About fduranti_

fduranti_ · ‎06-07-2013

Hi, I've a little problem. We use a MAG2640 with 7.3R5 installed and we use it as a passthrough for activesync email. Instead of connecting directly to Exchange we use a Mobile Iron appliance (sentry standalone) that will authorize the device. Untile version 4.5 of Sentry software all was working correctly but it seems that for enhanced security version 4.6 don't allow the SSA to get page with an error related to the SSL negotiation. MobileIron said that the Load Balancer (in this case the MAG2640 machine) should use SSLv3 with a strong cypher to get the pages. Anyone has any experience with this kind of connection? The error I get seems something standard related to negotiation so it's possible that someone got it on other application too (with Authorization only access): 2013-06-07 09:54:55,271 INFO [SocketThread.init:367] (pool-9-thread-33) (TAG,10.202.109.21:23377,DEVICE_TYPE,DEVICE_ID,USER_ID,COMMAND,SERVER) ********** SocketThread starting (running 1, total 33) for client /MAG2640:23377 2013-06-07 09:54:55,271 INFO [SocketThread.run:720] (pool-9-thread-33) (TAG,10.202.109.21:23377,DEVICE_TYPE,DEVICE_ID,USER_ID,COMMAND,SERVER) SSLHandshakeException: SSLv2Hello is disabled 2013-06-07 09:54:55,272 DEBUG [SocketThread.run:721] (pool-9-thread-33) (TAG,10.202.109.21:23377,DEVICE_TYPE,DEVICE_ID,USER_ID,COMMAND,SERVER) Exception: javax.net.ssl.SSLHandshakeException: SSLv2Hello is disabled at com.sun.net.ssl.internal.ssl.InputRecord.handleUnknownRecord(InputRecord.java:451) at com.sun.net.ssl.internal.ssl.InputRecord.read(InputRecord.java:355) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:863) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1203) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readDataRecord(SSLSocketImpl.java:818) at com.sun.net.ssl.internal.ssl.AppInputStream.read(AppInputStream.java:75) at java.io.FilterInputStream.read(FilterInputStream.java:116) at com.mobileiron.alcor.utils.CountStatsInputStream.read(CountStatsInputStream.java:90) at java.io.BufferedInputStream.fill(BufferedInputStream.java:218) at java.io.BufferedInputStream.read(BufferedInputStream.java:237) at com.mobileiron.alcor.http.HttpUtils.readNextLine(HttpUtils.java:68) at com.mobileiron.alcor.http.HttpUtils.getNextLine(HttpUtils.java:58) at com.mobileiron.alcor.http.HttpRequest.readRequestLine(HttpRequest.java:192) at com.mobileiron.alcor.http.HttpRequest.readStartLine(HttpRequest.java:185) at com.mobileiron.alcor.SocketThread.readMessage(SocketThread.java:2248) at com.mobileiron.alcor.SocketThread.getClientMessage(SocketThread.java:2127) at com.mobileiron.alcor.SocketThread.getClientMessageHeaders(SocketThread.java:2092) at com.mobileiron.alcor.SocketThread.processUpstream(SocketThread.java:408) at com.mobileiron.alcor.SocketThread.run(SocketThread.java:701) at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:439) at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303) at java.util.concurrent.FutureTask.run(FutureTask.java:138) at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:895) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:918) at java.lang.Thread.run(Thread.java:662)2013-06-07 09:54:55,272 INFO [SocketThread.run:733] (pool-9-thread-33) (TAG,10.202.109.21:23377,DEVICE_TYPE,DEVICE_ID,USER_ID,COMMAND,SERVER) SocketThread exiting (running 0, total 33) for client MAG2640:23377

fduranti_ · ‎11-28-2011

At the end we discoveder what seems to be the cause of the problem. It's not the Cluster or the active node. Our MAG cluster is configured with it's cluster IP address and some virtual ports (associated to different certificates). Users connect to those virtual ports for different services. One is used by normal user that log into the SA to upload files (and they have the described problem with upload). Another Virtual Ports is configured to "require" certificate authentication and we use it for a virtual host making Activesync proxy to our exchange. It seems that this "requirement" for a certificate is influencing the way the other virtual port works. When we have the virtual port for activesync in those requiring a certificate the file upload fail. If we remove the virtual port so that it will not require a certificate everything works correctly, file can be uploaded and RDP works as Anyone had problem with virtual port certificate required to log in into the SA interfering with other services?

fduranti_ · ‎11-18-2011

it seems that the firewall is not getting the MAC address at all... i get an (incomplete) on the arp table for the virtual ip after i switch the active node to node 2 but I don't know what this mean. I suppose if the table was not updating correctly I should see the old MAC address in the ARP table of the firewall. Just after I switch the node back I see the correct MAC address.

fduranti_ · ‎11-18-2011

I think there's something strange, today I've done some more tests and it seems that the clustered internal/external IP address is only working on one node (node1), failing over the IP they don't even answer to ping. I've also some virtual ip address on the internet side and they're correctly working also failing over the cluster. Doing a test and trying to upload a file directly to the "active" and "passive" node bring this results: active node: Transfer failing passive node: Transfer successfull So it seems there's something strange on the HA side. The 2 nodes are connected to interface on 2 different switch.The 2 different switch are connected between them with a trunk of 2 cable if I remember well (VLAN are allowed on the trunk). Internal interface are on a VLAN and external on another VLAN. VLAN end on a checkpoint firewall doing the routing and NAT to internet. Physical interface are always pingable/reachable and works. External Virtual Ports are alway pingable (and work). Virtual IP (internal and external) are only pingable when they are on node 1. Anyone have a suggestion? I think there's something wrong but I cannot real understand what...

