Hi, No point opening a TAC case for this, but on my rooted GSM HTC Desire with SenseUI, Pulse just reboots the handset as soon as you open it, making even the non-L3 options unusable. Would be nice know what versions this DOES work on. Ta Kendal ... View more

Thanks for the input.. In terms of IKEv2 vs SSL, I can clearly see the value/benfit/features, it's more about Juniper's implementation of IKEv2 termination versus Microsoft's. In this case, a lot of the added value features such as hostchecking, Single sign-on etc just don't/can't exist in this scenario. The resource profile is a good one, but in context all 2000+ users are served from a single resource role, they have no idea what there users get up too, so they do an "Any/Any" Accept, although the IPS integration (or at least possible integration with) is a good call. The availabiliy and scalability is a good call as well. From my limited reading so far on the subject, it would appear the biggest barrier to adopting it the MS solution is in fact IPv6; it's essenitally a requirement for basic deploytments, although you can use IPv4 translation..This alone is enough to scare most enterprises away as in my experience, virtually none of my customers have even thought about it, and certainly none of the ISPs i deal with on a regular basis are offering it as part of packages. ... View more

@SonicBoom wrote: our security video was foolishly created in microsoft silverlight, the only way i could get it to work was via WSAM and setting it to no rewriting Thanks for that, I've not tried WSAM yet but I've no doubt it'll work, but it just won't be that practical for the user community I'm dealing with.. Thanks again Kenda ... View more

@cbarcellos wrote: Hello, There haven't been any announced dates for Silverlight support. I'd suggest talking to your SE about filing a feature request (If you want to see the feature added). You can of course use NC or maybe WSAM as a work around for these users. Hi, I've spoken to my SE and already got the official line, but sometimes on here you get a "better" answer from PLM direct that the SE's would never dare give.. The constant frustration this is a couple of existing customers who already own the product, therefore when I fill out the feature request I will immediatlly fall-foul of the "Please state the Dollar value of the opportunity" clause; this figure will be Zero (unofficially I've been told that the required figure is more than our total annual $ value into distrubution) . All that will happen is that they won't renew in a 6 months because the product doesn't keep up with their needs. I realise SAM/NC would probably work, but in context for a pure web app this would never be practical (i.e. the requirement to install activeX or Java components). I'll probably do this as I've got no other recourse to be honest. Thanks anyway. ... View more

Hi Zanyterp, Things weren't looking good, hence I was looking for the more left-field solutions. We are not strictly using DNS to Loadbalance, only for failover should our the primary site fail and even then it is not instanionous (about 8mins of downtime in our testing so far). Suggesting that Juniper don't support DNS Load balancing is like saying you don't support DNS. the SA is oblivious is to what is happening externally to it, for that reason we have to have a solution to provide geographic failover since Juniper dropped the DX (at mine and my customers extreme invconvience and cost). Having seperate nodes doesn't make sense in most cases as it increases the admin workload and the likelihood of an introduced configuration error occuring. Furthermore, despite the cluster license changes in version 7.0 (which the last time I looked still weren't adequatly documented) seperate nodes without local load balancers doesn't give the same guarentees as having a shared cluster across two locations. Specifcally, in the new licenseing there is a 5 day grace period before the license count drops back the surving nodes capacity. This means that we either have to double the licensing that we need, accept that during an outage 50% of capacity will be lost, or purchase ICE licesening at signifncant cost. The problem for us is that some customers we have a 2 week wait time before we can get into there data centre (crazy I know). We have recently had a problem with a cluster node which would intermittetly crash and require a cold boot before restarting, the case went on for 4 months before the issue was resolved, during that time would have been at 50% capacity for most of the duration. Whilst the new licesning scheme offers a new solution, it's not going to be right for everyone and I think a lot of -CL licenses will still be sold. The primary reason we have DNS failover versus local balancers is cost; an in the cloud service costs about $4000/year to maintain, the cheapest, nastiest hardware load balancers I could find which met the spec were ~$20,000 all in for the first year, the preffered F5 solution was ~$60,000. ... View more

Hi JJH, thanks for your contribution, another poster seems to contradict you but I will give it a try in anycase as i've nothing to lose really. ... View more

Hi, Thanks for that, not a bad idea.. Sadly we don't have any hardware load balancers in the environment as I know that we would have various options then as they inevitibly would be much "smarter" and properly location aware. The JPG idea is definatly feasible, equally it occured to me that I could include in a custom template a reference to the cluster status page, wouldn't be massively elegant but would at least give me something. I'll have a play with a custom template and see if that gets us anywhere.. All other ideas/opinions still greatfully recieved.. Thanks again Kendal ... View more

In earlier versions of IVE (pre 6.1 I think) there used to be a network connect user log which could be optionally enabled for precisely this reason, under dire warnings of potential performance problems caused by logging these packets. For reasons that were never explained it was dropped. This now makes troubleshooting NC incredibly difficult especially when dealing with "messy" protocols such as Windows Domain auth and SMB which make random connections all over the place. Whilst it is possible to do client-side logging, It doesn't do per-packet logging. Not ideal, but the best solution I have is to install Wireshark or similar on a test PC, capture on the network connect interface and look for unreturned TCP syns/ restransmits from the client PCs. This is incredidly labour intenstive compared to look for a "deny" in an event log and adding that destination/port to the ACL. ... View more

