- Pulse Secure Community
- :
- About jiangu_
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
since
10-29-2017
10-29-2017
jiangu_
Occasional Contributor
12
Posts
0
Kudos
0
Solutions
11-15-2012
01:37:PM
Hi, all, We have several users complain not being able to connecto to MAG2600 recently, client OS is Mac OSX, the symptom is that Junos pulse connects then disconnects immediately, I don't see any suspicious log on server side, client side debugging shows that server is sending fatal error to client. (MAG2600 is running 7.3R1, Junos pulse version is 3.1) Seems that this is client side problem, because this problem does not happen to everybody. But users claimed that Junos pulse client was freshed uninstalled and installed, Anybody seeing this problem before? Thanks, Jian 00160,09 2012/11/15 12:09:39.041 3 root dsAccessService iveConnectionMethod p0086 t942B connInstance.cpp:1739 - 'iveConnectionMethod' IVE fatal error message length 39^M 00159,09 2012/11/15 12:09:39.042 2 root dsAccessService iveConnectionMethod p0086 t942B connInstance.cpp:1751 - 'iveConnectionMethod' received fatal error from IVE: 6^M 00172,09 2012/11/15 12:09:39.042 2 root dsAccessService iveConnectionMethod p0086 t942B connInstance.cpp:1753 - 'iveConnectionMethod' received IVE fatal error string: agentd error^M 00131,09 2012/11/15 12:09:39.042 1 root dsAccessService iftProvider p0086 t942B session.cpp:220 - 'IftTls' DSSSL_recv failed with error 54^M 00157,09 2012/11/15 12:09:39.042 3 root dsAccessService iveConnectionMethod p0086 t942B connInstance.cpp:1703 - 'iveConnectionMethod' Setting state to retry-connect^M 00173,09 2012/11/15 12:09:39.042 1 root dsAccessService iveConnectionMethod p0086 t942B connInstance.cpp:1384 - 'iveConnectionMethod' Error Connecting channel. Stage 0 Error 9 0x9^M 00153,09 2012/11/15 12:09:39.042 3 root dsAccessService iveConnectionMethod p0086 t942B connInstance.cpp:2108 - 'iveConnectionMethod' Queuing schedule retry 9 0^M 00155,09 2012/11/15 12:09:39.042 3 root dsAccessService iftProvider p0086 t942B IftTlsClient.cpp:353 - 'iftProvider' IftTlsClient::io_thread_fn() exiting: err=0xe^M 00144,09 2012/11/15 12:09:39.042 3 root dsAccessService iftProvider p0086 t942B iftProvider.cpp:275 - 'iftProvider' iftProvider::providerThread exiting^M 00147,09 2012/11/15 12:09:39.042 3 root dsAccessService iveConnectionMethod p0086 t4E57 connInstance.cpp:2124 - 'iveConnectionMethod' Scheduling retry 9 0^M 00174,09 2012/11/15 12:09:39.042 3 root dsAccessService iveConnectionMethod p0086 t4E57 connInstance.cpp:1148 - 'iveConnectionMethod' Sending broadcast message sessionncAccessMethod^M 00133,09 2012/11/15 12:09:39.042 3 root dsAccessService iveConnectionMethod p0086 t4E57 ncDnsOSX.cpp:31 - 'ncAccessMethod' Restore DNS Hosts^M 00141,09 2012/11/15 12:09:39.043 3 root dsAccessService netmon p0086 t4E57 DSSystemConfiguration.mm:927 - 'DSSystemConfiguration' Restoring settings^M 00187,09 2012/11/15 12:09:39.043 3 adibble PulseTray Pulse p0164 tC07 JamConnectionModel.cpp:653 - 'JamUI' Notification of connection status update: '' (ive:fd7f4aba-3d2c-404c-aa63-b5c89f98927e)^M 00144,09 2012/11/15 12:09:39.043 3 adibble PulseTray Pulse p0164 tC07 JamConnectionModel.cpp:654 - 'JamUI' Connection Status: Waiting to connect^M
... View more
08-24-2012
10:43:AM
Hi, Jay, Once again thank you for following this thread, as I mentioned in last update, when NAC_CONTRACTOR role suddenly started working, NAC_DOMAINADMIN role stopped working, I put the two roles' profile/role mapping at the top followed by the policy that catches all roles, the catch all profile is using default VLAN and has local pool 10.128.10.x. The trace message you pointed out is probably a red herring, as in the working case (MAG2600) I see the same message although IP was assigned from DHCP correctly, so I believe trace just shows all local IP pools regarless of profile being matched. DHCP server should not play at role here because local pool did not even work properly.
