Hello - Thank you for letting us know. We will fix this. Is it ok if I send you a Private Message on JNET forums once its fixed or if you prefer to be notified via email can you send me your email address via JNET private message? (This topic will be locked shortly so I wont be able to update you via this post) ... View more

This issue is fixed in 8.0R9 & later 8.0Rx releses and also in 8.1R2 and later 8.1Rx mainteneace releases.    Note: This community forum topic will be moved as indicated here        IMPORTANT NOTICE: New Junos Pulse Discussion Foru...              ... View more

So what did you do to fix the serial console? Was it a bad cable or something like that?   No I dont think its hardware (as the device was responding with correct error when you access via https://) Perhaps your console connection or some putty settings. Its hard to say.   This looks like a really old hardware device (factory reset version is 5.1 which is probably 6 years old if not more). I hope you have the appropriate hardware support coverage if you are going to provide any remote access services to end users via this device.    To get response from the wider community its probably best to start a new thread for each new question with as much details as possible ... View more

The only option is to be able to factory reset the device using serial console and go through the initial setup. There is no other alternative I can think of.  ... View more

I think the 'ADM22862' event is the root cause. Since the 'Skip if already shown' feature works when you sign in from different clients the value must be stored on server side and not client. And on server-side almost all user related data is stored in a user record (which is what gets deleted in 'ADM22862' event).   Can you try enabling the role level option "Show Last Login IP or Time" to test if above is the root cause? (http://kb.pulsesecure.net/InfoCenter/index?page=content&id=KB9984)   ... View more

Which box gives the error the one you factory reset or the one you could not connect to serial console? If its the one that you could not factory reset then you need to connect to the serial console and factory reset it first. There is no other option.   If you factory reset the device there should be no host checker config. Are you entering the correct admin URL to access GUI? i.e. https://ip-address/admin ... View more

If you are able to connect from browser (on the same machine) then Pulse client should work (atleast in TLS mode) without any further firewall changes (though ESP mode is recommended for better throughput performance).   In the past I have seen this 'Unable to communicate with the server' issue due to below reasons:   1. A security program on client that allows the browser to make outgoing tcp port 443 connections but does not allow pulse client to do so.    2. Incorrectly entering the server URL field in the Pulse client (recommended format is https://mag-dns-hostanme/ or a special sign-in URL if you are not using default example https://mag-dns-hostname/contractors)    3. Proxy settings on client browser that Pulse client is unable to interpret and apply correctly    ... View more

https://www.juniper.net/techpubs/en_US/sa8.0/topics/task/operational/secure-access-sa-series-hardware-setup.html ... View more

If you are looking for a trigger to launch your client update deployment tools/scripts while the VPN is active there are a few options:   1. Enhance your client side script to detect for a valid IP on the Pulse VPN virtual adapter (a valid IP is a good indicator that the Pulse VPN tunnel is setup) 2. Enhance your client side script to ping an internal resource that would only be reachable when tunnel is active. Use the success of ping as a trigger for your script 3. Use the VPN Tunnel role level option "Session start script". This option can trigger a script that is located on the client machine   Additionally if you would like to explore enforcing that a machine is updated with patches you should consider using Host Checker Predefined policies. There are pre-defined policies for most AV products and starting with release 8.1R1 there are predefined policies for a few patch management products.    ... View more

If the client is updated and if it still fails compalince checks it sounds like a bug. Is this a day one issue or did it break after upgrade to 8.1R3?    Can you report to Pulse Secure support? They will proabbly needs logs from the latest ESAP diag tool @    https://www.juniper.net/support/downloads/?p=esap#sw     ... View more

No you cant move these licenses.  ... View more

These should be logged by default. Which Type of Resource Policy are you changing?    Also make sure all events under Log >Admin Logs> Settings are checked.    I tested on my lab 8.1R2 and it worked ok for VPN Resource policy.   Message - Info - ADM10259 2015-04-17 13:50:13 - OzLab-Node1 - [192.168.5.23] SuperAdmin[.Administrators] - Resources in Policy ÔVPN IP filteringÕ is modified from XYZ to ABC ... View more

Slighlty old but this may help   http://www.juniper.net/techpubs/software/ive/guides/troubleshooting/RewriteTroubleshootingandLogCollection.pdf   ... View more

