- Pulse Secure Community
- :
- About dcvers_
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
since
10-29-2017
10-29-2017
dcvers_
Regular Contributor
196
Posts
1
Kudos
11
Solutions
07-08-2015
03:01:AM
There was a rewriting filter to fix this but it doesn't work with newer versions of Citrix. I opened a JTAC ticket but they intial said Citrix storefront 2.6 in general was yet supported and we should consider using HTML5 on Citrix. Later I was told 2.6 was supported in in 8.1R3 but when I tested this on my test box it didn't fix the issue. It was only impacting a small number of third party users so we just told them to use a different browser.
... View more
07-08-2015
02:50:AM
We have started having some issues with users in China. There are two possible issues, one if bad performance of their ISPs. The other is that there have been reports that some Chinse providers/the government are actively blocking VPN connections. Has anyone else had issues with Chinese users and if so have you found any workarounds?
... View more
06-25-2015
05:29:AM
Try the following: 1. Go to C:\Program Files\Common Files\Juniper Networks\JSCDT and right click on the JuniperCompMgr.exe file 2. Select Properties and switch to the Compatibility Tab. Note: If the Compatibility mode settings are greyed out click on the Change settings for all users button 3. Deselect the Run this program in compatibility mode check box and click on Appy. Click on OK to close the dialog.
... View more
06-23-2015
02:33:AM
We're in the process of rolling out the new Pulse Secure branded version of the Pulse desktop client and enabled a post authentication notification message to reasure the users nothings really changed other then the branding. The message is set up to only show if they are using the new client and the "Skip if already shown" option is enabled on the sign-in policy so in theory they only see it the first time they connection. This seems to work for a while and then suddenly they get the message again. In the admin logs I am seeing messages (ADM22862) for the users being removed from the authentications server. Could this be causing the issue and if so how to I control the removal? If not any other ideas why the system is not remembering the user has seen the message?
... View more
06-23-2015
02:23:AM
It sounds like this is a second hand box with the original configuration still enabled. Your best option may be to factory reset it via a console cable. Instructions can be found by searching this site.
... View more
06-05-2015
06:48:AM
We've jsut started getting issue with SAP Netweaver and Internet Exporer through the re-writer. We are seeing messages like: "'The application was stopped due to a critical rendering error. The IE compatibility view is not supported" and "'The application was stopped due to a critical rendering error. Use devices 'standards' in you appliation..." We are not seeing the same issues when accessing the it directly on the LAN. After some ivestigation it seems the issue is due to IE compatability modes. Via the LAN IE us running in version 5 mode but via the web re-writed in Edge (default) mode. I'm not web server/Netweaver expert but I think the mode is being set by a directive from the web server. I think the issue is the web server is not recognizing the client is using IE via the web re-writer so not sending the directive or it is getting stripped out by the re-writer. Any ideas how I can ensure the client browser type is passed through to the backend server and the directive passed back to the client? Or any other ideas to fix the issue.
... View more
05-20-2015
07:31:AM
If you want to check the machine store you need to use a host checker policy. If you just want to use a machine certificate then I think the way to do it would be be to set up a realm restricition with the machine certificate host check and then use an anonymous server for the authentication
... View more
05-20-2015
07:21:AM
Because the release notes state the is an issue with deploying profiles to the new client with AirWatch I did not want to waste the time of the AirWatch team until the issue was fixed. The workaround only references how to configure AirWatch to deploy a profile with Per App VPN. So the question is does a simialr workaournd exist for a VPN on Demand profile or could we adapt this workaournd? I guess the other question is, what exactly is the issue refered to in the release notes and how does it manisfest itself? We have a very lean IT organisation and don't have the resources to double checked every known issue. If the release notes say there is an issue we're going to take the vendors word for it and if possible wait for the fix.
... View more
05-15-2015
01:04:AM
Just received the notification of the removal of the Junos Pulse Mobile Client from App stores at the end of Q2-2015 (TSB16705). This TSB includes links to documents with basic instructions on how to deploy the Pulse Secure version with AirWatch or MobileIron with Per App VPN but the release notes for the Pulse Secure Version lists the following as the first two open issues: PRS-319284: Air Watch MDM VPN profiles are not getting pushed to the Pulse Secure client. PRS-319282: Mobile Iron MDM VPN profiles are not getting pushed to the Pulse Secure client. Firstly just over a months notice is not enough when you are looking at enterprise deployments. Secondaly is a new version iOS with a fix due out that will support VPN on demand profiles? I seen the new Android version still has the issue.
... View more
04-24-2015
01:11:AM
I see the TSB has now been updated with and ETA of 15th May for a fix for 8.1 (8.1R3.1) and 1st May for a fix to the Windows desktop client (5.1R3). So my question now becomes is Pulse 5.1R3 the version that will be included in 8.1R3.1 or will a newer version be include. In other words if we install the Pulse 5.1R3 client will the user be prompted to upgrade the client when we upgrade to 8.1R3.1.
... View more
04-21-2015
12:48:AM
Does anyone have a rough ETA for Fix for TSB16661 on 8.1? We are in the process of an upgrade project and reached the point where we are planning the Pulse client deployment and it would be good to know if the fix is expected in the next few weeks.
... View more
04-17-2015
03:19:AM
I have seen this behaviour if you are granted restricted administrator rights using a Delegated Admin Role. In this case it could be you have rights to manage the role mappings but not to the Auth Server itself (the groups are part of the server catalog).