... View more
08-22-2012
10:42:PM
Hi, Jay, I have separate profile for different roles, because different roles have different VLAN/source IP associated, I have checked and double checked for VLAN/source IP configuration for the roles that are not working, and I am sure the configuration is correct. See the following trace for contractor role, NAC_CONTRACTOR memebers should get IP 10.128.70.3-10.128.70.9 , but in stead SA2500 assigned IP from default non-tagged VLAN IP address pool 10.128.10.3-10.128.10.250, I want to know what happened between message 4 and message 5. I still don't know how NAC_DOMAINADMIN_VLAN33 role just magically started working. 1.PTR10212 2012/08/22 22:31:19 - [71.202.26.127] - CORP\ctest(Users - CORP)[] - Mapped to roles NAC_CONTRACTOR by rule 'groups = 'CORP/NAC_CONTRACTOR_VLAN_70'' 2. PTR10213 2012/08/22 22:31:19 - [71.202.26.127] - CORP\ctest(Users - CORP)[] - Role mapping stopped by Stop rule 3. PTR10205 2012/08/22 22:31:19 - [71.202.26.127] - CORP\ctest(Users - CORP)[] - Realm Users - CORP mapped user CORP\ctest to roles NAC_CONTRACTOR 4. PTR23471 2012/08/22 22:31:19 - [71.202.26.127] - CORP\ctest(Users - CORP)[NAC_CONTRACTOR] - VPN Tunneling: IP Address Pools obtained for the current session are 10.128.70.3-10.128.70.9,10.128.10.3-10.128.10.250 5. PTR23468 2012/08/22 22:31:19 - [71.202.26.127] - CORP\ctest(Users - CORP)[NAC_CONTRACTOR] - VPN Tunneling: Session started with IP 10.128.10.5, hostname jgu-ml.corp.local Active users shows that user ctest was mapped to correct role. CORP\ctest Users - CORP NAC_CONTRACTOR 2012/8/23 10:43:49 10.128.10.5 ESP Mac OS Junos Pulse Not Applicable Latest update: looks like SA2500 only allow one group role-mapping work, NAC_CONTRACTOR suddenly started working but NAC_DOMAINADMIN group is no longer working.
... View more
08-22-2012
08:48:PM
Good news: I got one role work, it just worked magically when I flipped DNS settings from client's DNS to device's DNS for that role's connection profile, SA2500 gave user correct DHCP address from configured VLAN. But other roles still have the same problem, the same trick did not work, SA2500 correctly matched the user to appropriate role, but just silently ignores IP pool/DHCP configuration for that role's connection profile, does not make sense at all.
... View more
08-21-2012
07:43:AM
I don't think SA2500 contacted DHCP server at all, because it does not work even when I have a local pool, it is highly unlikely more NC profiles mapped to that role, because I put the profile at the very beginning and role mapping stops whenever there is a matching. Other debugging tips I can turn on?
... View more
08-20-2012
08:14:AM
Hi, Jay, No, I don't see that, so I assume I don't have the license to run IVS and I have only one root-IVS, and I don't have IP filtering configured under VPN-tunneling -- which is the default setting, I believe. Jian
... View more
08-20-2012
12:31:AM
Hi, Jay, Thank you for your reply, yes I had the VLANs configured, otherwise, I won't have the role associated with that VLAN in drop down menu, or I won't be able to ping the VLAN's IP address. I am new SA2500, what network connect IP filter are you refering to? I don't see network connect under network, I am not using IVS, just a standalone box for a typical enterprise SSLVPN remote access. I am scratching my head to find the configuration difference between the working MAG2600 and non-working SA2500 running the same code, I couldn't find any, both have 50 concurrent user license. Jian
... View more
08-17-2012
02:56:PM
Anybody has an idea? or what additional debugging might be helpful? syslogs, policy tracing etc does not give any useful information, this is supposed to be a straightforward configuration, but it simply does not work ... frustrating.
