About NDCool_

NDCool_ · ‎11-17-2010

hi mangapuly, to run login using single sign on, you must : 1. computer/laptop must joined to your domain. 2. user login to domain. 3. configure your oac client, to used windows username and password. From step above it should be running for single sign on. Cheers ^_^

NDCool_ · ‎08-01-2010

Hi Muhammad, Would you share the screen capture of OAC client and User access Log on IC ? Sometimes, if you do some changes on IC you should to restart IC services.

NDCool_ · ‎07-29-2010

Hi All, We meet some issue regarding IC resource policy. If Enforcer (SSG) establish the connection to IC from ip on some sub-interface, the rules on resource policy is doesn't work. But if Enforcer was establish the connection to IC using ip on default interface (logical) all resource policy will working. It is true, the resource policy doesn't work when enforcer establish the connection to IC using ip on sub-interface ? need your advice soon thanks

NDCool_ · ‎07-29-2010

Hi Muhammad, I just pausing the Kaspersky protection, and all working then. I thought it's because of the Firewall or Proactive defense feature on kaspersky.

NDCool_ · ‎06-29-2010

rswinter, I have told to them, in that condition user can login from web browser, then auto launch the NC. Or using start script to run internal webpage. But they always compare to O2Micro product.

NDCool_ · ‎06-29-2010

Hi Sam, Yes, i know for that. But current behavior, user sign in from NC (O2Micro) then they be able to access web access resource. Any one know, why on juniper NC we cannot do that ? So i can give good reason to my customer also.. Thanks

NDCool_ · ‎06-28-2010

Hi Folks, I have challenge from my customer to replace their previous SSLVPN appliance with SA. Previously the used O2Micro product. At current behavior, user login from NC only, then from their NC will display all bookmarks menu for web application. And i have tried to custom on juniper NC, but it always minimize after user login. There is no option to display any bookmarks on that. It is possible to do at Juniper NC to display any bookmarks to compete their previous SSLVPN ? Need you advice. Thanks

NDCool_ · ‎04-08-2010

Hi, You can used Microsoft SMS server if exist. Or using windows logon script.

NDCool_ · ‎01-15-2010

Hi All, I have face some issue on UAC with OAC client. Users reported their connection to application has disconnected. And they see windows connection is disconnected for a while and connected again. At Infranet Controller Users Access Logs, i found many log like this: Info EAM24805 2010-01-15 13:03:58 - ic - [0.0.0.0] DOMAIN\himmia()[] - Radius authentication was resumed for DOMAIN\himmia (realm '') from location-group 'HP Procurve Switch' Info EAM24459 2010-01-15 13:03:58 - ic - [192.168.100.34] himmia(AJS-Realm)[IT_Roles] - User assigned to vlan (VLAN='10') Info EAM24805 2010-01-15 13:02:43 - ic - [0.0.0.0] DOMAIN\hendra()[] - Radius authentication was resumed for DOMAIN\hendra (realm '') from location-group 'HP Procurve Switch' Info EAM24459 2010-01-15 13:02:43 - ic - [192.168.100.20] hendra(AJS-Realm)[IT_Roles] - User assigned to vlan (VLAN='10') Info EAM24805 2010-01-15 13:02:12 - ic - [0.0.0.0] DOMAIN\Rudy_H()[] - Radius authentication was resumed for DOMAIN\Rudy_H (realm '') from location-group 'HP Procurve Switch' Info EAM24459 2010-01-15 13:02:12 - ic - [192.168.100.19] Rudy_H(AJS-Realm)[IT_Roles] - User assigned to vlan (VLAN='10') Info EAM24805 2010-01-15 13:00:36 - ic - [0.0.0.0] DOMAIN\andy()[] - Radius authentication was resumed for DOMAIN\andy (realm '') from location-group 'HP Procurve Switch' Info EAM24459 2010-01-15 13:00:36 - ic - [192.168.100.23] andy(AJS-Realm)[IT_Roles] - User assigned to vlan (VLAN='10') What does it mean ? Does users re-authenticate?

NDCool_ · ‎01-06-2010

So do me, first time working with srx210, so many issue that i faced. srx210 crash on system while handle my customer traffic. Previously my customer using ssg5 for their traffic. How come on paper srx210 is more better performance than ssg5, but unable to handle traffic that ssg5 can do. hopefully at next any release software should be better, because i have a lot of project with srx650 and cluster.

