Cool deal.  Thanks again! ... View more

BOOM!!! That worked!!  So offsite now is working flawlessly and anything internally is being denied.   So now my question to understand all of this.... is the IP address 255.255.255.255 (is the MAG) and allow access to 0.0.0.0 (is basically anything on the network after authentication) correct?   Just making sure I'm understanding the logic. :)  Thanks again for the help! ... View more

So here's the deal.... if I add my home IP to the "allow" IP list, I can login, if I remove it, i cannot login as it comes back and says no roles.   See below, first is without my IP added as allowed, second is:   W/o adding my IP: Info PTR10305 2013/03/05 11:15:52 - [X.X.X.1X] - username(User Realm)[] - Variable [email protected] = "Apps-VPN" Info PTR10218 2013/03/05 11:15:52 - [X.X.X.1X] - username(User Realm)[] - No match on rule 'userAttr.Apps{-}VPN = '*'' Info PTR10212 2013/03/05 11:15:52 - [X.X.X.1X] - username(User Realm)[] - Mapped to roles Apps-VPN by rule 'groups = 'Apps-VPN'' Info PTR10218 2013/03/05 11:15:52 - [X.X.X.1X] - username(User Realm)[] - No match on rule 'userAttr.Apps{-}VPN{-}Trusted = '*'' Info PTR10218 2013/03/05 11:15:52 - [X.X.X.1X] - username(User Realm)[] - No match on rule 'groups = 'Apps-VPN-Trusted'' Info PTR10218 2013/03/05 11:15:52 - [X.X.X.1X] - username(User Realm)[] - No match on rule 'userAttr.Apps{-}VPN{-}Employees = '*'' Info PTR10218 2013/03/05 11:15:52 - [X.X.X.1X] - username(User Realm)[] - No match on rule 'groups = 'Apps-VPN-Employees'' Info PTR10205 2013/03/05 11:15:52 - [X.X.X.1X] - username(User Realm)[] - Realm User Realm mapped user username to roles Apps-VPN Info PTR23352 2013/03/05 11:15:52 - [X.X.X.1X] - username(User Realm)[] - IP restriction check failed for role Apps-VPN Info PTR23354 2013/03/05 11:15:52 - [X.X.X.1X] - username(User Realm)[] - All roles restricted Info PTR23334 2013/03/05 11:15:52 - [X.X.X.1X] - username(User Realm)[] - Sign-in rejected. Reason: NoRoles   Adding my IP as allowed: Info PTR10305 2013/03/05 11:22:20 - [X.X.X.1X] - username(User Realm)[] - Variable group.Apps-VPN = true Info PTR10305 2013/03/05 11:22:20 - [X.X.X.1X] - username(User Realm)[] - Variable group.Apps-VPN-Trusted = false Info PTR10305 2013/03/05 11:22:20 - [X.X.X.1X] - username(User Realm)[] - Variable group.Apps-VPN-Employees = false Info PTR10305 2013/03/05 11:22:20 - [X.X.X.1X] - username(User Realm)[] - Variable [email protected] = "Aaron Hockett" Info PTR10305 2013/03/05 11:22:20 - [X.X.X.1X] - username(User Realm)[] - Variable [email protected] = "Information Technology" Info PTR10305 2013/03/05 11:22:20 - [X.X.X.1X] - username(User Realm)[] - Variable [email protected] = "1149" Info PTR10305 2013/03/05 11:22:20 - [X.X.X.1X] - username(User Realm)[] - Variable [email protected] = "username" Info PTR10305 2013/03/05 11:22:20 - [X.X.X.1X] - username(User Realm)[] - Variable [email protected] = "Apps-VPN" Info PTR10218 2013/03/05 11:22:20 - [X.X.X.1X] - username(User Realm)[] - No match on rule 'userAttr.Apps{-}VPN = '*'' Info PTR10212 2013/03/05 11:22:20 - [X.X.X.1X] - username(User Realm)[] - Mapped to roles Apps-VPN by rule 'groups = 'Apps-VPN'' Info PTR10218 2013/03/05 11:22:20 - [X.X.X.1X] - username(User Realm)[] - No match on rule 'userAttr.Apps{-}VPN{-}Trusted = '*'' Info PTR10218 2013/03/05 11:22:20 - [X.X.X.1X] - username(User Realm)[] - No match on rule 'groups = 'Apps-VPN-Trusted'' Info PTR10218 2013/03/05 11:22:20 - [X.X.X.1X] - username(User Realm)[] - No match on rule 'userAttr.Apps{-}VPN{-}Employees = '*'' Info PTR10218 2013/03/05 11:22:20 - [X.X.X.1X] - username(User Realm)[] - No match on rule 'groups = 'Apps-VPN-Employees'' Info PTR10205 2013/03/05 11:22:20 - [X.X.X.1X] - username(User Realm)[] - Realm User Realm mapped user username to roles Apps-VPN Info PTR233X 2013/03/05 11:22:20 - [X.X.X.1X] - username(User Realm)[] - Role restrictions successfully passed for roles: Apps-VPN Info PTR23362 2013/03/05 11:22:20 - [X.X.X.1X] - username(User Realm)[Apps-VPN] - Sign-in successful, creating session Info PTR23363 2013/03/05 11:22:20 - [X.X.X.1X] - username(User Realm)[Apps-VPN] - Session created, redirecting user to start page. Sign-in done. ... View more

