About Brian_

Brian_ · ‎05-07-2012

Here's what I have so far. I'm using the com.citrix.ConnectionCenter applet. It works nicely and doesn't require the user to "Click Here to Continue," like the com.citrix.JICA applet does. I just need to figure out the display portion. I did see this discussed in a Citrix forum and have tried the 10.1.1 JICAComponents.zip file, but it produced the same results. Ther URL for the Citrix forum is: http://forums.citrix.com/thread.jspa?threadID=257039&start=0&tstart=0 fallback HTML: <html> <head> <title>JICA Applet</title> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> </head>  <body> <applet code="com.citrix.ConnectionCenter" codebase="<< CODEBASE >>" archive="JICA-browseN.jar,JICA-cdmN.jar,JICA-clipboardN.jar,JICA-configN.jar,JICA-coreN.jar,JICA-printerN.jar,JICA-seamlessN.jar,JICA-sicaN.jar,JICA-zlcN.jar,JICAEngN.jar,cryptojN.jar,sslN.jar,JICA-audioN.jar" width="640" height="480" name="JICA" align="top"> <param name="code" value="com.citrix.ConnectionCenter"> <param name="codebase" value="<< CODEBASE >>"> <param name="archive" value="JICA-browseN.jar,JICA-cdmN.jar,JICA-clipboardN.jar,JICA-configN.jar,JICA-coreN.jar,JICA-printerN.jar,JICA-seamlessN.jar,JICA-sicaN.jar,JICA-zlcN.jar,JICAEngN.jar,cryptojN.jar,sslN.jar,JICA-audioN.jar"> <param name="cabbase" value=""> <param name="name" value="JICA"> <param name="width" value="330"> <param name="height" value="140"> <param name="align" value="top">  <param name="TWIMode" value="on"> <param name="ClientAudio" value="on"> <param name="Compress" value="on"> <param name="StandardCompression" value="on"> <param name="PersistentCacheEnabled" value="on"> <param name="icafile" value="<<ICAURL>>"> <param name="End" value="<<CODEBASE>>examples/end.html"> </applet> </body> </html>

Brian_ · ‎05-02-2012

Got the com.citrix.JICA applet working. Only issue is that on the Mac the VDI consumes the entire display. I'm looking for the right applet parameters to use that will control the display size. Can anyone help with this? Thanks in advance.

Brian_ · ‎05-02-2012

We don't allow NC from non-corporate devices, so I would like to find a Java fallback solution. I'm experimenting with the Citrix JICA applet now. There must be a Java solution for it; otherwise the option wouldn't be there.

Brian_ · ‎04-30-2012

Hello, We are setting up VDI using Citrix XenDesktop. Has anyone gotten this to work with Java fallback for Mac users? I currently use Elusiva and Lixia JavaRDP applets for terminal services, but so far have been unsuccessful porting these over to XenDesktop Java Fallback. I keep getting the message: "Failed to launch the desktop. Either Java is not enabled in your browser, or Java support is not enabled for this bookmark." I do have "Enable Java for Web-Start applications checked on the Mac in the Java Preferences. Thanks for your help.

Brian_ · ‎07-22-2011

We're seeing JSAM not loading on Snow Leopard 10.6.8 with the recently released Safari 5.1: "This browser does not use the Cocoa Java Plug-in. 1) Make sure that the JVM 1.4.1 or later is installed, 2) Check that this browser supports Java for Cocoa (such as Safari)" I upgraded my home Mac to Lion (with Safari 5.1) and am getting the same results.

Brian_ · ‎01-24-2011

Greetings All I'm using Elusiva Java RDP in a Windows Terminal Services Profile. I need to find the "param name=" option to disallow the desktop background. Any suggestions are greatly appreciated. HTML below. Thanks, Brian Bourkland, JNCIS-SSL <script type="text/javascript"> function getResolution() { var yourRes = screen.width + 'x' + screen.height; document.write('<param name="geometry" value="' + (screen.width - 16) + 'x' + (screen.height - 128) + '">'); } </script> <applet code="com.elusiva.rdp.applet.RdpApplet.class" codebase="<< CODEBASE >>" archive="JavaRDP14-1.1.jar" width="640" height="480" name="ElusivaRDP" align="top"> <param name="code" value="com.elusiva.rdp.applet.RdpApplet.class"> <param name="codebase" value="<< CODEBASE >>"> <param name="archive" value="JavaRDP14-1.1.jar"> <param name="cabbase" value=""> <param name="name" value="ElusivaRDP"> <param name="align" value="top"> <param name="username" value="<<USERNAME>>">  <param name="Server" value="xyz.domain.org"> <param name="Port" value="3389"> <script type="text/javascript">getResolution();</script> </applet>

