Can you test out the newest Pulse version? There was an issue using SSL transport that yielded similar results that has been addressed. I do not know if the fault is the same; but it is worth a shot. Are you still on XP SP3 or are you using a newer client as well? ... View more

Yes, this is still the case. I would recommend an enhancement request to have our development team investigate enabling an option for this. You can still let the server push the upgrade without manually needing to modify this; however, yes, the users will have the option to ignore it. While still manual, you can do the following to force users to upgrade. Is it pretty? No; but it will get the job done because it gives users a chance to do the upgrade on their terms AND gives them a deadline to complete the action.    1) Enable pre/post-notification message (up to you when you want to show it) 2) Say that a new version is available and the upgrade needs to be done by <date> and that after <date> access will be denied 3) On or after <date>, create a user-agent restriction on the realm at Users>User Realms>Restrictions>Browser and put in the new version of Pulse as the allowed user string and deny any other connection   You can set <date> to be immediate or you can set it in the future; it is up to you and your team what you want to allow. ... View more

Can you explain more about what you are seeing? I'm not sure they provide return codes that can be retrieved ... View more

You will need a MAG appliance, probably 4600 or higher, with a user license for the maximum number of concurrent users. You could also get a mag2600 as a license server and purchase subscription-based licenses for using virtual appliances. Depending on the type of mobile access, you may need the per-app vpn license If you can PM me your contact, I can try to find out who can reach you from our sales group go discuss your requirements further ... View more

Not as TACACS, no; if you enable RADIUS on the same server, and it has the same database, it will work. But the TACACS protocol is not supported ... View more

Yes, that is correct. ... View more

Without credential provider on the role, it can't work; not sure on the customization done on the login. Hade you tested Pulse? What is the goal you are attempting to achieve; does machine auth meet your need? ... View more

Unfortunately, there is no solution as the server platforms are unsupported clients. ... View more

How are you launching nclauncher? That is the script-based launch for Network Connect; it is not expected to work until login to the user profile. Do you have credential provider/GINA enabled under the role (users>roles>roleName>VPN tunneling>options)? ... View more

If you are using file browsing, yes, there is a 2GB concurrent download limit shared by all users on the system. If you need to be downloading/uploading more than that, SAM or VPN tunneling is recommended. Are you streaming through web bookmarks, SAM, or VPN tunnel? Web rewrite-based streaming generally won't work as that typically does not work as it wants to create a direct socket connection; HTML5 may work and would be something you need a ticket with our support team to address to confirm if it is a limitation or not. Can you provide more info on what type of video streaming you are using? The CIE (rewriter) guide can give more info on this: http://www.juniper.net/techpubs/en_US/pulsesecure/pulse-connect-secure/ps-pcs-sslvpn-8.1-cie-best-practices.pdf ... View more

If you use Pulse Secure with machine auth it should work. You still need to have a session timeout because it is required for the configuration. Please note: the maximum is ~20 years and using machine auth allows for automatic reconnection during reboot. ... View more

If you connect from IE or Firefox, does it work? ... View more

Thank you for confirming how you are connecting. No, there is no way to avoid the username and password prompt when using this type of authentcation. The only option that can be done without user interaction is certificate. ... View more

If you have control of the machines, machine authentication with certificates if your best bet as previously indicated. If you do not, your option is limited to anonymous authenticationÉwhich allows anyone in if they know the URL (read: not secured by anything other than SSL). You can add source IP restrictions if the connection is a static known, good value; but it is hard to have any security on an anonymous connection. Otherwise, no. ... View more

It depends. if you currenlty have a wildcard certificate, or get one based on this new need, you can have as many hostnames as you want in DNS that point to your single physical port IP and as long as the hostname falls under the wildcard, you will be fine. For example if you have *.company.com, you can have client1.company.com, client2.company.com, etc.   If you currently have a single domain certificate, and do not want to change to a wildcard, you will need to use a virtual port for each certificate and have a new IP for each certificate needed. ... View more

Which issue are you seeing? If you have a proxy that will not work without allowing legacy file-based proxies (or upgrade). ... View more

yes, as long as they are on the same version (or the appliance receiving the configuration can be newer). ... View more

There is currently no way to move where the information is stored. The best bet is to use the SharedInstall option as referenced by filbert. ... View more

Thank you for sharing the fix. This also applies to other client sessions such as WSAM or Pulse ... View more

How long do the outages last? Is it long enough that you can grab a policy trace for the user? With it happening randomly, are users contacting you/your helpdesk for assistance when it happens? If yes, does your helpdesk have a delegated admin role for troubleshooting permissions?   Typically this error happens if the group listing does not come back from the server with all the groups. Some things to check: How different is the time on your SA and DC? Is the admin on the DC domain admin? Are you using nested groups? Does the DC show any failures? If you are using DNS, does it change if you switch to a static IP to force connection to a specific device? If you are using trusted domains, does the issue resolve if you disable that? ... View more

In addition to the VOD query from kita, is this for all applications or just specific ones? i am aware of a couple instances where Citrix fails to connect...but that appears to be a Citrix issue that may or may not be compounded by any iOS 8 issues. ... View more

The "choose file" is where you choose the new certificate file from your CA The password key is the password needed for the file the import button tells the system to import the file ... View more

Very cool; thank you for sharing ... View more

Check to confirm that the role option for allowing browser request follow through is enabled at Users>User Roles>roleName>General>Session Options. And that this role is the first one users map to when they complete authentication ... View more

If you remove the pleasewait.js file from your temporary internet files, does that help? How many realms are on the URL? ... View more

Is it all group lookup or just a specific group? To help with dcvers' comments: What does your policy trace show? TCP dump? What does your AD team see on the server for failure? ... View more

Glad you were able to find solution. Was it holding the cookies incorrectly for the Host Checker applet? The logs are in %public%\Juniper Networks\Logging\*.log after you enable them on the server at System>Log/Monitoring>Client Logs>Settings ... View more

Connecting by IP will _always_ give you an untrusted error as that is not a valid entry in the certificate. If you were somehow able to get the certificate issued to your IP address then this would be a problem; but because your IP will, most likely, never match your CN/DN/SN/hostname of your certificate, that is correct behavior. Is the correct name/certificate being presented? ... View more

Thank you for your comments, flip_pipe; I am sorry to hear that it looks like you may not be able to use the solution that will fit best for your needs. If you PM me your contact information, I can forward it to the team who may be able to assist with some of your concerns on future planning. For the specifics you asked, I do not know as I am not on the product team; however, I can confirm that investigation is being done on non-Java delivery options. I do not, however, know the time frame for a resolution to this requirement and handling NPAPI-based plugins across browsers as not all are eliminating them.   No, not just the smartphone/mobility platform is what matters.   As far as an 8.1 "what's new" there is not one as 8.1 does not exist yet. You may be able to discuss with your account team about features that are planned/targeted for that release once it becomes available. ... View more