You cant replace the card by itself, the appliance will have to be replaced ... View more

http://kb.pulsesecure.net/InfoCenter/index?page=content&id=KB29856 ... View more

The new feature in 8.1 (Patch Management) is different from the old one (Patch Assessment). The new feature will only verify if the endpoint complies with a customer's Patch Management Policies. The patch management server and client are both independent components not tied to the SSL VPN gateway in any way except for the interop/compatability between the host checker client and the patch management client installed on client machine.     The new feature is similar to the predefined AV rule functionality where Host Checker client will query the pre-installed 3rd party Patch Management client software.    You can select the Patch Management product from drop down when configuring a Predefined Patch Management Policy in Admin UI. Currently there are 7 different Patch Management products/versions to select from.   As and when interop with new products are available they will be packaged into the ESAP package and released (similar to the current predefined Anti-Virus checks feature)   Unlike the old Patch Assessment feature, no additional license is required for this feature.  ... View more

The CNAME records should be created on the DNS server that the SSL VPN gateway uses for name resolution (defined under System > Network on the gateway) ... View more

For just one single application the only way I can think of is to manually mask it and use the static host file mapping on the SA/MAG gateway to point ot the IP of the application.   Have not tired this: What happens if you create a role for just this one application, perform role merge and enable mask hostanme feature for this one role?       ... View more

John, On Mavericks I have seen this issue with Safari but worked ok when I used firefox or launched Netrork Connect directly (6-8 months ago). On Yosemite I have not heard of a workaround.    Please note that these OS are not supported by Network Connect. If you have a chance do try the Junos Pulse Client. It is a newer client and will provide a far better expereince on modern operating systems like Yosemite.    http://pulsesecure.net/products/pulse-secure-client/   ... View more

As the error suggests, The Pulse installer can't create a virtual adpater on your system and like Kita mentioned there could be multiple reasons for this, most of them external to Pulse Client (related to the OS, another third party software, etc) The debug logs from Pulse might give a little more detail.    Here is a shot in the dark: We had a couple of customers resolve this recently by following http://support.microsoft.com/kb/3024777 - If you are using Windows 7 then it might be worth a try.  ... View more

I dont think there is a manual option. You can try reducing the lockout period to a low value to see if it helps (if its a one-off situation) ... View more

Assuming your cert was issued by a PKI vendor like Verisign or similar you will have to reach out to them first to renew the cert. Once you finish that they will supply you with the certificate file that you can import into the SSL gateway. ... View more

Start with the Policy Trace AND user access logs on SA.  A tcpdump from failed attempt will probably be the fastest way to narrow down but might not be as easy to read as the policy trace is. The test config button only helps verify basic connectivity. ... View more

Thanks for sharing the URL. Is this for an app that is written in Ruby on Rails?   Was the AUTH method NTLM and POST body greater than 4k? In that case your issue sounds like the behaviour described in http://kb.pulsesecure.net/InfoCenter/index?page=content&id=KB17485 specifically the below part:   "Before 6.5R4 this technique of using 'HEAD' requests was restricted only to situations where the POST body is greater than 4k approximately (AND) for sites that the SA knows (by ÔlearningÕ during a previous HTTP transaction) is protected by NTLM authentication. The ÔHEADÕ method is used to send NTLM Type 1 message. This behavior of using ÔHEADÕ requests when a large body POST is encountered for NTLM protected web pages was introduced in 6.2R1 and since then has not been changed in any release to date (as of writing this article i.e. 7.0Rx).  Therefore, if your backend resource is protected by ÔNTLMÕ authentication and involves large ÔPOSTÕ, then we recommend that you enable the support for http ÔHEADÕ method on your backend webserver."     ... View more

Its going to be hard to resolve this without understanding the impact of the Rewrite engine on this application. If you are familiar with web development technologies then  can you capture a dsrecord (session recording) while replicating the issue? Then open the file and see if the POST request is sent as a HEAD request to the backend.? If yes then check if your backend app server supports the HEAD method?   Alternatively you should capture the following logs and open a JTAC case. http://www.juniper.net/techpubs/software/ive/guides/troubleshooting/RewriteTroubleshootingandLogCollection.pdf     ... View more

Yosemite KB - http://kb.pulsesecure.net/InfoCenter/index?page=content&id=KB29572   The details of which access methods are supported should be in the supported platforms document. ... View more

http://kb.pulsesecure.net/InfoCenter/index?page=content&id=S:TSB16540 ... View more

Does the failure occur if user's machine has only one client certificate? It sounds like a bug. I recommend reporting to TAC. ... View more

Is the Junos Pulse Client connection option 'Dynamic certificate trust' enabled? ... View more