fduranti_ · ‎11-18-2011

One more information. I was able to replicate the problem on the cluster also on internal network uploading a bigger file (470 MB). After some seconds the upload stopped with the same error so it seems that the problem is some kind of timeout involved.

fduranti_ · ‎11-18-2011

Hi Jacob, I'll try to get some information in the afternoon and to do some tcpdump collection. I've just done one tcpdump on the internal interface of the mag and there's no communication with the ip where the share resides(I've done a trace from when I click UPLOAD to the error, It's probably correct because I think the IVE will cache locally the file and then save it to the share). You think that the problem is between IVE and the file share/web server ? It seems something related to some kind of stange timeout. It happen only when connecting from Internet and passing through routers (it's not happening if connected directly to the Internet switch where routers and firewall are connected). I have a demo SA6500 from our provider and just setted up with the same version 7.1R4.0 and the same share and it works correctly (it's configured exactly as the MAG 4600, with ip address on the same VLANs, the only difference is that the MAG4600 are 2 in HA cluster while the 6500 is a single appliance) . I've opened a case yesterday (you need the case number?) Thanks Francesco

fduranti_ · ‎11-17-2011

Hi, I've a little problem with any kind of file upload. We have 2 MAG 4600 in HA cluster with SA software 7.1R4.0. We have some internal custom sites that have an Apache Commons FileUpload function to get files from users. If the file is just a bit big (more then 1 MB but it vary) the upload interrupt and we get an internet explorer error. Testing with the PC directly connected to the internet connection switch all works correctly so as it work if I do the file upload connecting from the internal network. I've done a test publishing the sites directly on internet and the upload go without a problem (tested with a 14 MB file). I've also sone a test uploading the same 14 MB pdf file to a windows share with Juniper and it's working from local LAN but not working from Internet. We also seems to have some strange behaviour with RDP connection passing through MAG appliances: the connection is broken and the RDP client reconnect sometimes 4-5 times in 1 minute. Our internet connection is cone with 2 routers each with 40 Mbit link in Load Balancing.MAG are connected in a DMZ network on our Checkpoint Firewall (tested with IPS disabled/excluded with no luck). We changed the configuration so now it's only an HA configuration. We tried changing MTU to less then 1500 on the router, on MAG and on client. The problem seems to happen only with MAG appliances (we have many other kind of connection that are not affected at all). Anyone have any idea of what can cause this strange behaviour?

fduranti_ · ‎09-27-2011

Hi, I've searched a bit on internet, on the forum but was not able to find the name of the symbian client for nokia phones to download. From what I've understood it should be available on Ovi store but I was not able to find it, I searched for junos, junos pulse, juniper, juniper network but there was no result. I've tried to search on Junos pulse documentation too but it seems that there's no link to download. The only reference I was able to find on this forum is this: https://forums.pulsesecure.net/topic/pulse-connect-secure/79506-junos-pulse-for-symbian_ that talks about a downloadable client that was not able to do l3 (network connect) vnp (I think it can only do Web ssl access)... There's anything I'm missing? Where I can find the symbian client? Thanks Francesco

fduranti_ · ‎09-06-2011

activesync url proxy are still into the MAG, is this right? Thanks Francesco

fduranti_ · ‎08-27-2011

Thanks for the answer. So at the end it seems better to use LDAP :) Just a little clarification regarding single sign-on... What happen in regard of it? Does LDAP Authentication then work with Kerberos/NTLM Single Sign-ON on internal web sites and Windows File Shares?

fduranti_ · ‎08-27-2011

Any idea on which verdor will deliver Juniper VPN and when? Thanks Francesco

fduranti_ · ‎08-25-2011

Anyone that would like to explain a bit better the differences between AD/NT and LDAP Authentication against a Win2003 Domain Controller? They seems really similar in functionality (they allow password expiration change, they allow single sign on, it's possible to create roles on domain/ldap groups and so on). The only difference I saw is that using AD/NT I see traffic going to almost every DC in my Domain (but it seems it's not using the "right" on the site on which SA reside) while LDAP try to authenticate on defined ldap servers. What's the real difference between them? I saw that using AD/NT as primary authentication and RSA as secondary it use domain\user as <username> so RSA will not authenticate (checking on manual it seems I should use <NTUSER> instead of <USERNAME>). There's any pro/con using AD/NT or LDAP?_ Thanks

fduranti_ · ‎08-25-2011

I'm a bit confused... checking on the Admin Guide it seems that AD and NT Domain authentication can manage the password about to expire (warning as long as 14 days before the password expire). I'm wrong on this? It's on page 163-165 of the SA Admin Guide.

Problem connecting ActiveSync through SSL VPN and ...

Re: Problem uploading files with MAG4600

Re: Problem uploading files with MAG4600

Re: Problem uploading files with MAG4600

Re: Problem uploading files with MAG4600

Re: Problem uploading files with MAG4600

Problem uploading files with MAG4600

Junos Pulse client for Symbian

Re: MAG series differences and HA features

Re: Difference between Active Directory / Windows ...

Re: Android Support

Difference between Active Directory / Windows NT a...

Re: AD Password management -good doc?