JTAC says that iNotes 8.5 will be supported in version 6.5 due out soon. However, they got my config working with 6.3r4 using four policies all defined with the base URL and a star wildcard - No-Cache-No-Store, compress, SSO (Basic Auth), ACL. At least the site looks right. Now I need to verify that it works. ... View more

I'm anxious for a solution to this too. I'm running 6.3r4. Juniper must have folks working on Notes integration . . . and they probably have a document that defines the policies (compression, caching, acl, SSL, etc) needed to support 8.5. If any Juniper engineers monitor this forum, could you please let us know what policies are needed so we can create them manually ? Thanks! ... View more

I'm running 6.3R4 and the problem exists in that version too. I'm glad to know (a bit of schadenfreude) that others are suffering with me. ... View more

Yeah, you can pay a heavy price for upgrading. . . No proxy server settings at all in my net. I really want this problem fixed - and I can't believe that it's not widespread. It is so easy to duplicate on my IVEs. ... View more

I've recently upgraded to 6.3r2 with current ESAP - and the problem remains the same. ... View more

Hi clumsy. I would recommend against it, but if you have to - you can use complex matching to force policies to do what you want. Sorry about the formatting. Since all Hostchecker policies are evaluated simultaneously, it makes controlling the remediation process difficult. I use boolean logic with the rule sets to force an order on policy evaluation. For example: 1) I don't want non corporate computers to connect at all - whether or not they run the right FW and Virus software. And, I don't want non corporate computers using the remediation process to get my corporate version of FW/AV 2) If it is a corporate computer, I want to make sure FW is installed first. The FW remediation is difficult and lumping both FW and AV remediation together was found to be too difficult for non-technical users. 3) If it is an corporate computer and FW is installed and functional, then check for AV and signatures. Here is how it was done: Policy - SSL Access Not Allowed from Non-corporate Computer Name Rule Type Summary Login_Script_Exists Files required C:\Program Files\IT\Login\hmilogin.bat Require: All of the above rules Policy - FW Not Running Name Rule Type Summary AntiVirus_Running Processes Process Name: Rtvscan.exe required Login_Script_NOT_Exists Files deny C:\Program Files\IT\Login\hmilogin.bat Firewall_Running Registry Settings Key/Subkey: SOFTWARE\Symantec\Managed Products\Symantec Client Firewall\Status DWORD; 0x00000001 Require: Login_Script_NOT_Exists OR (Firewall_Running AND AntiVirus_Running) Policy - Virus Signatures Need To Be Updated Name Rule Type Summary AntiVirus_NOT_Running Processes Process Name: Rtvscan.exe deny Login_Script_NOT_Exists Files deny C:\Program Files\IT\Login\hmilogin.bat Firewall_NOT_Running Registry Settings Key/Subkey: SOFTWARE\Symantec\Managed Products\Symantec Client Firewall\Status DWORD; 0x0 Current_Virus_Signatures_Required Antivirus (predefined) Rules configured: Symantec Client Security (10.x) Require: Login_Script_NOT_Exists OR Firewall_NOT_Running OR AntiVirus_NOT_Running OR Current_Virus_Signatures_Required ... View more

I've run session start scripts for a long time. I originally used a local script with success, but eventually moved to a network-based script. To answer your question - YES, I've had big problems. I've had MTU problems, issues with NetBIOS (hence, no script access) caused by Kerberos over UDP (yikes, that was awful), and problems with syntax (\\domain doesn't work in the UNC). ... View more

Yes, unfortunately they haven't fixed it yet. I'm on 6.1R5 and the problem is in that version too. I've had an open case with JTAC, but it takes sooooooo long to get the data they want. If only we got paid to upload system snapshots to Juniper, we'd all be RICH! I've simply disabled the recheck (by setting Perform check every to 0). That doesn't make my security folks happy, but until Juniper fixes this there isn't much that can be done. ... View more

Jahmal, I tested this over the weekend and it works great ! Thanks very much. ... View more

That's great news. I tried it with a comma and space separating the two IPs - and it didn't work. It saves ok, but when you go back into the policy definition the second IP has been chopped off at the comma. Separating the two IPs with a comma saves properly. I'll give this a try this weekend. Many thanks ! ... View more

WINS is the gift that keeps on giving ! Every time we think we no longer need WINS, we discover that Microsoft uses it in some new strange way. Good luck to you in eliminating it. I don't necessarily agree about the difficulty of having two servers offer the same scope. Split scopes are easy, they work, and have been around forever. We use Cisco CNR which can be configured for scope or server redundancy - but each server is independent (not sharing a single IP). Ours are separated over a WAN for DR, GLB, etc. I like the idea of having the IVE use the helper addresses, but that would limit your ability to specify different DHCP servers per policy. I still like the ability to specify a server in the IVE, I just want them to allow a list of IPs. ... View more

I've got two reasons. 1) You can only specify one WINS server - so that's a single point of failure if that device dies. 2) You can't offer other DHCP options - like a voice server using Option 43 for a softphone. Unless I hear some great solution, I guess I'll stay with my current config - since I'd rather have a WINS failure than a DHCP failure :) It's odd, however, why Juniper doesn't recognize and fix something obvious like this. Thanks Jickfoo ! ... View more

