About -red-_

zanyterp_ · ‎09-07-2014

Short answer: rewrite allows browser-only remote access to the web server; not rewriting requires a client to access the web server. Neither is more or less secure Long answer: Rewriting, standard/traditional or pass-through proxy, acts as a proxy for the user: the end user browser only sees the IVE & the internal server only sees the IVE. Disabling rewriting means there is a form of direct access: in the form of a SAM or VPN connection. The former is L7 connection in which you define applications/servers that are allowed to be accessed and is client-initiated only; the latter is a traditional L3 connection in which the remote user is a node on the network.

-red-_ · ‎07-29-2014

Thanks for chiming in. Took a bit, but finally realized that my problem wasnt the policy, but rather the test machine I was using. I completely overlooked the fact that it had 2 AV products loaded (and apparently active.) So, the rule as written was actually correct. Now I have to figure our why there is almost a 1 minute delay between the time the user enters the credentials and when the role mapping actually takes place. Policy trace shows the gap, but nothing in terms of an explanation as to why.

Kita_ · ‎08-27-2014

Hello Red, Thank you for the feedback. I can help discuss this internally, but we wanted to get the information out as quickly as possible. If there is any other concerns we can address, please feel free to reach out to [email protected] or you can PM me and I can forward your information accordingly.

zanyterp_ · ‎06-26-2013

Not sure how you are completing the login through the Network Connect application as it expects to make a VPN tunnel; however, it is theoretically possible to work. what is the behavior you see when you connect through the browser on these failing machines?

zanyterp_ · ‎11-08-2012

i'm sorry i had bad news to bear. which feedback are you referring to...that it has limitations? it would be interesting to hear if microsoft has feedback on how to check this information.

mtessier_ · ‎08-01-2012

Yes, this issue was mentioned in the 7.2R3 Release notes under the fixed section. I was in the process of testing 7.2R2 out when this came out. I decided to skip to 7.2R3 specifically because of the NC issues. 4. cs-nc-enduser - NC users are connected via SSL instead of ESP after 16,383 NC tunnels. (787424) 5. cs-nc-enduser - After IPSec re-key time, the ESP session of the NC tunnel falls back to SSL if data packets were sent the on the NCP control channel during the initial ESP tunnel establishment due to latency sensitivity. (787470)

Kalex_ · ‎05-21-2010

Hi -red-, I've been discussing this with a colleague who has some experience with the 6xxx series and apparently, the number of profiles shouldn't be that much of a problem - not even for the admin interface. Do you have any results from JTAC? I'm rather curious

-red-_ · ‎04-14-2010

Unfortunately, the bulk of the users are connecting via the workstations which we don't control. Our biggest challenge is the desire to address all of this with no additional user interaction. Even if we had offered up an app for the users to manually execute, I suspect only half the users would actually do so.

DHayes_ · ‎07-14-2008

I have experienced similiar issues when I upgraded our SA6000 active/passive cluster to 6.0R5. I found that by disabling the Replay Protection option in the Network Connect Connection Profile that I was able to connect and stay connected with ESP. I currently have a case open with Juniper but no progress yet.

fire2power_ · ‎10-30-2008

Thanks, joepope. It really works with your label parameters on my OWA 2007. I just need to change the destination to /owa/ It saves a lot of time researching.

Felipe_ · ‎02-15-2008

Hi there, Yes, this issue is resolved in 6.0R4 that was just recently released, but not in the web site yet. If you have a case, then it should had been noted there. Let me know if you need help getting this release. Thanks, Felipe

kenlars_ · ‎03-27-2008

Are you willing to share your custom sign-on pages for RSA soft tokens? I have the same issue, and your help could save me a lot of effort.

zanyterp_ · ‎02-28-2008

Hi -red-, You are correct, the IVE authentication intermediation page cannot be modified beyond what you have described. Is creating an SSO policy an option for those sections of the SharePoint application that require the additional information? This would allow seamless access and should not interrupt the flow of the GUI users experience.

psully10_ · ‎01-17-2014

Just an FYI. I opened a support case about the same issue where I was told by JTAC my SE needed to submit an enhancement request. Enhancement Request ER-056515 has been opened. If you would let your account team aware of this, the more attention it gets, the sooner it might get fixed. Thanks

Re: Web ReWriting

Re: Realm based host checker restrictions

Re: Future of Junos Pulse

Re: NetConnect Usage?

Re: ESAP alternative options.

Re: Jump in ESP to SSL transport failovers after g...

Re: Admin interface performance issues

Re: Ideas for overlapping IP space

Re: 6.0R4-2 (build 12875) Network Connect issue

Re: Passing credentials to OWA

Re: Bug in 6.0R3.1?

Re: RSA Soft Token API

Re: SharePoint with Core access

Re: Pulse client issue with Adaptive Auth.