This feature is really NOT BAD! I would have liked it, IF:   This User would also have the ability to assign this new created user to one or more roles! Generating a user in a particular authentication realm would otherwise mean that this use-case is just for ANY authenticated realm user that will be able to use all roles.   OR: that you are forced to do the role mapping with username prefixes and mappings to different roles   f.e. role1_stephan, role1_linda are the usernames and you pre-configure the rolemapping like this:   if username IS role1_*             assign role1   This feature would have made more sense, if you would have local user GROUPS, assign those groups in the rolemapping and create local users IN A PARTICULAR group. But like this, it is ... a little useless.   btw... the password change option is quite good.   Best, Ate   ... View more

Hello VVJ, - Please forward the error messages from the pulse client automatically to the user access log. That should be possible as long as there is a connection to the MAG. ==> We currently do print messages in the User Access logs for any SA side errors that come up during bringing up the tunnel. Examples are when there are no IPs configured/DHCP server not reachable, ACL counts exceeded etc. Other than this, we also log entries for sesssion timeouts on Pulse as well. The rest of the scenarios are mostly due to issues at the client side which the SA is not really aware of and hence is only printed in the Pulse client side logs.    ->> understood and the server side errors are listed there, I know. But if just the reason string on the client side would be written also in user access log (just in case the user logs in through the web-interface, before launching the pulse client) that would also help a lot.   - Display in the header line somewhere the device name (hostname or anything self configurable) Because: when accessing the device over an ip address with nat, it's annoying to search always for the certificate and / or sign-in policy and check there if you are on the right device. ==> We currently print the member names on top in case you are logging into the Admin UI of a cluster. Are you looking for something similar for stand alone devices as well?   ->> Exactly! I need that also for virtual appliances (VA-SPE) they come out usually default like with "localhost2" that is somehow not changeable...   Managing many of them becomes really irritating...   Thanks for replying! And also thanks for forwarding.   Ate ... View more

Hi VVJ,   am I completly wrong with my post here? Any feedback on my post would be nice.   Ignoring it  is not :) When this is the wrong place to put it here - please tell me.   But my experience is - when telling our senior system engineer contact:   - he will write some lines as a feature request - those feature requests will put somewhere - I will never hear anything about it in the next years   Best regards, Ate ... View more

Forget it..   Yes - you would have required an extra license, but afaik IVS is already end of sale.   Ate ... View more

@ksimpson@ap.org wrote: Could anybody advise me when the Juniper SSL remote access units SA4000 and SA6500 go end of life? Thanks Please keep in mind that upgrading until 7.1 ist just possible with SA4000! Even if the End of Life / End of Support is at the end of January 2015. Best regards, Ate ... View more

Spacyfreak gave you some good ideas about the whole stuff.   First of all we assume, the workstations have a valid USER cert. (we are not talking about machine certs here - that would be covered by host-checker)   - create a new auth server as a certificate server User Name Template: is the only stuff that is important here...   f.e. <certAttr.altName.UPN> for User principal name   - go to configuration -> Certificates -> Trusted Client CAs Import Root and maybe also intermediate CA certificate   - create a new realm User the certificate server auth server entry for authentication   Go to authentication policy certificate and select "Only allow user with a client-side certificate signed by Trusted Client CAs to sign in...)   That's it ... Rolemapping * -> to Role   Everybody with valid user cert will be able to logon.   Ate ... View more

@VVJ wrote: Please post your thoughts and queries for features you are using or would like to use. Our senior technical engineers will be answering your technical queries, and will try to resolve each of them. Hi,   - First of all, for troubleshooting reasons it would be great if the user gets the DHCP Junos Pulse address displayed in the client! Proxy and DNS Settings (including the search domain) would be great. All optional configurable on the server side.   - Find a way to cluster the license server (active passive would be just good enough...) There is a way to re-register a cold standby device, but this is not a great way to deal with it.   - Please forward the error messages from the pulse client automatically to the user access log. That should be possible as long as there is a connection to the MAG. In case the is a problem with the virtual adapter, SSL VPN would know that there is probably a client side problem.   - Improve Archive schedule ... it is annoying to click on EACH entry, to click on EACH day, enter EACH time...   - Display in the header line somewhere the device name (hostname or anything self configurable) Because: when accessing the device over an ip address with nat, it's annoying to search always for the certificate and / or sign-in policy and check there if you are on the right device.   - Junos Components: Why are they not customizable on the box? IF you already present the possiblity to choose between minimal / no / all components and DOWNLOAD then the installer.. Why don't you let us configure the complete individual package and download the package in one? The reference to the admin guide is time consuming.   - Please improve the communication about the compatibility between junos pulse client and different firmware versions. It is not clear to me how this will work, if a user is using different MAGs with different firmware. What will work? What will not work. f.e. is 7.1R3 useable when you have already visited a box with 7.4R1. Users may use many ssl vpn gateways...   - Please provide also a better password policy for internal user   - Please include groups for internal user -  internal groups should be then useable for role-mapping (I know internal users are not state of the art, but some customers prefer a self service on the box.)     I hope that I understood your comment correctly. That this was a invitation to tell you what our needs or wishes are.   Greetings, Ate ... View more