NDCool_ · ‎01-06-2010

Nope, i haven't to run wireshark or any tracer tools. Now I can't do any trace, because i face new issue at this srx. http://forums.juniper.net/t5/SRX-Services-Gateway/failed-to-upgrade-u-boot/m-p/32733#M1876 so many issue on this project.... by the way thanks to sharing knowledge.

NDCool_ · ‎01-06-2010

Nope, i have been waiting for they answer since 30 Dec 2009. for now running 10.0R2

NDCool_ · ‎01-06-2010

so, what is wrong with my srx or my configuration ?

NDCool_ · ‎01-06-2010

Hi Mike, does at your srx there have dhcp relay drop packet also ?

NDCool_ · ‎01-05-2010

Hi Mike, Yes, finally user will get their ip address. But before they get the ip address, they will get the 169.x.x.x ip address first. But it better than previous configuration, when didn't put bootp on host-inbound service. I already open ticket to TAC regarding dhcp drop packet, hopefully they will found the solution soon.

NDCool_ · ‎01-04-2010

hi mnarine, yes interface set already there helpers { bootp { relay-agent-option; server 128.21.33.50; minimum-wait-time 360; client-response-ttl 200; interface { ge-0/0/0.10; ge-0/0/0.20; ge-0/0/0.30; ge-0/0/0.40; ge-0/0/0.50; ge-0/0/0.60; } } } ehm...so what packet is being dropped ? [email protected]> show system services dhcp relay-statistics Received packets: 13 Forwarded packets: 10 Dropped packets: 3 Due to missing interface in relay database: 0 Due to missing matching routing instance: 0 Due to an error during packet read: 0 Due to an error during packet send: 0 Due to invalid server address: 0 Due to missing valid local address: 0 Due to missing route to server/client: 0 [email protected]> show system services dhcp relay-statistics Received packets: 14 Forwarded packets: 10 Dropped packets: 4 Due to missing interface in relay database: 0 Due to missing matching routing instance: 0 Due to an error during packet read: 0 Due to an error during packet send: 0 Due to invalid server address: 0 Due to missing valid local address: 0 Due to missing route to server/client: 0 [email protected]> show system services dhcp relay-statistics Received packets: 21 Forwarded packets: 16 Dropped packets: 5 Due to missing interface in relay database: 0 Due to missing matching routing instance: 0 Due to an error during packet read: 0 Due to an error during packet send: 0 Due to invalid server address: 0 Due to missing valid local address: 0 Due to missing route to server/client: 0 when i compare it with ssg550m, ssg550m is faster to relay the bootp/dhcp request.

NDCool_ · ‎01-04-2010

hi mnarine, i just enable bootp on host-inbound service, i think it better, but there still have drop packet on dhcp-relay thx

NDCool_ · ‎01-04-2010

hi mnarine, 1. i just allow ping and dhcp service for host-inbound-service, so the bootp must be allow also? 2. yes, all traffic allowed. thx

NDCool_ · ‎01-04-2010

Hi IPSec, 1) How fast you get IP when port is not dot1x ? -> it fast, because if not dot1x all port is default vlan, and dhcp server are on default vlan also 2) What is the OAC Status under Connection information ? -> always open and authenticate, and sometime user get 169.x.x.x. ip address 3) If its open and authenticated then try ipconfig/release and ipconfig/renew. Does it get you IP address immediately ? -> sometime user will get ip address soon, but sometime we must do it 2 times. if user didn't get any ip address, at SRX have dhcp relay drop statistic [email protected]> show system services dhcp relay-statistics Received packets: 49 Forwarded packets: 40 Dropped packets: 9 Due to missing interface in relay database: 0 Due to missing matching routing instance: 0 Due to an error during packet read: 0 Due to an error during packet send: 0 Due to invalid server address: 0 Due to missing valid local address: 0 Due to missing route to server/client: 0 [email protected]> show system services dhcp relay-statistics Received packets: 64 Forwarded packets: 52 Dropped packets: 12 Due to missing interface in relay database: 0 Due to missing matching routing instance: 0 Due to an error during packet read: 0 Due to an error during packet send: 0 Due to invalid server address: 0 Due to missing valid local address: 0 Due to missing route to server/client: 0 [email protected]> show system services dhcp relay-statistics Received packets: 84 Forwarded packets: 67 Dropped packets: 17 Due to missing interface in relay database: 0 Due to missing matching routing instance: 0 Due to an error during packet read: 0 Due to an error during packet send: 0 Due to invalid server address: 0 Due to missing valid local address: 0 Due to missing route to server/client: 0 so this issue it maybe came from SRX, because when i change srx650 with ssg550M. I never facing DHCP issue again.

