An additional hint: The app that you want to use with VPN on demand must have enabled support for it. E.g. if you define ".mycompany.com" to be a VPN on demand domain, the Junos Pulse client will only connect automatically for destination something.mycomany.com, if the app uses a special call. Otherwise you have to open the VPN manually. Safari and some other apps have enabled this, but many not. :-( - Steffen ... View more

Hi, there were several versions which had problems with special characters in usernames (eg. german umlauts). You will see exactly the behavior you described. In 7.0R6 _ RDP single sign on works with umlauts, In 6.5R3.1 _ it does not. But I do not remember in which release it changed. - Steffen ... View more

Hi Globix, @globix wrote: I had another idea.... but not so sexy... The user logs in on the SA with the portal page. Then he launches the Pulse client And finally, I create 1 bookmark for the webapp with no rewritting.... that way ... when he connects it goes through the tunnel... Not automatic but shoud work as well... If you check "Auto-launch" in the user role under "Network Connect" the Pulse Client will start as soon as the user logs in to the SA. So: User logs into SA -> Pulse Client lauches automatically -> he/she will see your bookmark on the start page. - Steffen ... View more

Hello, wie experience a similar behaviour: We define a configuration profile though "Apple's iPhone Configuration Utiliry". It contains a cert auth VPN definition connecting to an own URL (*/iphone) and VPN on-demand. Manually connecting to the SA useing this VPN definition works fine. On-demand connections do not work: If I try to access one of the on-demand domains (connect allways), Pulse accesses the SA and logs in successfully but it does not make a network connection. The show active users list shows the connection but now IP address assigned. The Pulse client status says disconnected. Do to the fact that manual connections with the very same VPN-profile works well and the on-demand connection gert stuck in the middle, I guess there is a bug. Or did anybody get on-demand work. If so, what did you configure? Thanks in advance, Steffen ... View more

Hi, since iOS 4.2.1 for iPad is out you can use one of the iPad RDP clients in combination with the Juniper Pulse App. This way you use RDP over VPN instead of RDP through a HTTPS web session. If you use split tunneling which sends only our RDP traffic through the VPN it looks quite similar to RDP through the web browser: secure RDP with simultaneous internet access of your iPad. - Steffen ... View more

Hi Billy, is our iPhone sign-in URL defined in the SA something like "my-juniper-sa.mycompany.com/iPhone" (with specific hostname) or "*/iPhone" (with wildcard hostname). The first method does not work with iPhone pulse due to a bug. The Pulse app resolves the hostname and used the resulting IP address to connect to the SA. Due to this the SA will reject the connection before client certificate authentication will take place. No client authentication = no authentication failure log within the SA. The bug is know to Juniper and they promise to fix it. Up to then you must use the wildcard for a hostname in the sign-in URL. Hope this matches your problem. - Steffen ... View more

Hello, which version are you running? Starting with 6.5R2 we got problems running ActiveSync in IVS. It was only running in the root IVS. It should have been fixed in 6.5R4 but I only had a chance to test it with 7.0R2. At least there it works again. I'd recommend to open a JTAC case. It sounds like a bug. - Steffen ... View more

Hi, you can add ActiveSync to zanyterp's list. It works with Exchange and Z-Push (Zarafa, ...), ActiveSync connections do not count against the concurrent user license. It's maximum depends on your SA model. 1000 concurrent ActiveSync connections are supported on SA6500. Regarding the Junos Pulse Client on the iPhone: It works only with iOS 4.1, so not with older iPhones/iPods and currently not with iPad (4.2 for the iPad is expected in November. Yes, the iPhone (Pulse) disconnects itself from the SA while no VPN traffic is needed and it reconnects if the iPhone initiates a new connection (eg. mail polling from an IMAP server). Sometimes it disconnects completely and you have to manually reconnect. I haven't discovered if it is a timeout or something else. Sometimes the automatic reconnect occurs to late for an application if it doesn't retry to connect after first failed attempt (eg. the IMAP mail refresh if you open the mail app. Between the first connect and the real disconnect (= automatic reconnection on outgoing traffic) a concurrent user license is occupied. Hope it sheds some light on it. Steffen ... View more

Hello smedeiro, I am not sure what you exactly want to know. But if your question is "how can I use secure meeting while I am connected with network connect or WSAM?" the answer will be this: If you right click on the NC- or WSAM-tray-icon you'll find a menu option to start a browser window. For NC it's named "Fenster 'Neuer sicherer Gateway' (probably in English "window 'new secure gateway') and for WSAM it says "Neues Fenster" (probably in English "new window"). Both options hide their meaning well, but if you click on it your browser will show the usual startup page while you are still connected to NC or WSAM. Then you can open the secure meetings with that usual button on the top (if not disabled). Hope this helps, Steffen ... View more

Hi, Juniper SA dies only support VMware View if you use the RDP protocol instead of PCoIP. So yes, you can access your virtual desktop, but no, you can't use the "native" PCoIP" protocol which is the part that makes using virtual desktops nice and comfortable. - at least according to my opinion. So I'll change the question a bit: When will Juniper SA support PCoIP without using NC or WSAM ? - Steffen ... View more

Hi, since we use 6.5 we had some users reporting a long delay. Can't tell if exactly 30 seconds butsomething around that. No all users report this, but a few do. We use LDAP auth to an Active Directory forest and have not autoloaded hostchecker, WSAM, NC or anything like this. I have at least one user starting NC direct who reports the same. I haven't found anything so far, nor can I savely reproduce it. - Steffen ... View more

