But for the case that a user does not have the rights to install e.g. NC, SAM etc. Juniper has the installer service to manage that. ... View more

Regarding my problems with the SVW - the loginpage thin --> Appears since 6.0 - Vista problem for non admin users -> since 6.2 (did not test this earlier) ... View more

Did they say anything why it does not work with newer releases? The reason why I ask, I don't guess you will find another solution than juniper fixing that or use the pretty expensive symantec virtual desktop as 3rd party one, assuiming that your a'x is working with this. But I don't see any other way as maybe accessing any URL without svw, to just push this a'x and run the main URL with the SVW later. This will result in the behaviuour you dislike, as I unterstood, that this applet will remain on the pc. ... View more

Well for me the SVW works fine with Vista in this release, except that we face the problem for the need of admin credentials when running this stuff the very first time on a fresh installed vista machine as standard user. Regarding your problem, does the remediation page show more poilicies than applicable for this realm? The question why I ask is, we had / have the problem, but not on all PCs. If we set the startpage of the SVW as std (--) instead of setting the explicit one, inside the SVW we got a remediation pagedisplaying _all_ existing HC policies even if they were not relevant for this specific realm/role. JTAC did not really find things, the solution is still to define the login page inside the SVW's config. ... View more

Maybe you can ask Juniper for renting a sa2000 for some days, downgrade this to your SA's current release copy the config over there, upgrade this SA2000, export, import to the next. Then you would have at least the possiblity to do this wihout an outage. ... View more

For me this sounds more like a bug because I did not read sth. of a limitaion for the general use of ActiveX-Applets (or -based apps) within the SVW, so how about troubleshooting this with JTAC? ... View more

As I personally dislike those self made sign in pages as they are hard to manage upon release changes, how about just writing the disclaimer text in the sing-in page instructions and imply for the user to accept them when doing the login itself?! Or the other thing could be you place this in behding the login as part of the authorisation of the backend ressource. ... View more

Normally you should see also a system snapshot that was automatically generated under Maintenance -> Troubleshooting -> System Snapshot. I'd download that + save the log (I'd save all logs as per my experience jtac allways wanted all logs eventhough from my point of view only e.g. the eventlog was needed) and open a jtac case. ... View more

Yes I did, but only on our testsystem. What do you mean by affect HC and NC? Every IVE OS updates results in new versions beeing pushed to the clients, no matter of HC, NC, WSAM or whatever. Also there is no mechanism to lock a client to a specific, e.g. NC, version, even though this would solve problems of some guys here, always reporting other problems in the NC upgrade process on the client, after upgrading the IVE... ... View more

Why do you assume based on such a user feedback (whatever slower or faster may mean here), that your IVE OS is too old? Only because of saying it looks faster wie ie6 or are there real facts like - comparing 2 identical pcs with the same connection, on running ie6 the other ie7, brining up the startpage takes every time of access at least 10 seconds more when using the ie7 machine ? ... View more

I never had any upgrade problems reagrding loss of realms, roles or any other config-data since 5.x. We always backup user and system config nightly, and before each backup I do a local backup on the IVE, eventhough a rollback once worked fine without the need to restore anything from a backup. So I'd worry more about the functionality with the new OS than the upgrade procedure itself. ;) Message Edited by ben on 11-14-2008 09:06 AM ... View more

If there is no need for you to upgrade due to a lack of features I'd keepd the current version you have, even though I am not sure if later releases of the 6.0 tree contain any upgrades due to security issues. If so I'd upgrade then. Regarding the problem of different access speeds for some users I don't think that this might be OS related at all. But the same / similar question regarding OS upgrades from 6.0 to 6.x is discussed here: http://forums.juniper.net/jnet/board/message?board.id=SSL_VPN&thread.id=2074 Message Edited by ben on 11-11-2008 09:08 AM ... View more

Ray, but you can control for sure, if the outside interface is directly connected to a firewall (outbound) and the internal interface to a firewall inbound. So you can also monitor where the machine can go in inside direction and how it is reachable from the outside / internet network. ... View more