What exactly isn't working? I've had problems with kerberos over NC - drives not mapping in some cases. That ended up being the size of the kerberos packet that is returned to the server. Changing to kerberos over TCP on the client fixed my problem. ... View more

I'm running 6.0R5. You may be right about it being different, but it sure sounds identical. My epcheck.log shows no problems, user booted off NC, the following in the IVE log - Info AUT22927 2008-05-19 15:17:39 - ive - [1.1.1.1] domain\user(Network Connect)[Network Connect - Autolaunch] - System process detected a Host Checker time out on host 1.1.1.1 for user 'domain\user' (last update at 2008-05-19 14.38.38 -0400 EDT). The only difference I see is that my problem appears in dshostchecker.log, and that I can get around it by turning off policy re-evaluation. This is what I see in dshostchecker.log 2008/05/27 10:02:29.109 dsHostChecker: tFFC "DebugId" 'CHttpNAR::run()' [Debug] CHttpNAR::run(): Error 1 sending HTTP payload. Host Checker quitting... When I set "Perform check every" to 0 (which disables periodic re-evaluation of compliance), my users are fine. I've had several JTAC cases on this for several months, uploaded hundreds of megs of snapshots, etc. ... View more

Aaah - Thanks. I've never tried to nest there, but that would be a great feature. You can use boolean operators, so you can use logic (gotta love those truth tables) to enforce evaluation order. . . but that's not what you want. Good luck with this. If you can get it working, please post it. ... View more

That's the way I understand it. I use the NASA Julian calendar and have to adjust by 1 day (since Jan 1= 1). http://daac.gsfc.nasa.gov/julian_calendar.shtml ... View more

I've got the same issue. I've temporarily fixed this by disabling HostChecker policy re-evaluation by changing "Perform check every:" to 0. I've got an open JTAC case on this because I'm having a difficult time duplicating it in my lab. My EPCheck.Log is fine. My problem is seen in dsHostChecker.log pretty clearly (must enable HostChecker logging). It does this until it gives up and the user is booted. 2008/05/27 09:57:40.888 dsHostChecker: tFFC "DebugId" 'CHttpNAR::WaitForNetwork()' [Debug] CHttpNAR::WaitForNetwork(): HTTP_RETRY, Network problem, retry in 15 seconds 2008/05/27 09:57:55.872 dsHostChecker: tFFC "DebugId" 'sendTncOverHttp()' [Debug] sendTncOverHttp(): session cookie DSSIGNIN=url_25; path=/dana-na/hc/tnchcupdate.cgi; secure; /SNIP/ 2008/05/27 09:58:16.943 dsHostChecker: tFFC "DebugId" 'CHttpNAR::WaitForNetwork()' [Debug] CHttpNAR::WaitForNetwork(): HTTP_RETRY, Network problem, retry in 15 seconds ... View more

What do you mean by "expressions"? Are you talking about resource lists, HostChecker policies, etc? ... View more

Felipe, Are you saying that the SPF ports are not intended to be used for primary connectivity? Mine seem to work perfectly - I've been using them for several years on my SA-6000s. I connect mine to a WS-X6408A-GBIC blade in a 6500. These gig ports default to auto-negotiate, and mine are left that way. So, what is Juniper's official stance on SPF ports? Should we use them or not? Thanks! Kevin ... View more

I use them. Just plug them in. No need to enable them and no special license is needed. ... View more

The "universal print driver" that the docs are talking about is the TS Easy Print feature of RDP 6.1. So if you can't use RDP 6.1, you won't be able to benefit from the new feature of IVE 6.0. UniPrint is a third-party solution to this (http://www.uniprint.net/products_TerminalServerEdition.asp). ... View more

There are several popular Java clients including properJavaRDP (works in Windows, Linux, and Mac) from http://properjavardp.sourceforge.net. The latest version is available at - http://sourceforge.net/project/showfiles.php?group_id=90078. ... View more

I do something very similar when troubleshooting problems. Configure a log filter to match [probably something like (id='AUT24326') and realm='Admin Users'] Then under log settings, create a syslog server host for that filter. I use Kiwi Syslog Daemon as a receiver, which has a great set of tools you can use for responding to incoming syslogs. This will not work as well on the 700 since it can't do filtering like the larger concentrators. But, you can still do it without filters. ... View more

Keith, I tried this morning and got the same results. My JTAC case was escalated yesterday. I've provided the engineer snapshots, etc. Also included was a OesisDiagnose.log. The OESISdiagnose utility provides some GREAT information about how the client postures! I wish that was a widely available tool. Is there any documentation available? Any command line syntax that could make this utility work without user interaction? In any case, they should have everything they need. I'm anxiously awaiting an answer because I've got Vista users pounding on my door every day! Thanks again for your help. Kevin ... View more

Keith, That's great! Thanks very much. Regards, Kevin ... View more

Ken, If you're willing, would you please send me your case number to my email - [email protected] I would greatly appreciate it. I'm also working with JTAC on this, and my engineer doesn't believe others are working on the same case! Thanks. Kevin ... View more

Also look at NWG Technologies (http://www.nwgtechnologies.com/products/product2.html). They have SSL ClearView Reporter which is really excellent. ... View more