Brian_ · ‎08-26-2010

ruc, The delay occurs every time. JTAC suggested isolating and timing each policy; I forwarded the results to them along with the client-side HC logs. The policy for patch level is checking for just 3 patches: MS08-067, MS10-042, and MS10-046. HC took anywhere from 0:33 to 2:44 depending on XP SP3, Windows 7, or non-domain machine; on or off the network. But even the policies enabled at the role level such as registry settings and verifying if firewall is on for our own devices, range between 0:17 and 1:21 depending on OS and hardware.

Brian_ · ‎08-24-2010

I don't have much experience with Host Checker and I don't know if I'm simply asking it to do too much, or if I'm overlooking something. My problem is that it is taking minutes for HC to perform the assessment on the client. I've also noticed that HC is quite CPU intensive, often maxing out the processing time for moderate periods. On IVE version 7.0R1, I have HC configured with the following policies: 1) require any supported antivirus product, successful system scan within the last 7 days, definitions not older than 4 updates, monitor changes 2) scan for specific patches, with a small number of selected critical patches added to the criteria, SMS patch update disabled 3) check the values of various registry settings, using a custom requirement of Setting 1 AND (Setting 2 OR Setting 3 OR Setting 4 OR Setting 5) 4) check for a specific firewall product from one vendor. Rules 1 & 2 are required at the realm level, rules 3 & 4 are required at the role level for 3 roles. On a Windows XP SP 3 client, it takes anywhere from 1minute 22 seconds to up to 3 minutes for the sign-on page to display. Windows 7 seems faster, with the time be about 35 seconds to under a minute. I've got a case open with JTAC and the technician has viewed the configuration, but so far no immediate solutions. Have any of you experienced this and can you offer any suggestions? Thanks in advance!

Brian_ · ‎03-05-2010

Thanks for the info guys. Unchecking "Connection Requests" in the Event Log settings did the trick.

Brian_ · ‎02-24-2010

Hello, Can anyone help me with these messages I keep seeing in my Event log? Thanks, BB Info AUT20920 2010-02-24 19:13:29 - ive2 - [64.184.0.173] System()[] - Connection from IP 64.184.0.173 not authenticated yet (URL=/dana/home/norefr.cgi) Info AUT20920 2010-02-24 19:13:27 - ive2 - [162.1.2.2] System()[] - Connection from IP 162.1.2.2 not authenticated yet (URL=/dana/home/norefr.cgi) Info AUT20920 2010-02-24 19:13:26 - ive2 - [98.223.184.85] System()[] - Connection from IP 98.223.184.85 not authenticated yet (URL=/dana-na/auth/welcome.cgi?p=forced-off) Info AUT20920 2010-02-24 19:13:26 - ive2 - [98.223.184.85] System()[] - Connection from IP 98.223.184.85 not authenticated yet (URL=/dana/home/norefr.cgi) Info AUT20920 2010-02-24 19:13:26 - ive2 - [69.5.33.210] System()[] - Connection from IP 69.5.33.210 not authenticated yet (URL=/dana/home/norefr.cgi) Info AUT20920 2010-02-24 19:13:24 - ive1 - [98.223.201.243] System()[] - Connection from IP 98.223.201.243 not authenticated yet (URL=/dana/home/norefr.cgi) Info AUT20920 2010-02-24 19:13:24 - ive1 - [98.223.201.243] System()[] - Connection from IP 98.223.201.243 not authenticated yet (URL=/dana/home/norefr.cgi) Info AUT20920 2010-02-24 19:13:24 - ive1 - [98.223.201.243] System()[] - Connection from IP 98.223.201.243 not authenticated yet (URL=/dana/jz?con=79420565)