@sleepingsnowman wrote: SA-4500   7.3R2 (build 22751) Juniper Pulse Client version 3.1.2.29447   Windows 7 issue: *  Juniper Pulse virtual adapter does not get created and thus tunnel not created and thus have no IP address.   *   User logs from the the SA show an IP address being handed out. *  Network Connect works just fine when connecting to another SA-4500   This is probably a permission problem. Please check if the user has local admin rights.   The handed out ip just signals that the j-pulse client start has been triggered. Could be auto-start or manual start. In that moment the ip will be taken from the dhcp pool and handed over to the client.   Different vpn clients MAY disturb, from my experience Cisco vpn client was running parallel without a problem (but that is no gurantee). Anti-virus software or device-monitoring software (like for example "device watch") may check for unknown devices and block them.   I would test first with internet explorer, before using firefox, because you'll need java for firefox. I would not use network connect AND pulse on the same client parallel, because of the juniper installer..   For testing, I would de-install all juniper components - after that reboot and try again.   Active X component should be present and the installer and the pulse client.   Best, Ate     ... View more

Hi, a little bit late and maybe also now not interesting anymore, but I wanted to add the following: If you use ESP as the Transport Protocol of your wish... All of the above fits. But in case you use oNCP/NCP(!) you should keep an eye on the SYSTEM -> CONFIGURATION -> NCP Settings ;-) There individual timeouts for oNCP/NCP to adjust. AteRocKz ... View more

As mentioned here before you provide the web-link when the hostchecker noticed that there is no citrix client installed. What files are you searching for? Would be neat if you could name as I haven't worked yet with the new xen citrix. What is necessary to provide the Java fallback? Is on the client side just the JRE required? AteRocKz ... View more

I found the following in the net... Citrix Server Farm Error: "You do not have the proper encryption level to access this Session." The Citrix server requires 128 bit encryption. If your Citrix client is not set to use 128 bit encryption, you will receive the following message when you attempt to login: You do not have the proper encryption level to access this Session. To verify or update the encryption level, follow these steps: Windows Users: Start the Citrix Program Neighborhood. Highlight your ARMS Server Farm connection icon. Do not actually open the connection. From the File pull-down menu, select Properties. Click the "Options" tab. Select "128 Bit" as the "Encryption Level" from the drop down box. You may need to de-select "Use Custom Default" to change the encryption level. Do not select "128 Bit for Login Only." If you do not have the "Encryption Level" option, you need to upgrade your client software. The following document will lead you through updating your client software: Citrix Setup & Connection Instructions for Windows 9x/NT/2000/XP Click OK. But I don't know how you can cope this with the ssl vpn box. Best regards, Ate ... View more

When using Firefox you should use firebug. A very cute tool, which will allow also to show post data without the need of registering that tool like for httpwatch ;-) I can send you the following. https://[SERVER-URL]/OWA/auth/owaauth.dll?destination=https%3A%2F%2F[SERVER-URL]%2FOWA%2F&flags=0&forcedownlevel=0&isUtf8=1&password=[XXXXXX]&trusted=0&username=[AD-DOMAIN]%5C[YYYYY] or... https://[SERVER-URL]/OWA/auth/owaauth.dll destination https://[SERVER-URL]/OWA/ flags 0 forcedownlevel 0 isUtf8 1 password [XXXXX] trusted 0 username [DOMAIN]\[USERNAME] I guess this is all you need. Or are you searching something else in particular? Best regards, Ate ... View more

@hazeen wrote: Hi Player, I have fixed the issue of SSO to OWA 2007. I used a browser plugin/tool called httpwatch to trace the parameters being sent when user logs into owa 2007. I am posting below the setting i used in my sitiuation(SSO to OWA 2007). Name :My email Type : OWA 2007 Base URL http://servername.com/OWA SSO parameters Ð REMOTE SSO Ð post the following data Resource http://servername.com:80/OWA/auth/logon.aspx?* Post URL http://servername.com:80/OWA/auth/owaauth.dll Destination http://servername.com/OWA Flags 0 Forcedownlevel 0 Trusted 0 Username <USERNAME> Password <PASSWORD> isUtf8 1 I hope this helps. I tried it a couple of tims with your very good description and failed! I requested assistance from the support and first failed too. The difference is that our OWA 2007 server is accessed with https, but this shouldn't be an issue at all. Single Sign On still failed. What brought the success was changing the destination post parameter from: destination destination https://[SERVER.URL]/OWA to destination destination https://[SERVER.URL]/OWA/ also support requested me to change the order of the post parameters. I am not sure if this might be relevent but just for completion I will post the order. destination destination https://[SERVER.URL]/OWA/ User CAN change value flags flags 0 User CAN change value forcedownlevel forcedownlevel 0 User CAN change value isUtf8 isUtf8 1 User CAN change value password password <PASSWORD> User CAN change value trusted trusted 0 User CAN change value username username <USER> User CAN change value Maybe anyone has experienced something similar. Ate RocKz Message Edited by aterockz on 02-04-2009 10:43 AM ... View more

