About kcorace_

kcorace_ · ‎09-17-2010

I wanted to see what people are doing in order to support OWA 2010 for Exchange 2010. Is anyone out there running 7.0R1 in production for a large enterprise hitting OWA 2010? Any caveats or recommendations?

kcorace_ · ‎08-18-2010

The only way we have been able to get this to work is through using the Pass Through Proxy feature and assigning that resource a different port. Even then we occasionaly run into formatting and other issues. I think it all depends on the various AJAX calls. I don't believe that we've tested it out through a phone though.

kcorace_ · ‎04-18-2009

I currently have a single SA 4000 running 6.0R4-2 and I've had some bad experiences in the past trying to upgrade to different Juniper releases. I'm now replacing my 4000 with 2 4500's in a cluster. Any recommendations on which code to be running? Thanks, Kevin

kcorace_ · ‎01-06-2009

You could do a stop processing on the rule where people get the OWA 2007 Bookmark and then another rule for everyone to get the other bookmark right after that.

kcorace_ · ‎01-05-2009

I currently have Basic Authentication enabled and I have that working through web bookmarks in the core IVE. What I'm trying to do is get that to work through Network Connect. If I tunnel through network connect then I'm always prompted for credentials when accessing an internal web site that is IIS using Integrated Windows Authentication. Anyone else having this issue?

kcorace_ · ‎01-02-2009

Whenever I login to Network Connect and I browse to one of our internal servers that is IIS 6.0 with Integrated Authentication (Integrated Windows Authentication checked in Security in IIS) I am always prompted for credentials. This never happens whenever I'm on the LAN. Is there any known issue with this or a workaround? My SA4000 sits in a DMZ (just one interface). Nothing is blocked on the firewall.

kcorace_ · ‎09-15-2008

Thank you for saving me time. This is just what I needed.

kcorace_ · ‎09-09-2008

One of the shortcomings that I see with the SSL VPN is that you can't use <userAttr.scriptPath> for running a logon script for network connect. Has anyone written a vb script file that does the LDAP bind to pull and get this variable? You can then execute cscript with that .vbs file that you get back. Our AD infrastructure uses .vbs files for all users logons and I don't want to try and manually tie script files to user roles as they may change. The only way I can see this scaling for a large organization is to have a .bat file (one thing ssl vpn accepts) that calls a vbs file that will pull your scriptPath attribute and execute that with another cscript call. Any other solutions?

kcorace_ · ‎05-02-2008

The way I've done this is by creating a seperate User Role that just has the network connect. If users have the registry key for Logon Domain matching our internal domain then I allow the access to the domain. If not they just map to their other roles which do not include network connect. Obviously this isn't doing machine authentication to AD like you can do with other NAC implementations, but I'm also running a few other checks before they are allowed the network connect role.

kcorace_ · ‎04-21-2008

Is there a way to make network connect traffic route to the IVE's default gateway for hosts on the same subnet as the IVE? For instance if you have the internal IP of the IVE in a DMZ as 192.168.1.10 /24 with a default gateway of 192.168.1.1, and you define a network connect pool of 192.168.2.0 /24 then anytime a network connect client connects to a resource in the 192.168.1.X subnet you will have asynchronous routing. If a network connect IP (192.168.2.30) goes to a host at 192.168.1.50 then it will go through the IVE's local area interface directly to the server. However, the server will send that response traffic back to the default gateway and if it is a DMZ where the default gateway is a firewall then the traffic is dropped. I see several different workarounds: - Static Routes on DMZ subnet hosts for Network Connect Pool - This isn't ideal for configuration reasons. - Network Connect Pool in same subnet as IVE - This isn't ideal as I don't want the VPN IP's to be listed as DMZ ip's. - Allow Asynchronous Routing through a router - Not going to happen as a firewall is used. - Build a seperate DMZ with just the IVE in it - Possibly in the future with our architecture. What I'm looking for is that all Network Connect traffic goes to a default gateway ip. With Cisco VPN tunnels we are able to use a default static route with the "tunneled" option after it to accomplish this. Anyone have any ideas or suggestions for how to accomplish this on the SSL VPN?

kcorace_ · ‎04-19-2008

What version are you on. I tried all options on 5.5 but couldn't get OWA to accept credentials until I upgraded to 6.0. Are you having the IVE prompt you for credentials and then not allow access? Are you getting an error message that the page cannot be displayed? Or does it continually try to connect never returning a message? Kevin

kcorace_ · ‎04-03-2008

For what it is worth I am running 6.0R3.1 Previously I was on 5.5R4 which I found to be pretty stable. Whenever I first upgraded to one of the first 6.0 releases it was pretty bad; however, I've found that 6.0R3.1 fixed most of my issues. I had an issue previously with the SSO into OWA and that was fixed, sharepoint 2007 was supported, and the Outlook Meeting plugin is working in 6.0R3.1. All of which were things I had issues with in the previous releases.

kcorace_ · ‎02-22-2008

I am currently setting up Sharepoint 2007 on IIS 6.0. What I'm having a problem with is that the SSL VPN doesn't support NTLMv2 for SSO. The only thing it can do is NTLMv1. The Integrated Windows Authentication of an IIS server uses NTLMv2 and Kerberos. Does anyone know of an actual setup document to get IIS 6.0 using Integrated Windows Authentication working with Juniper SSL VPN? Thank You

OWA 2010

Re: how to present an AJAX-intensive page through ...

Firmware Version

Re: Is there a way to assign role if the user is N...

Re: Network Connect - IIS with IWA

Network Connect - IIS with IWA

Re: Network Connect Logon Script

Network Connect Logon Script

Re: Host checker and network connect options

Network Connect Asynchronous Routing

Re: Passing credentials to OWA

Re: I need to upgrade my IVE's from 5.3r8 to a sta...

IIS 6.0 - SSO / Sharepoint