Brian_ · ‎06-09-2009

I've had a problem similar to this, but it gets even more wierd. In my case, I have two IVEs in Active/Active, load balanced by DXs. One node will properly map the user based on AD security group membership, but if the user gets sent to the other node, they will get a role mapping failure "No Roles," and cannot login. Also, if they were previously moved out of a group, the IVE will not see the refresh even though domain controllers are synch'd. So I opened a case with JTAC, but they have not been able to resolve. Get this: the IVE does cache AD group information and for some reason the trigger that tells it to refresh is broken (in certain instances). Here's the summary from JTAC regarding my case (2009-0422-0388): On 6.0R3.1, using AD server for authentication and role mapping based on security group membership. If a user is removed from a security group and removal, or if the group membership is exchanged with another one that corresponds to a different role mapping rule, is synched with domain controllers, IVE still thinks user is a member of previous group and maps user to old role. When same user logs into lab unit running 6.3R2, role mapping works correctly. Wondering if this is a flaw in 6.0R3.1 PTAC understanding of issue/issue reported by customer IVE unable to sync the changes made to the AD users. The changes made are reflecting on the Domain controllers but IVE still presenting the old roles to them. Seems IVE is presenting through the existing Cache.

Brian_ · ‎02-25-2009

I'm not sure about incorporating it into custom pages; you can check out the Custom Sign-on Pages Solutions Guide, downloadable from the website, or open a case with JTAC.

Brian_ · ‎02-18-2009

System>Configuration>Last Login Options at the bottom.

Brian_ · ‎02-12-2009

It says on the Users>User Roles>Role_Name>General>Overview Options section, above where you select Session Options for the role, that "If these settings are not specified by any roles assigned to the user, the settings specified in Default Options will be used." I understand that to mean the session options specified in the role would take precedence.

Brian_ · ‎12-16-2008

Kath, I'm using the Microsoft Sharepoint web profile template to intermediate Sharepoint (Resource Profiles>Web>New Profile>select Microsoft Sharepoint as the type from the drop-down). This has worked well for us; you may want to try that instead of JSAM. On another note, we use JSAM exclusively in a healthcare environment with external DNS loopback resolution instead of host file modification. Macs are popular with physicians and JSAM keeps cross-platform options open.

Brian_ · ‎11-07-2008

Antti, I think you will have to use some diplomacy and convince them to rewrite the links in the form of an http resource; otherwise, you can create a file bookmark to a location that contains the documents.

Brian_ · ‎11-06-2008

There are a few approaches. The first is in a document you can download from Juniper called "Custom Sign-In Pages Solution Guide." In there it talks about adding custom help files. The approach I've taken, which works well for me, is to create a simple HTML document with help topics specific to your environment, then enable the Show Help button in the applicable Sign-on page in Authentication>Signing In>Sign-In Pages. Upload your HTML help file. I'm including a screenshot of mine, which I created in MS Word (I know, not the ideal tool) and saved it as an HTML document. Another option is to put another web server accessible in front of the IVE and add a link to it on your sign-on page, then simply redirect to that for Help content, downloadable utilities, etc. Regarding the end-user meetings, be sure to educate them on accepting any necessary ActiveX controls and allowing Java certificates, etc. Also, we've had a lot of users inadvertently block the IVE ds* components with their Internet Security software such as dsCacheCleaner.exe, dsNetworkConnect.exe, dsCitrixProxyResource.dll, etc. If not, then it will be a real hornet's nest for your help desk.

Brian_ · ‎11-06-2008

commander, I've taken an approach that so far has worked in my organization. The online end-user Help content from the IVE is quite good, so if I need to (or I should say if I'm forced to) create documentation for any feature, that documentation amounts to a brief set of instructions of how to navigate to the topic in the online Help, including a few screenshots. I'm hoping this will create more self-reliance among the masses. Also, I believe the Help content from the IVE can be customized.

Brian_ · ‎08-26-2008

There are some general guidelines in the Admin Guide under Remote Access>Network Connect>Defining role settings: Network Connect. For Windows, it will need to be .bat, .cmd, or .exe. A .bat file can call a .vbs script. I've used a .bat file to call an .htm file to launch documentation in a new browser window on the client. The Admin Guide does mention that the client needs to be a member of the same domain. I don't have any experience on scripting for Mac, so I will defer to someone else.

Brian_ · ‎08-25-2008

Yup. We've even told our users to steer clear of certain hotels. I don't know what they are doing, but somehow their equipment is able to circumvent the DNS search order so that it will always search the hotel's ISP first (perhaps to make sure the users gets to their room number/credit card input page), thus, none of our internal resources resolve (I have our NC policy configured to split tunnel and search our DNS servers first). In some cases, we've worked around this by configuring the DNS search order in the client's TCP/IP properties. My hunch is that it is more prevalent with satellite service providers. If someone has cracked this, please share, because it is driving me nuts.

