Using x509 certs and issues them to users.   If we install Pulse from the SA / MAG no problems.  The process would be: Go to cert portal and get cert Go to SSL VPN portal and sign in using cert Install Pulse Connect to SSL VPN using Pulse and cert   If we install Pulse using a push install we have issues.  The process would be: Pulse is installed along with connection profile Go to cert portal and get cert Connect to SSL VPN using Pulse and cert <<<<----  THIS FAILS with with "Missing or invalid client certificate"   Now to get it to work, we have the user do this: Go to SSL VPN portal and JUST select the cert and hit ok - no need to sign in Close browser Connect to SSL VPN using Pulse and cert - All is good   After doing that just once, it works from Pulse everytime after that.  Any clues why it behaves this way?  ... View more

Is there a really easy way to create a Pulse sign in page / realm / role that would allow a user to install Pulse but set up a predefined connect to the correct Pulse Realm that has host checking and role mapping policies?   While the user can use the web url for the pulse role, it requires them to have java and then loads host checker all before installing pulse.   We could push pulse out manually, but then I believe it will not auto upgrade when we upgrade the SSL VPN.  Is that still true?  We are running 8.x code.   How are others handling this in order to remove any burden from the end user? ... View more

This seems like a simple enough request yet I am having a terrible time finding an answer.  We issue certs to clients via a dedicated enrollment portal.  The user can then log in to our MAGs using either the web browser or Pulse.  All is good.   Now if the user doesn't have a cert or it is expired, we'd like to redirect them to the enrollment portal.  I would think this would be easy to achieve, yet it would seem like we are asking for the impossible.  Any thoughts on how to do this?   A nice guide or KB article would be a hoot. ... View more

We want to restrict the types of devices that are able to connect via the ActiveSync proxy.  We were told this could be done via User Realms | Authentication Policy | Browser Check but so far we have had no luck setting this up.   Can anyone confirm if this is possible?  Any examples of strings that work.   Strings we are using: *Windows Phone OS* Allow   *Linux; Android 4.2* Allow   *iPhone; CPU iPhone OS 6* Allow   *iPad; CPU OS 6* Allow   *Windows Phone 8.0* Allow   ... View more

The subject says it all.  I've never seen a app perform so badly through the rewriter.  Is there anything to look into, settings to tweak, way to figure out why the performance is so horrible?   Running 7.2R5 on MAG4610.  Cascade presented to user as web bookmark with no other settings other than base URL and ACL allowing traffic.   ... View more

We are trying to create a landing page for some external partners.  On that landing page we want to include both internal and external (internet) resources.  So far so good.  One of those external resources we'd like to pass the current user ID to as a HTTP POST.  Seems possible.  Just can't get it to work.   Opened a ticket. Not sure if JTAC understands us and we them.  Thought I'd ask here since you guys seems to know these things really, really well.   Here is what we've done so far: Added external fqdn to System | Network | Overview | DNS Domains (read a juniper tech doc saying it was needed) Created a Web App Resource Profile with Single Sign-on SSO defined as Remote SSO | POST the following data.   Example URL w/forms parameters that works when going direct (not through SSL VPN) http://test.testcorp.com/testclient/faces/customerList.xhtml?brokerId=broker2   What we are seeing - SSL VPN never passes POST name / value   We are running 7.2 R3 code.  Thanks! ... View more

Is there any chance this century that we might get RDP capability which includes support for Network Level Auth which was introduced way back in 2008?  The HOB client just doesn't seem to be progressing.  I mean, 4 years isn't forever, but it sure feels like it.   How are others handling access to servers using NLA? ... View more

Is anyone else seeing problems with Host Checker AV signature check issues?   We've got a few contractors using McAfee Internet Security 2012, Norton Internet Security and Microsoft Security Essentials and all of a sudden they are having issues passing the host check.  Our host check policy for AV is simply that it is instsalled, running and the sigs are up to date within the last 5 updates.  I've check the MAG and the last host check signature update was a few minutes ago and it is set to update every 30 minutes.   I've watched them boot the laptop, update the software and try to connect and the MAG just reports that the sigs are not up ... View more