98:8f: e2:c9:37:87:59:c2:ba:2e:b7:6c:7a:3f:78:20:a5: 80:88:c5:22:67:eb:53:aa:65:56:e5:b7:c5:05:71: dd:b7:88:be:08:4e:81:e0:c7:33:d4:46:1f:8a:48: 7c:0c:e2:f9:9f:2f:cf:4f:a3:b1:86:a8:2c:29:77: 33:ff:48:03:28:ec:c6:c5:b0:b4:b5:60:ed:4e:10: 9a:7d:c7:f2:d1:25:8e:fa:03:42:a0:6b:b6:50:02: 8c:8c:e3:dd:b2:96:6c:76:01:b3:84:9c:8c:a9:2f: fa:3c:45:81:fc:04:71:60:09:f7:82:c1:dc:2c:0e: 0a:47:dc:50:2a:e2:27:0b:7e:2e:30:c3:e1:2b:9c: 11:c4:96:4a:47:40:86:69:ef:6b:01:0e:2b:30:83: 73:02:bf:25:6b:81:f8:7b:9b:18:73:25:c6:0d:2a: c5:12:df:1e:66:83:d1:a2:9e:f3:a5:bb:2a:3c:4e: 90:8d Exponent: 65537 (0x10001) Key Usage: Certificate Sign, CRL Sign Basic Constraints: CA:TRUE Subject Key Identifier: B7:1F:4E:45:B5:00:DD:F3:C7:9A:97:62:04:08:D1:9A:4C:BA:4A:0D 1.3.6.1.4.1.311.21.1: Certificate Policies: Policy: 1.3.12.2.1006.73.0.0.1 User Notice: Explicit Text: Thumbprint Algorithm: SHA1 Thumbprint: FA:40:F1:F2:03:AA:7C:40:35:69:4F:24:69:84:50:3C:6D:35:1 And here is the certificate received from the 802.1X supplicant, as seen in Wireshark:
... View more
08-12-2012
11:52:AM
Hi all Problem resolved, but not exaclty sure why... I removed TLS from another protocol set, pointing to a different sign-in page, and now the traffic from the Cisco switch is processed properly. I have no clear idea why TLS being present in the other protocol set would have prevented this negotiation, though. Surely I would have seen a message to the effect of "failed authentication for user X in realm Y"? It's a good thing that the other protocol set doesn't really need TLS, or I'd have a problem to resolve. Thanks all
... View more
08-10-2012
08:37:AM
Hi all This may be a bit off topic, as it involves Cisco switches as 802.1x authenticators, but any help gratefully received. Scenario is to use UAC to authenticate Alcatel 4018 phones using 802.1X on both Juniper EX and Cisco Catalyst switches. As far as I know, the Alcatel phones are only capable of EAP-MD5 and EAP-TLS, and from the phone setup I have enabled both using the default settings. UAC has a dedicated realm for the phones, with the default user name and password added as a user. This realm is matched via sign-in policy to a protocol set that contains only EAP-MD5-Challenge and EAP-TLS. This configuration works happily on the EX switches, but not on the Cisco switches. I have checked with the Cisco switches that they can authenticate other "normal" users correctly via 802.1X to the UAC, but the phones fail. A policy trace on the UAC and the user event log show no sign of the attempt, but we do receive radius. A tcpdump on the UAC shows the following: 1. Switch sends Access-Request with correct user name 2. UAC sends Access-Challenge with EAP-code = Request and EAP-type=TTLS 3. Switch sends Access-Request with correct user name, EAP-code=Response, Eap-Type=Legacy-NAK, Desired EAP-type=EAP-TLS 4. UAC sends Access-Challenge with EAP-code = Request and EAP-type=TLS 5. Switch sends Access-Request with correct user name, EAP-code=Response, Eap-Type=EAP-TLS and some SSL content 6. UAC sends Access-Challenge with EAP-code = Request and EAP-type=TLS, plus some SSL that wireshark says is malformed (is this normal?) 7. Switch repeats Step 5 8. UAC sends Access-Challenge with EAP-code = Request and EAP-type=TLS, plus some SSL that wireshark displays as "Ignored unknown record" Steps 7 and 8 are then repeated continuously. Any ideas what's going on?
... View more
Latest Tags
No tags yet
© 2017 Pulse Secure, LLC. Use of this website assumes acceptance of our Legal Notices and Privacy Policy.
Pulse Secure has updated its Privacy Policy effective June 28, 2017.
