<begin rant> My concern is that a company I strongly believed in made a bad business decision by selling off what I and many other people on this thread feel is their strongest product. I compare it to if Apple was to sell their iPhone to a unknown company. Was it broke ? Why fix it ? Is someone getting rich off of this decision ?   Our hardware is end of life. I dont want to pay a premium and go through the growing pains yet again. Feels very similar to dumping ScreenOS for Junos. Also, the only way Juniper could redesign their product is to sell it ? Seems unimaginative and short-sighted. Whats so wrong with Juniper that they couldnt reboot their own product ? Do I need to worry about the other products I use ? In short .. WTH ? Do you worry about your reputation and your standing with your loyal customers ? You should.   No, I dont want to talk about it. The consolidation of VPN products was inevitable for us. Juniper just made the decision much easier. I'm just glad I'm not one of the companies that bought a MAG just before this was announced.   Anyway, that's my 2 cents. Justin <end rant> ... View more

I did a large scale SSLVPN bake off back in the Aventail and Whale days when the technology was new. Neoteris (now Juniper) blew everyone away. The platform has grown over the years and still nothing can come close to it.   This lead us to Juniper Firewalls, Juniper NAC, Juniper Switching. To sell off  the SA is really, really dumb. We're moving to Citrix for VPN access. Makes more sense to us since they are already in house and seem to have no plans to mutilate their own company.   Talk about cutting off your nose to spite your face. Just odd.     ... View more

Hi Spanudiez,   You are making a custom thtml page ? Do you need to ?   In the authentication realm you are using, make sure 'Additional Authentication Server' is unchecked. I think that being checked might be what's causing the second prompt ?   Good Luck,   Kudos me if you feel this helps,   Thanks, Justin     ... View more

I have no time to upgrade this script again but I wish Juniper would provide something official that does the same thing. Its a critical tool. Look at Symantec's NONAV. A complete uninstall/reinstall solves lots of problems with NC. ... View more

What happens if I have a role that has Network Connect enabled (and thus Pulse disabled) and an iOS device is hitting that role? Will it work? You will get some wonderfully generic error I'm sure. NC: 26281628363 or something. No, it wont work. Yes, you should set up a Role tied to a unique URL for pulse devices. Then direct your mac geeks there. Also, does Pulse plug into GINA on Windows like NC does? I'm not sure. Set up a test URL/role and give it a shot. ... View more

Well, I've heard that Pulse will work with iPads and iPhones. Thats the only reason we are looking into it. ... View more

Hi Timo, I made and posted a new version. Follow this link and download the .zip file. http://forums.juniper.net/t5/SSL-VPN/GoAwaySa-Updated-Uninstaller-Script-of-all-Workstation/td-p/115354 Good Luck ... View more

Him Timo, What versions are you trying to uninstall ? I did make a new version. Justin ... View more

Thanks.. ... View more

Are you using reason strings or custom instructions ? If you are using reason strings I would uncheck that and enable custom instructions for each policy. ... View more

Obviously you have host checked set and the Role level and not at the Realm level right ? Under the Role, General, Restrictions, Host Checker, You have the correct Host Checker Policies selected right ? It sounds like for each role you only want 1 policy applied. Finally, some times that error you speak of "Your computer's security is unsatisfactory" can appear because host checker failed to run. It's a bit of a bug. I'd recommend doing two things: 1- Uninstall all components on one of the affected machines. This includes Juniper browser objects. Clear all cache and cookies. Manually install host checker from the installers on the System, Installers page. Try again. 2- If it fails, start a policy trace under troubleshooting, user sessions. See exactly why the user is being denied. It could be the criteria is not selected correctly. It's certainly possible to have only one HC Policy apply to a role. Good Luck. ... View more

yea 6.5 R8 .. I've learned to never install any sslvpn code less then R6 ... View more

guess not ... View more

Why not use the same host name but just change the paths.. ie.. vpn.yourcompany.com/northamerica vpn.yourcompany.com/southamerica etc.. limit the number of hostnames, less confusion, more better. Just my 2 cents.. ... View more

I use to run into a weird issue all the time. If H323 runs through a firewall like Juniper, or Checkpoint, these firewalls try to apply certain standards on the traffic type. In Juniper I think its called ALGS. You have to disable that for H323. The traffic did not comply to the standard correctly which caused all kinds of issues. In Checkpoint we had to delete the predefined traffic class H323 and create a new one just based on the port 1720 ? H323 is also hypersensitive to NAT. Good Luck, Justin ... View more

big help.. thanks flei ... View more

The IVE is rewriting the javascript which is when it breaks. ... View more

Holy Cow, 25,000 concurrent users ? I'm curious how much bandwidth that would take up. Also, I know the 6500 says it can handle 25k but has anyone stress tested it ? Anyway, I think you need to buy and install the Clustering license " Allow 25k additional users to be shared from another 6500 ", on 2 of the 3 boxes. One will be the primary with the all the simultaneous user licenses. Also, With that many users, I'd think you'd want to spread out the load on these boxes. I guess you're running Active/Active/Active or do you have some kind of load balancer in front ? On a side note, on a purchase of that size, I'd think you'd have a team of sales reps to help you out. Good Luck, I'd love to hear how it goes. Justin ... View more

FYI, This only affects users who are using ESP. It will not affect users using NCP. Also, most of my ESP users never complained because, they typically did not stay connected for 2 hours. My users connect, replicate and disconnect. Good Luck, Justin ... View more

https://forums.pulsesecure.net/topic/pulse-connect-secure/40123-upgraded-to-65r31-now-users-complain-of-drops#M7607 I fixed my issue. My problem occured because the ESP Rekey timer was set higher then the NCP Timeout. Even when you set your sessions to use ESP, NCP is still used to handle the control traffic. By default, the NCP timer is set to 2 hours. If you set your ESP rekey timeout to anything more then 2 hours. You will get this problem. The solution is to either to leave the ESP timeout at 1 hour or to increase to NCP timeout to a value higher then the ESP timeout. Good Luck, Justin ... View more

Mazhar, Yes, I've been told that the control data for the session always flows over TCP 443. If this is true then I dont understand how your sessions could be working. I would check your firewall logs to see if you have both 443 and 4500 coming from a client. Justin ... View more

Yes, you could do local authentication and directory authentication. You just set it up in the realm. Choose the 2 different authentication sources. Some would argue that this isnt 2 factor auth. You're missing the "something you have" piece of it. Do you use Host Checker ? What you could do is bury a unique registry key on all the machines you want to have access to your network. Then, during login search for this value. If it doesnt exist don't let them log in. This way you have 2 factor auth. It's something you have, (an approved pc), and something you know, (your id/password). You could also look into 'soft tokens'. I always thought "Bingo Cards" were cool for cheap 2-factor auth but I'm not sure if they ever caught on. http://www.tomsguide.com/us/factor-authentication-in-online-banking,review-678-5.html Justin ... View more