One of our customers had a similar problem to this once. It turned out that it was to do with the Primary Group that the users had been assigned in AD. As a result, we ended up creating 2 role mapping roles for each group. eg 1 group is "Sales" 2 attribute "Primary Group ID" is "1234" (Where 1234 is the AD group id for the Sales group) Might be worth trying. Keith ... View more

Yes, Single Sign On will pass on the credentials that the user logged in with, assuming the Values are the logon details, eg <USER> & <PASSWORD>. If the web resource uses different details, why are you using SSO? Could that be what's causing your problem? Keith ... View more

10th April, according to the Juniper engineer I spoke to this week. Keith ... View more

I raised a support case with Juniper this week about AVG 8.5 on ESAP 1.4.7. Without running any tests, this is what the engineer told me: 'There is a known problem with this version and currently we are in the process of including this version support in future ESAP 1.4.8. The ETA for 1.4.8 is 10th of this month, (ie April '09). The current workaround to support this version is to use a custom process check other than using the pre-defined AV check. The processes to be included in the HC policy are avgcsrvx.exe, avgnsx.exe, avgrsx.exe, avgtray.exe and avgwdsvc.exe.' This now works, but is obviously a very poor alternative, as it doesn't check when the user last updated. Keith ... View more

Do you have ' Deny direct login for this resource' ticked? ... View more

No, it's effectively the user's home page, replacing core services. We fixed the problem. There was a rogue line of code preventing the browsing toolbar from showing. Keith ... View more

In the SSO details, are the 'Name' and 'Value' correct? I think that by default the values are 'login' and 'password'. Are these the correct values for the page you're posting to? Keith ... View more

Try separating the list of AVs into 2 rules. You can do this still in a single policy. I seem to remember that if you do them all in a single rule, then it overloads the buffer. Keith ... View more

In your resource policy, change the Username & Password in the SSO settings from 'User CAN change value' to 'Not Modifiable'. That should fix your problem. Keith ... View more

Dan, Hi, can you go into a bit more detail on that? Is NETLOGON a network share, or a server? Either way, whereabouts do you store the script? Thanks, Keith ... View more

If you don't mind me asking, why are you using IAS? Vasco can also answer RADIUS calls, if that's all you're using IAS for ... View more

Does anything appear in the Vasco Audit Viewer? (ie failed login attempt etc) Also, you say that you're using both NICs on the IVE. I assume that the routes are set up correctly? Can you ping the Vasco server from the IVE? When you set up RSA, was it in the same subnet as the Vasco server now is? ... View more

Are you saying ping doesn't work from either the IAS server or the IVE to your Vasco server? If that's the case, I would check your firewall settings ... View more

Did you get anywhere with Vasco Tech Support? ... View more

Originally we were trying to reach the script through a SAM connection, (ie local to the IVE). After several weeks working on it with a Juniper engineer, he eventually told us that SAM can only run local scripts, (ie C-drive only). He said it was, however, possible to reach scripts local to the IVE on NC. Further testing on NC has so far proven unsatisfactory, though. We managed to find the following error mesasges in networkconnect.log: Can't copy win_start_script from \\server1\script.bat to: C:\DOCUME~1\user\LOCALS~1\Temp\3865.tmp.bat, err=53 There were a couple of other similar errors, 20 & 1326. So far, though, noone has decoded them, though. Any ideas, anyone? Keith ... View more

Never be afraid to ask the obvious questions. It's in Log/Monitoring > Admin Access. I just tried a policy trace for my admin session on our IVE & it didn't log anything. So I guess policy trace's don't log admin sessions. I assume you're able to create & edit web bookmarks still? ... View more

Did you check the administrator logs? When you did the policy trace, did you make sure it was the administrators realm? ... View more

Have you tried looking in the logs, or running a policy trace, to see if there are more details on the error? ... View more

Well, it says that your Vasco server, 10.0.0.1, is unreachable from your IVE. Are they on the same subnet? Is there a firewall in-between? Have you also checked that both Juniper & Vasco are using the same RADIUS ports? ... View more

It's definitely possible to reorder web bookmarks, as I just tried on ours and it worked fine. I'm not sure why it's not working for you though. Do you have full admin rights? Keith ... View more

You need to configure a number of steps to get Vasco authentication over Juniper working. When you say RSA worked, did you configure RSA over Juniper? If so, it's a good starting point, and allows you to copy a number of the settings. With RADIUS servers, the first things I check are: - shared secret - overwrite it again at both ends - token - use the Vasco RADIUS Test tool to check the token works, without involving Juniper at all. If it's not working, then it clearly won't work on Juniper Are you sure you've got Vasco set up correctly? Keith ... View more

Swivel Secure offer SMS & email OTPs & security strings. They also have an interesting concept of an on-screen, randomly generated .gif image with a security string on it. This would obviously mean making a server web visible, though, to generate it. We've supplied it to several customers & it works really well. Keith ... View more

Have you tried using the (Softerra) LDAP Browser? It's a fantastic, free, little tool for working out A/D schemas. Keith ... View more

I don't think that solution is going to be much use. Shabib is talking about SSL VPN & crazyl3gs is talking about a Netscreen 50, ie a Firewall / VPN. ... View more

It looks like upgrading to 6.1 R2 fixes this problem, both for AVG 8.x, and Norton 2008. We're gone live with it now, after testing it briefly. So far, so good... Keith ... View more

Terry, You're not alone on this one. I've had an open support case with Juniper for 6 months now, with Norton AV 15.x also not being supported on each of the most recent ESAP files. And in 1.3.7 we noticed that AVG 8.x was now no longer working. I'm afraid I can't yet offer a solution, but will post if we manage to fix it. Thanks, Keith ... View more