Hi stine, > Or another conflicting VPN client. No oother VPN client or cormparable software installed. > In the users' NC client, is the correct URL displayed? Yes, the correct URL is displayed. > Do your IVE logs show successful connections from the user? Yes, SA logged successful login but nothing about NC is started. > Is the user on a 3G/4G connection, [...] Is the user in a hotel or other captive-portal network. No, the user is behind a simple NAT router without any outgoing filters. > Another thing to check is the local subnet address of the XP client. The client's local subnet is different form the companies addresses. - Steffem ... View more

Hi, I just get yesterday a similar problem. What I found so far: NC running on WinXP with IE8. SA2500 is running 6.5R3.1. NC works fine since some days ago. User said he hasn't change anything. (But patches are done automatically as far as I remember.) When starting NC without browser, the login page won't be displayed. After the usual timeout a message is displayed that the page cannot be displayed. (That one you will see in IE, if a webpage can't be reached.). Accessing SA through webinterface is fine. Starting NC through the start button NC won't start. Accessing SA's webinterface with Firefox instead of IE and pressing the NC start button will start NC's installation procedure and NC connect will work for that session. Starting NC after this directly will works once. And problems starting again ... I have only few occasions to contact the user so debugging is currently not possible. Any ideas? Thanks in advance Steffen ... View more

Hello, we use SEP11.0.5002 without NAC and had no problems with 6.5R3.1 and 6.5R4. The "Teefer2 Miniport" network adapter is in normal device-manager view not visible, only if I enable "display hidden devices" (or what it might be called in the englisch Windows XP). We do not have any software or device usage restrictions defined in SEP. Only virus/spyware, network and proactive protection is enabled. It might be woth checking your SEP policies if not already done. - Steffen ... View more

Hi, I use XCA. it is a GUI based replacement for openSSL with a file-database. You can generate key, create certificate signing requests (CSR), build an own certificate authority (CA) and sign certificates, create certification revocation lists (CRL) for your CA and use templates for your certificates. All keys, CSR, certificates and can be im- and exported. I use it for small PKIs and store my official certificates in the XCA database as well to keep all certificates in one place. XCA runs on Windows and Linux and can be found at http://xca.sourceforge.net/ - Steffen ... View more

Hi, do you mean an ActiveSync connection to your Exchange server, OWA ("Outlook Web Access") or RPC over HTTPS ? ActiveSync works fine. It's setup is quite simple: You'll need a separate external IP (and Certificate). Define "Authorization Only Access" with that URL, point the backend URL to your Exchange server. Something like http://your.exchange.server.com/ (or https://... if your Exchange uses HTTPS), set "Authorization Server" to "no authorization" and associate a Role that allows HTTP or HTTPS to your Exchange server. To protect you Exchange set "Allow ActiveSync Traffic Only". See the "Adman Guide" for further details. It works fine, at least with 6.4 and 6.5. In 6.5 it won't work in a virtual IVS. OWA should work as well, but I expect the web interface to be very uncomfortable on that small screen. I guess there is no Exchange client for the iPhone that can use RPC-over-HTTPS like Outlook for Windows or Entourage for Mac an Linux. Hope this helps. - Steffen ... View more

Hello, remember, this ActiveSync problem occurs only in non-root-IVS. In the root-IVE (and with no IVS license) ActiveSync works quite well in 6.5R2. Latest (08.02.2010) update form Juniper Support: Status Update: - As per engineering analysis this issue seems to be related to 6.5 code level - Engineering is presently working on required code level changes to fix this issue - Once issue is tested/fixed in lab we will be merging it to coming IVE release accordingly - Steffen ... View more

Hi Chris, no real new status update. The last thing I heared on 1st of Feb.: "This issue is still under engineering escalation and they are working on design changes done on latest IVE build. I will keep you posted with engineering update accordingly". I think it might be a good idea to open a case yourself to show that this is not a problem for only a very few people. - Steffen ... View more

Hi, we also have moved the ActiveSync configurations of the IVSes to the Root. For possible cross-link of the open cases: Our's is #2010-0104-0116. - Steffen ... View more

Hi, no it makes no difference wether I enable "llow only ActiveSync Traffic"" or not. I the neantime I have discovered that the problem exists only in virtual IVS but not in the root IVS. I have an open ticket but no result so far. :-( - Steffen ... View more

@deaconz wrote: What is unstable about 6.4R4? WIndows 7 support is missing! - Steffen ... View more

Hi, I discovered today that Active Sync defined in an virtual IVE - not the root-IVE - stops working. I have an open JTAC case now, but no results yet. - Steffen ... View more

Sorry Kevin, the paramters you mention have no effect. I use only one value for "ConnectionType" and real values for "hostname" and "remoteDir". I still have to connect manually. - Steffen PS: If there are parameters for the destination. Is there also one to disable the connect to menue? ... View more

Hi, if you authorize against Active Directory with LDAP and the domains are within the same forest, you might try using <userAttr.userPrincipalName> instead of <USERNAME>. At least for some of our environments this works fine. Hope this helps ... Steffen ... View more

Hi, where can I specify the protocol (SFTP or FTP), the destination host and the directory? The Applet should connect automatically and the user shouldn't be able to specify a protocol and host. Of cause there are apropriate access policies in place as well. But if the user can't change protocol and host he can't make mistakes - at least at that point. ;-) Thanks in advance. Steffen ... View more

Hi, On our SA with 6.4R3 we use network connect successfully with Windows 7, BUT only without host checker. I can't say anything about Windows 7 64bit. We have none in that test. - Steffen ... View more