NDCool_ · ‎01-04-2010

Hi Mnarine, regarding this thread http://forums.juniper.net/t5/SRX-Services-Gateway/DHCP-drop-packet-on-srx/td-p/32195 i already open a ticket to jtac. thanks for your help.

NDCool_ · ‎12-23-2009

Hi All, I'm implemented UAC on my customer side using L2 (802.1x) and all thing is working already. But sometime users must waiting for long time to get new IP. Even i must un-check the "Connect to the network" option on OAC then check it again to re-authenticate. On User log/monitoring , i seen IC already give an attribute to switch which vlan does users belongs. But OAC status always doesn't established. It is normal condition? how to make it better? Any suggest ? Thanks

NDCool_ · ‎12-13-2009

guys, finally i can join to AD. thanks

NDCool_ · ‎12-10-2009

Hi all, i have customize my OAC client, but i cannot disable option of "Connect to the Network". How to do that ? I want this option cannot be change by user. I use IC v3.0R3 with OAC v5.00.13531.0 need your advice. thank

NDCool_ · ‎12-09-2009

Hi Kevin, Sample : my customer domain is AJS2000.com, and i already input at NT domain name is "AJS2000" without ".com" when i saw at event viewer on AD server, they have error with event ID 672 and 675

NDCool_ · ‎12-09-2009

solve, blocked by Kaspersky Internet Security. thanks

NDCool_ · ‎12-09-2009

Hi All, I want to deploy UAC using L2 scenario and the L2 authentication is work already,user get their ip, but status on Infranet Controller is Terminated. As i know while POC, the Infranet Controller status must be establish. When POC i use IC version 2.1, for now i use version 3.0R3 need your suggest asap guys. thank

NDCool_ · ‎12-09-2009

anyone can help ?

NDCool_ · ‎12-08-2009

Hi Guys, Why i cannot add AD as Auth Server on IC4500 running v3.0R1. AD running on windows server 2003. When i test the configuration, have some error like this : Error while joining domain "domain_name". Possible causes: - The specified administrator credentials do not properly authenticate. - The specified domain or domain controller may not be valid. and "You can not change the password of the IVE computer account on the active directory server using the specified administrator credentials" Need help..

NDCool_ · ‎12-03-2009

Hi Craig, Thank to response my question. For now, our customer have 80 branches and installed SSG as gateway to Head Office. So all this ssg will be as IE. And on Head Office have L2 switch for Host enforcer. So both of IC will be support for that number ?

NDCool_ · ‎11-25-2009

Hi All, Just want to know, how many host enforcer (L2) and infranet enforcer (L3) can be supported by IC4500 and IC6500 ? I can't found this information on datasheet. And, how many user can be added on local database IC4500 and IC6500 ? thank.

Re: UAC Single Sign On

Re: Status Infranet Controller Terminated but L2 C...

IC resource policy doesn't work if Infranet Contro...

Re: Status Infranet Controller Terminated but L2 C...

Re: Show bookmarks on Network Connect

Re: Show bookmarks on Network Connect

Show bookmarks on Network Connect

Re: how to distribute the preconfigured OAC client

Radius authentication was resumed - Mean what ?

Re: How to make faster to get IP from DHCP server

Re: How to make faster to get IP from DHCP server

Re: How to make faster to get IP from DHCP server

Re: How to make faster to get IP from DHCP server

Re: How to make faster to get IP from DHCP server

Re: How to make faster to get IP from DHCP server

Re: How to make faster to get IP from DHCP server

Re: How to make faster to get IP from DHCP server

Re: How to make faster to get IP from DHCP server

Re: How to make faster to get IP from DHCP server

Re: How to make faster to get IP from DHCP server

How to make faster to get IP from DHCP server

Re: Cannot add AD on IC v3.0

Customize OAC Client - How to disable "Connect to ...

Re: Cannot add AD on IC v3.0

Re: Status Infranet Controller Terminated but L2 C...

Status Infranet Controller Terminated but L2 Conne...

Re: Cannot add AD on IC v3.0

Cannot add AD on IC v3.0

Re: How many enforcers can be supported by IC4500 ...

How many enforcers can be supported by IC4500 or I...