... View more
04-17-2015
03:09:AM
When the release Notes say 7.1R16 to 8.0R1 in the release column this means this is the path for any release from 7.1R16 upto 8.0R1 and this will apply for any later 8.0 release unless changed in a later version of the release notes. I believe you should be able to upgrade a virtual appliance using the same package as the hardware appliance.
... View more
04-10-2015
06:13:AM
If you look at the Users tab for the authenitcation server it will show you the agent including the version. Adjust the Show users number to be sure to see all users.
... View more
03-02-2015
06:29:AM
What is the purpose of the secondary LDAP authentication? If for example you are just looking to check group membership for role mapping you don't actually need to authenticate to the LDAP. All you need if for the user ID in the certificate to match that LDAP user ID and set the Directory/Attribute server to be the LDAP server.
... View more
02-27-2015
06:02:AM
If you own the device in the Kiosk then as Chris said you can use certificate based authentication. If you use the Pulse client with an appropriate location awareness condition then you can have it automatically connect when it boots so it would require no user interaction.
... View more
02-16-2015
05:31:AM
You can customize some of the default messages via the Default Options button onthe User Roles page. Here there is a tab called Custom Messages.
... View more
02-02-2015
05:13:AM
On the Realm Certificate Authenitcation Policy you can optionally specify required certificate attributes and expected values. However, in my experience which attributes can be checked it limited to the basic certificate attributes and various Subject Alternative Name attributes
... View more
01-26-2015
07:03:AM
If you have two realms and want to use realm1 if the DLL present and realm2 if it is not present then create two host checker file policies for the DLL, policy1 set to "Required" and policy2 set to "Deny". Assign policy1 to realm 1 and policy2 to realm2. Assign both realms to the same sign in policy. As only one of the host checks can be true only one realm will be available on the sign-in policy so the user will get Realm1 or Realm2 depending on the presence of the DLL
... View more
12-12-2014
04:59:AM
It looks from the logs like your issue is with Host Checker. They say it is failing for all roles. We don't apply Host Checks at role level but I have seen something similar with Realm level checks. This normally indicates a corrupt HC installation. Uninstalling and re-installing normally resolves the issue but if you are repeatedly getting the issue it could be something in your environmentis conflicting with host checker. The fact it works with the Network Connect application and clearing IE settings suggests it could be something in the IE configuration.
... View more
12-08-2014
02:48:AM
If you have a layer 3 connection (e.g. Network Connect or Pulse) the chances are there will always be background traffic keeping the session alive even if the user is doing nothing.
... View more
12-02-2014
08:09:AM
Try connecting to the URL using a browser. You can then inspect the certificate to see what the issue could be. It is possible for some reason (malcious or otheriwse) you are hitting a server spoofing you VPN box. A common cause of this is if you are connecting through a hotspot that requires authentication. In this case it could be you have not authenticated yet and so are being redirected to the authentication page. Again using a browser may show you the cause.
... View more
11-28-2014
02:08:AM
This normally means something has changed in AD. Prime candidates are: 1. Someone have moved your AD groups to a different OU (in my experience AD admins seem to be always redesigning the OU structure) 2. The AD account used by the VPN boxes is disable, locked or the password has changed/expired.
... View more
11-06-2014
03:04:AM
My understanding is Rollback takes you back to the exact state (version and config) prior to the upgrade. So it is not downgrading you current config to 7.4 but restoring a snapshot of the box taken at the time of upgrade. I think your only option would be to downgrade the production box to 7.4 and restore your most recent 7.4 backup and then re-apply any changes made since that point.
... View more
10-13-2014
05:12:AM
Not sure why this would affect the certificate authenitcation but it could be there is a difference between the configuration profile you are using for the manual install and the current configuration on the MAG. Logging in via a browser will update the users lcoal configuration which could explain why everything starts working. To check try exporting the configuration again and compare it to the file you are using for the install.
... View more
09-17-2014
05:32:AM
One option could be to make the old "Redmond" group a member of the new "World" group and reconfigure your mapping to use the new group. You will also need to check the Nested Group search option are enabled.
... View more
09-09-2014
06:36:AM
I don't believe there is any direct relationship between the URL number and the sign-in policy position I think it's more to do with the order the policies were created. And I guess the box may re-used numbers if a policies is deleted. I do know from experience that the number can change when you do an upgrade/config copy between boxes which can be annoying if users have bookmarked the sign-in page.
... View more
08-26-2014
06:46:AM
If you want to use the settings across all (or most roles) then don't select the option on the new roles and the defaults will be used for the user session. You only need to enable the settings on the new role if you want to use settings different from the default.
... View more
08-26-2014
06:40:AM
It can be a little confusing at first but MAG is just the "server" platform the Secure Access (SSL VPN) solution runs on. IVE (Instant Virtual Extranet) is just another histroical name for the Secure Access solution. What you need is the Secure Access documenation. Assuming you are running version 7.2 then j-sa-sslvpn-7.2-adminguide.pdf is the right document for SSL VPN. The first part of the the document (Getting Started) includes step by step instructions for setting up a test scenario and is the best place to start if you are new.
... View more
07-25-2014
05:06:AM
I would strongly agree with Kita about using an MDM solution. We originally started out using a manual process but it soon got so labour intensive we had to hire a contractor part time to process the requests while we looked at implementing the MDM solution. Even 10 users could take an hour plus to process. Remember you not only have to do it once but repeat the whole process once the certificares expire and to do this you need to be tracking the expiry dates.
... View more
Latest Tags
No tags yet
© 2017 Pulse Secure, LLC. Use of this website assumes acceptance of our Legal Notices and Privacy Policy.
Pulse Secure has updated its Privacy Policy effective June 28, 2017.