Brian_ · ‎08-25-2008

Write the script the does the mapping, then go into User Roles>Role Name>Network Connect, scroll down to "Session Scripts", input the location of the script.

Brian_ · ‎08-20-2008

To take this further, I have often thought how nice it would be for the SA product to have the ability to use a variety of different backgrounds, designs, etc., for all of the pages it serves up, whether login, bookmark, help, etc., and for this to be an additional item by itself under the left side admin navigation structure (sort of a "look and feel" design area). I know the capability is there to upload a few custom pages, but I wish this could be broadened considerably.

Brian_ · ‎08-01-2008

I just put an EV SSL cert on our cluster and am very happy with it. The VeriSign EV SSL requires that two intermediate certs be installed first. They are at http://www.verisign.com/support/verisign-intermediate-ca/extended-validation/index.html If you are clustering SA boxes, there is a price differentiation for the VeriSign warranty to support the additional nodes, depending on how many you have. Throughout the process, I indicated Apache.

Brian_ · ‎07-30-2008

When setting up a terminal services resource for the IVE to intermediate, is there a way to specify that it connect to the target's console (session 0)?

Brian_ · ‎07-24-2008

No resolution yet, but they said they were "looking into resolving the issue." They did suggest adding our IVE site URL to the browser's trusted site zone, but we do that here anyway. Wierd thing is with the behavior I've observed is that the outer frame of the OWA resource shows up trusted, but the email message body is in the "unknown zone." I've tried everything I can think of, including wildcards in the trusted sites config in the browser with no success in capturing what it is trying to do. HTTPWatch shows the redirect going on. I'm not the Exchange admin here, but did inquire with him and it seems the Exchange implementation is following all the standards.

Brian_ · ‎07-16-2008

Is *iPhone* with smartphone HTML Advanced sufficient in System>Configuration>Client Types or is the string and HTML type different?

Brian_ · ‎07-07-2008

We discontinued automatic host file mapping due to the privelege requirements users need locally. Instead, setup an external, internet-facing DNS server to resolve server host names to JSAM. This works much better and will reduce help desk calls considerably. A locked down machine can still run traffic through JSAM. Look in the Admin Guide under Remote Access/Secure Application Manager/JSAM overview/Using JSAM for client-server communications/Configuring external DNS servers and users machines.

Brian_ · ‎06-19-2008

My case number is 2008-0320-0583, if you want to ask them to cross-reference. I uploaded an avi file showing the problem to that case.

Brian_ · ‎06-19-2008

We've observed the same behavior. It turns out it is an IE7 workaround. It doesn't occur with IE6. I have an open case on it now, but heard from a Juniper engineer that this has been corrected in a later release--something I need to test.

Brian_ · ‎06-16-2008

You could put the IVEs in an active/active cluster with DXs in front of them, then place the IVE targets in global server load balancing group.

Re: XenDesktop with Java fallback

Re: XenDesktop with Java fallback

Re: XenDesktop with Java fallback

XenDesktop with Java fallback

Re: Apple OSX Lion Support???

Elusiva JavaRDP - how do I disallow desktop backgr...

Re: Host Checker Slow

Host Checker Slow

Re: "Connection from IP x.x.x.x not authenticated ...

"Connection from IP x.x.x.x not authenticated yet"

Re: No Roles assigned - when browseing AD groups

Re: Display user's Source IP/Client IP address as ...

Re: Display user's Source IP/Client IP address as ...

Re: Network Connect Session Timeout message - when...

Re: JSAM "cannot bind to localport=80"

Re: We can't download doc, xls and PDF files

Re: End User Documentation

Re: End User Documentation

Re: Juniper SA 6000 MAC OS X, Network Connect, scr...

Re: NetConnect works from some ISP's fails from ot...

Re: Juniper SA 6000 MAC OS X, Network Connect, scr...

Re: Creating DOD Banner Page

Re: EV SSL Cert?

Terminal Services--connect to console

Re: OWA 2007quirk

Re: iPhone

Re: JSAM on Vista

Re: OWA 2007quirk

Re: OWA 2007quirk

Re: Multi-site cluster