.... to internal resources? We are using Split Tunnel resources/routes on the Network Connect. Network Connect is only for the corporate issued Laptop's that we control. The question is how granular do you go with the resources without adversely opening yourself up to security? 1) Fist off, if I add fewer routes with larger scopes like 10.1.0.0/16; 10.50.0.0/16; 10.170.0.0/16 the I run the risk of network conflicts if one of my thousands of users visit a hotel or business that has a similar network. Now, I know I can not guarantee network conflict avoidance but I feel it is my responsibility to do my due diligence to at least reduce the possibility. 2) Now on the other hand if I push each VLAN from each office I run into A: A lot of routes being pushed to the PC. At what point with the PC start to see performance issues? B: Now I've mapped out the internal network. What security concern should I now be scared of? My thoughts are since it is a 'directive' to allow Split Tunneling we open our selves up to the security concerns and potential network conflicts. We don't care about home network. But it becomes what is more important to the institution. If Security is a concern then you run the risk of more user calls about not being able to work. If functionality is more important then we have to open it up and ... map the network. I have thought about creating 1 realm with reduce scopes/subnet masks and then another realm for back just in case the user does run into this issue where we map out the network on the PC. Then if we do that the user will more than likely keep using it so what is the point? :-) Another thought was to create a single route that points to another device, (Netscreen firewall/router) that knows all the internal networks. It adds a layer of single point failure for the SA but we have the security back and the user gets all internal resources I would appreciate your thoughts guys and gals. Thanks ... View more

Does anyone use custom login pages? If so how do you deal with redoing them when upgrading? I spoke to Juniper and they told me that there was nothing in the works to make the custom page forward compatible. They stated that I would have to take the new sample template from each version/release and redo it completely. Now, as I'm not a programmer and have to rely on the Web team this makes it all the more difficult as they are working on true projects with great programming languages and modules etc etc. It is like working in these sample templates using what language it is called is caveman stuff. We use them and it is such a letdown, hassle, and nonproductive task to completely redo the page every time we upgrade. For instance if I upgrade from 5.xr1 to 2 to 3 with each move there seems to be a new glitch where the IVE does not accept some type of coding from the original page we created. (I see more and more errors in the logs.) So, when I tried to upgrade from 5.3 to 6.0 the IVE would not accept the custom login page at all and defaulted to the basic generic page. Had to back rev to 5.3. Has anyone found a workable solution?!?!? ... View more

Is anyone using 6.0r2 or 6.0r3? If, so how stable are they? I'm using 6000's clustered; 4000's separate cluster; servicing internal and external clients; Using RSA 2-Factor Authentication; servicing Core Rewrite for OWA, Lotus Notes DB's, iManage (Worksite), Citrix, and other general web apps; Terminal Services; and Network Connect. My concern is that in the past upgrades have fixed one thing and broken others. With so much going on and servicing so many users it makes upgrading a major task unlike a ScreenOS upgrade. So, the question is what is the most stable version out? Nov/Dec I was looking into upgrading to 5.5 because I was told by JTAC that is was very strong and stable. Does anyone feel the same way about any of the 6.0 codes yet? (Currently having issues with Javascript errors with OWA via the core rewrite.) ... View more