... View more
08-16-2012
08:47:PM
Hi, all, I am trying to configure SA2500 such that when a user matches a specific AD group, the user traffic will be tagged a specific VLAN by SA2500, SA2500 will assign IP address from a central DHCP server for that VLAN, in the following trace, I was mapped to "NAC_DOMAINADMIN_VLAN33" role correctly (this role has correct VLAN/source IP checked under users>userole>NAC_DOMAINADMIN_VLAN33>general>overview>options>). I am supposed to get an IP address from 10.128.33.x range, however, SA2500 seems to ignore DHCP server (or local pool) I configured in the VPN-tunneling connection profile and assigns me an address from default local address pool (in 10.128.10.x network) for untagged native internal interface. CORP\jgu(Users - CORP)[] - Realm Users - CORP mapped user CORP\jgu to roles NAC_DOMAINADMIN_VLAN33 CORP\jgu(Users - CORP)[] - Role restrictions successfully passed for roles: NAC_DOMAINADMIN_VLAN33 CORP\jgu(Users - CORP)[NAC_DOMAINADMIN_VLAN33] - Sign-in successful, creating session CORP\jgu(Users - CORP)[NAC_DOMAINADMIN_VLAN33] - VPN Tunneling: IP Address Pools obtained for the current session are 10.128.33.5-10.128.33.9,10.128.10.3-10.128.10.250 CORP\jgu(Users - CORP)[NAC_DOMAINADMIN_VLAN33] - VPN Tunneling: ACL rule [1] resource = *:*, action=ACCEPT CORP\jgu(Users - CORP)[NAC_DOMAINADMIN_VLAN33] - VPN Tunneling: ACL rule [1] resource = *:*, action = ACCEPT CORP\jgu(Users - CORP)[NAC_DOMAINADMIN_VLAN33] - VPN Tunneling: Session started with IP 10.128.10.7, hostname jgu-ml.corp.local <== It should be a 10.128.33.x address TCPDUMP on internal interface's VLAN 33 shows that traffic is being sourced from 10.128.10.7 (which is native VLAN subnet), this obviously broke network connectvity. I have no problem pinging SA2500 VLAN interface IP address from internal network, so this should not be switch side configuration problem. I have very similar configuration on a MAG series which is in a different location (authenticate to the same AD domain), which works as expected, i.e., I am getting the IP address assigned by DHCP server for mapped VLAN CORP\jgu(Users)[NAC_DOMAINADMIN_VLAN37] - Sign-in successful, creating session CORP\jgu(Users)[NAC_DOMAINADMIN_VLAN37] - VPN Tunneling: IP Address Pools obtained for the current session are 10.4.37.10-10.4.37.20,10.4.36.3-10.4.36.240 CORP\jgu(Users)[NAC_DOMAINADMIN_VLAN37] - VPN Tunneling: ACL rule [1] resource = *:*, action = ACCEPT CORP\jgu(Users)[NAC_DOMAINADMIN_VLAN37] - VPN Tunneling: ACL rule [1] resource = *:*, action = ACCEPT CORP\jgu(Users)[NAC_DOMAINADMIN_VLAN37] - VPN Tunneling: Session started with IP 10.4.37.11, hostname jgu-ml.corp.local<== This IP was assigned by DHCP server correctly What configuration I could've missed in SA2500? both SA2500 and MAG2600 are running 7.2R3 (build 21397), I attached screen shot of related configuration, your input is greatly appreciated.
... View more
06-29-2012
01:56:PM
Yes, I realized that after I posted the message, everything worked fines now, thanks!
... View more
06-29-2012
11:25:AM
Hi, We just purchased a MAG 2600 SSL remote access box, it worked great for simple remote access configuration, but we want to configure it beyond basic ... We are implementing an unified role-based access control for wired/wireless and remote VPN access, this idea is that we use central DHCP server (running on MS AD/DC), use Radius to dynamically assign VLANs based on user group and then apply ACLs on different VLANs in the gateway router (we use internal tools to generate such ACLs based on role/resource definition), that worked well for wirelss and wired access. Now we want to extend this to remote access VPN, I am having hard time to get this to work on MAG2600, this is what I've done: I created a VLAN on MAG2600 internal interface (seems like that VLANs are automatically created out of internal interface), match a group to this VLAN, define network connection profile which spefies internal DHCP server for IP address assignment for this VLAN, on the switch side's L3 VLAN interface, ip helper address is configured to relay DHCP request to internal domain controller. When I login, I was matched correctly to the correct AD group, yet MAG2600 did not assign the correct IP address, instead it falls back to MAG2600's internal address pool. I did a litle research, seems that MAG2600 is sending DHCP request from default internal interface IP in stead of it VLAN interface IP, that would obviously fail DHCP process. Another question I have is this "Network Connect Server IP" concept, seems that this IP address is a gateway for all remote clients and only one such address (which has to be on the same subnet as internal interface) can be configured. If I ever can get the above VLAN/DHCP working, which default-gateway IP address should I configure on DHCP server?
... View more
09-29-2011
09:44:AM
Hi, one of our mobile employees who is using network connect version 6.5.0 is having a strange problem, he has Cisco IP communicator installed on Windows XP, whenever the call is connected, he can hear other party (IP phone in corp office) fine, but not the other way around, Network connect log shows that packets from corp office IP phone are being received/de-crypted fine, but there is no packet being encrypted and sent to corp office IP phone. Un-install and re-install network connect client will fix the problem, but after laptop reboot, the problem happens again. There is no problem if he connects to corp network via Cisco IPsec VPN or SSL VPN. I suspect that Juniper network connect client software has some kind of conflict with other software the employee has on his laptop. Did you guys see the same problem? A side question, I always had the impression that Juniper network connect client initiates SSL VPN to SA series gateway, but network client log shows that the connection is actually IPsec, why is that?
... View more
Latest Tags
No tags yet
© 2017 Pulse Secure, LLC. Use of this website assumes acceptance of our Legal Notices and Privacy Policy.
Pulse Secure has updated its Privacy Policy effective June 28, 2017.