Also--- I'm explictly giving 172.16.6.x-6.50 for DHCP for the VPN users, I'm guessing that the 172.16.x.x/16 denial is what is causing them not to get an IP but then anytime I try to login from the outside world, I get denied as it is stating I am not authorized to login. ... View more

Cool.   So one step closer.  I was able to restrict everyone on the 172.16.x.x/16 subnet from logging in, but external people trying to login got rejected as well even though I allowed the internal IP and the NAT'ed IP address to connect.  Here's what I'm seeing in the logs:   Info AUT23457 2013-03-05 10:47:08 - ive - [X.X.X.X] username(User Realm)[] - Login failed. Reason: NoRoles Info AUT23361 2013-03-05 10:47:08 - ive - [X.X.X.X] username (User Realm)[] - Login failed from X.X.X.X for username/User Realm. All roles restricted. Info AUT24326 2013-03-05 10:47:08 - ive - [X.X.X.X] username(Warner Pacific Realm)[] - Primary authentication successful for usernameLDAP from X.X.X.X   I feel like I"m having a major brain far on this. ... View more

Here's a screenshot of what I'm looking at in Users-Users Roles-Restrictions     In terms of the policy trace, haven't done that before.  I'm assuming that's documented in the MAG documentation? ... View more

So no dice.     I put 172.16.0.150/32 (or 255.255.255.255) as the only allowed IP address and put 172.16.0.0/16 as the deny from and it still is allowing me to connect from the 172.16.x.x network.   Order is Deny first, allow second.  My account is only part of one group so permissions aren't an issue. ... View more

Awesome.  Thank you so much, I'll give that a shot and report back. ... View more

Internal LAN is using the same IP range.   Example: 172.16.x.x/20   MAG 172.16.0.150   DHCP address leases: 172.16.11.1-172.16.14.255  DHCP Leases for MAG users: 172.16.6.x-50   I want to explicitly deny anything with a 172.16.x.x address from getting an IP address internally to avoid loopbacks or errors.   more to the point, when specifying an IP address, do you simplely use CIDR for the IP address + range w/o putting in the netmask?   Thanks for the help. ... View more

Just wanted to chime in on this and say thank you for this fix.  We actually were having a problem where the ESP to SSL failover would result in no connectivity.  Now that I've changed it to straight up SSL Pulse is working great again.  I'll have to get our MAG updated here soon to resolve this going forward. ... View more

Well, I just figured it out. Simply checking the bubble that states: "When more than one role is assign to a user: User must select from among assigned roles" and that allowed me to navigate and install NC. Sorry for the trouble. ... View more

Thank you THANK YOU!!! :) Much thanks! ... View more