What we are doing here, as we did not find anything appropriate are two things: - "curling" every 5 mins with a read-only account over the IVE's concurrent user pages, and parse this page's data into a DB so that we can get statistics on the concurrent user niveau, also grouped by realms / roles. - letting the IVE send logins + logouts (filtered based on a filter on the ive) to a syslog server. the server itself is sending messages of this facility to a named pipe which we are reading and parsing a) sucessfull logins b) failed logins c) logouts. But this function we do not use much as datacollection like this is always a serious problem. But it should work to calculate user session durations, at least approximately, because you won't see the real session time when a user closes his browser without explicitly logging out. In case you need the (php) code for the first thing, just let me now, nothing really wild. ... View more

I'd just say no. Did you ask for an FE or how do you expect this feature to be available? Also some others here in the forums were interested in this feature. ... View more

Looks like a redirection error or similar, as the URI does not contain the IVE's DNS-name after the http:// Is only one user affected? Because you won't see anything in the tcpdump about the http stuff, maybe you can install a trial of "ie watch" or similar to see where the browser's sent to. As those kind of plugins are free for firefox (-> httpfox), does this problem for this user also occur with another type of browser? ... View more

Can you describe this problem a bit more, because I did not see a specific problem in the SVW of 6.2R2.1 ... View more

I also missed this document. But it looks like (from the releasenotes) the 6.3 Release starts the integration with configuring the IVE via NSM. ... View more

Is there any restriction for the current loggod on user on his machine, so that JSAM is not able to access the registry? Or maybe is the key, JSAM is looking for missing at all. I guess it's looking for keys like HKCU->Software\Microsoft\Windows\CurrentVersion\InternetSettings\* ... View more

So you are saying you get a cert error on a mobile device but not on a normal PC? What's the actual error message then? IS the CA you say it's trusted also known on the mobile device? ... View more

6.2R1.0 / 6.2R2.0 does not makes sense as it's activeX applets are signed with a revoked cert. 6.2R2.1 was officially announced today to be generally available. Message Edited by ben on 09-16-2008 04:29 PM ... View more

[quote] However, it seems from the thread that you have as much of an issue with having to have a license for each of the sessions initiated by the same user. I can't imagine Juniper counting multiple sessions by the same user ID as one concurrent session for licensing purposes. [/quote] But aren't the concurrent? The Cisco VPN3k, e.g. also counts users logged in twice as two concurrent users. How this may affect the licensed concurrent users is maybe something different, but then concurrent users != licencensed concurrent users. ... View more

Or let your muscles play and ask Juniper for an FE on making the number of multiple logins configurable on a per realm basis. Would be something for that suggestion: http://forums.juniper.net/jnet/board/message?board.id=Feedback_and_Direction&thread.id=58 ;) ... View more

I'd see this problem more as a security feature. As this is a RAS solution it is not that typical to have one user logging in from two places the same time. For sure it might be more comfortable to e.g. allow on a per realm basis a user to login more often, but then the question would be as already mentioned the ccu licensing thing, because those user must be counted n times then. ... View more

But there is (still) no possbility to keep the multilanguage items based on the browser language when using those templates? ... View more

WSAM is only limited to the couple of applications you define that they may have access or let's say processnames (as it does not see an application itself). E.g. you could also allow ping 1.2.3.4 besides SAPGui, whatever. But in my eyes it get's unhandy if you have too much apps for all users together, then I'd personally use NC, except when they are spread among different roles that are mapped based on different user attributes. ... View more

I was on 6.0R4-2 for quite a long time till both clusternodes had permanent 100% cpu load. As this was a bug juniper support told me I upgraded to 6.0r6 which works fine for a while. But I hope to see 6.2R2 soon as we need SVW with Vista support... ... View more

Well opened up our old SA5040 as we had to do this hw change... looks as expected like a "normal" server, so if not too much changed you will be able to replace the harddrive. should be much easier now as they are hotpluggable now, so just give it a try ;) ... View more

I think one goal of SAM, especially WSAM is that you also may check which application is connecting, e.g. a SapGUI. To prevent users using the ACL for that up with any evil tool you may lock it down to a variety of MD5-Sums of possible sapgui.exes. For sure this might get unhandy once in administration if you have thousand of different sapgui versions around you. Also you may reduce the access range to just this application, as with a NC tunnel, you have at least a transparent access to the network (that you grant access to) and at least some attackable servers like DNS or other things you need to give the client access per default. ... View more