What kind of wiki is it? I am interested in the results. Ate ... View more

Are the xxx and xxx addresses the same? dfs = distributed file system Is maybe the alternate ressource unavailable, unrechable? Try using fully qualified domain name for the ressource. Ate RocKz ... View more

Mentioned that in a different post already. The frozen sessions can be related to ESP as the transport protocol! Try it with oNCP. The frozen sessions have been caused by different MTU sizes of network components in the transfer path which made ESP (udp) crash and lead to kernel panics on the IVE afaik. Try it with oNCP or try an firmware upgrade. The MTU issue should have been fixed in an actual release. Best regards, Ate RocKz ... View more

Where have you found the 6.3R3 ? It's is not posted in the juniper.net support forum. Ate ... View more

Hi, I am quite sure and it is validated by a juniper system engineer that you are just able to define ONE ACE server for the complete IVS environment. - True that it has to be defined in the root instance. - When you use internal AND external port, the INTERNAL port will ALWAYS be used for any kind of authentication/validation, so even external radius servers need to be reached by the internal interface in some way. - you can define multiple radius servers, but just one ACE Hope this clears some things, Ate RocKz ... View more

True true... But in this update ... even the installer has changed and with it the active x control element. This leads to following situation: The user also needs priviliged/admin rights to upgrade the installer. So you need to roll out the installer with software distribution in advance but a software distribution is not always available for external users. So long, Ate RocKz ... View more

Hardest problem for me was the that the juniper installer / active x control element has changed. I wasn't really well prepared for that. (I have been told, last time it has been updated 2 yeas ago). Immediatly there poppt up a lot of calls because the users did not have the rights to install the new piece of software. Juniper Installer / Network Connect should be rolled out 1 month in advance. Sounds long term, but keep in mind that some users might be on vacation / ill or whatever. ActiveX control element / juniper installer should be compatible with older versions but I would test that. Esp. try it with non priviliged accounts after roll out. Ate RocKz ... View more

I encountered myself problems with ESP and the transport protocol within network connect! Should be fixed with the newest release 6.3R2 higher. Test it, by switching to oNCP and look if the problem still exists. The reason for the problem was different mtu sizes of the components in the network path. good luck, Ate RocKz ... View more

I have been told that cut and past is not possible due to security reasons. But from my point of view a administrator accessing his machines through this ssh/telnet session who is unable to use cut and past will regret to use this ssh/telnet session at all. I already requested this function as a feature request but didn't get any response on it yet. For me it is a MUST HAVE or it is nearly useless prictically :( *sigh* Hope cut and paste will be included for an upcoming release. With regards, Ate RocKz ... View more

I also tried to find a way to STOP pushing the network connect client actively. I would prefer to "Roll-out" the client by myself via software distribution. This would also grant more security as I am able to define the computers the client is installed onto. Using unwanted devices to open up a vpn tunnel would be more difficult for a regardless user because the client will not be pushed automatically. The suggested way by juniper was to use a hostchecker to test if network connect is installed and then to enable the role for network connect itself. But why should I use the hostchecker if not really needed in my eyes. I hope Juniper will integrate a way to STOP pushing the client AND to give us some more options when installing the network connect client with command line switches (f.e. after installation of the network connect client it doesn't starts minimized!!) With regards, Ate ... View more

Because it is an productive environment I wouldn't just try an import/export to test something. Currently I am using " 6.0R3.1 (build 12507)" So it should be not a version problem. Ate ... View more

Thanks for the hint with the link, that is probably the easiest thing to populate the change pw destination. When trying to look for the Users>User Roles>roleName>Web>Options>View advanced Options to check for persistant cookies are disabled I saw that this box was already UNchecked. The delete cookies option is still in the advanced tab of the preferences. disable the SSO configuration is another thing... I have a realm with only one user role that mapps only one ressource. The Web POST policy is not modifiable ! on all points Tricky is: When the user selects the advanced tab in the preferences he sees the Advanced Preferences > Configure Remote SSO (Single Sign On) Resources Select the Remote SSO Resource you wish to configure and click Configure. Then the configure button (without a use you can click it but nothing happens) Remote SSO Bookmark (with a grey circle.. unable to select) then the Resource and link to the resource..... The resource button is gray and not chooseable, but the worst is that You see the resource like named as inside the box and also the link to the resource is in plaintext see-able for the user. Ate ... View more