Hi, It's the back-end URL you need to change as that the bit the ACL applies to.. Regards Kendal ... View more

Hi, This is because the ACL for ActiveSync and OWA are conflicting. The simplist way around this is to create a host entry on the IVE for something like "mobilemail" and point it to the private IP address of your exchange server. Then edit the sign-in URL for your Activesync to point to the hosts entry. This allows you to have one ACL for Activesync, one for OWA and never the twain shall meet. HTH Kendal ... View more

That's because that feature is only available in 6.5 which has only been GA on the Juniper support site for a couple of days. Download that, upgrade and it's all gravy; I've one customer who was so happy they went live with Beta 2.. ... View more

Hi, Easier still, just use openssl; there is a complete example "how-to" in the admin guide (just do a search). Follow the instructions CAREFULLY and you'll be their, takes about 20 mins. enjoy. ... View more

Aah, we're running 3.0, sorting out the ugprade now! Thanks Dude! ... View more

Hi, That sounds a lot like our issue, I'll find out what version of software we're using! Thanks Kendal ... View more

Hi Yes we used Form post, Settings: Base URL: https://mysite.local/index.jsp Post the Resource: (Post the following resource) https://mysite.local/index.jsp https://mysite.local/index.jsp Label -------------------- ------------------- Name ----------------------------- Value (Not modifiable) authType authType-windows-password true User Name: windows-password-username <USERNAME> Password: windows-password-password <PASSWORD> Domain: windows-password-domain MYDOMAIN-NB Submit: submit Login Now back to my problem :) Bascially the session sits at "Establishing Conneciton to View Server" for about 2 mins before it shows the session. This takes 20 seconds MAX on the local lan, any ideas? Because we have to use SSL the packet capture is fairly meaningless... Thanks Kendal ... View more

Hi, I'm doing some testing on this at the moment, I have gotten the single sign-on working but beyond the authenticaiton, it takes about 2 mins to load the list of available services (there is only one!), on the LAN it takes about 20secounds max. Once the session is started, the performance over network connect is excellent, but getting there it takes it time. Any other suggestions? Regards Kendal ... View more

Well, after replacing the 9/10 fans that had failed over the years, we changed the hard disk and now run VMware on it for our test systems! Makes a nice little rack mount server :) ... View more

Hi Dogmai, The Juniper Client logging is pretty good, if you know where to look.. If you enable client side logging in the IVE admin console, when users login they will automatically generate an "EPcheck.log" file which is buried in a hidden directory under \documents and settings\username\EPcheck\epcheck.log. This explains in verbose detail why the check failed. Admittidly this won't be mean much to the average end-user, but you should at least be able to figure it out.. With the "canned" esap tests when there is a problem is does take a while to sort I'll admit..In the meantime as a workaround I tend to create an "oldschool" test and manulally check for the bit myself that aren't working. Juniper have been tinkering with this functionailty a lot in the late 6.x releases, whilst still not perfect it still is much more comprehensive than any other vendor that I've seen.. ... View more

Hi, You can do this using the WSAM and the NetBIOS file browsing option, however, this never works very well as the Windows security model doesn't make this easy for anyone. Mapping network driver across VPN (SSL, IPSEC or otherwise) has always sucked for me.. Hope that helps.. Regards ... View more

Yup, it'll be fine! You can run like this with a dead primary for 90 days from memory; more than ample time to get it RMA'd.. HTH Kendal ... View more

Hi, I guess this is the limitation of using an add-on tool kit such as ProperRDP rather than something home-grown. You could use a <userattr.prefferedterminalserverIP> and populate the users home terminal service in the LDAP first, but I don't think that this is what you want.. Relisatically I think you're options are as foo says, use the JSAM or raise a Feature request with your local SE. My success rate for feature requests such as this is less than 10%. Regards Kendal ... View more

Hi, In the event that you completely loose your primary node and you need to reboot your secondary node, your remaining device(s) will continue as normal. Even when the primary is down the secondary still retains the license details of all other members of the cluster; as long as one device retains these details then remaining devices will function as normal. Obviously you'd RMA your dead 4000 ASAP and get customer care to resassign your licenses to the new tin. There is a full procedure for this in the admin guide I believe. Hope that helps Kendal Message Edited by KendalBeefcake on 11-24-2008 02:34 AM Message Edited by KendalBeefcake on 11-24-2008 02:34 AM Message Edited by KendalBeefcake on 11-24-2008 02:35 AM ... View more

Hi, After nearly two weeks I finally got the patch out of Juniper, and it doesn't work! I've included URLs you mentioned but still gotten no-where. Basically if you open up an archived mail it works, but all the buttons are missing..I'm going to go back to TAC but this is going to take some time, any other ideas? We are using EV 2007R1, apparently there is an R3 patch, not sure if that makes any difference.. I've attached a screen shot of the missing shortcuts, going direct to the OWA server. Thanks! ... View more

Thanks Ruc, I'll give the Tac a tinkle then! ... View more