The new, new temporary domain is:    http://pulsesecure.thetempdomain.com      ... View more

Are we going to see another namechange? I notice that PulseSecure.net now points back to Juniper.  ... View more

The NEWCO (PulseSecure) will consist of key management members from Juniper who are migrating over along with the coders, TAC folks, etc. The field elements (sales teams, etc) will have to be built out and will occur as the transition moves forward (information received from a briefing). ... View more

I had the opportunity to attend the Juniper Sales Engineering Summit last week. During that event I was able to pick up some news that I can share. Most was NDA but I can at least share the name of the "NEWCO" - it is Pulse Secure and the current website (which says nothing) is pulsesecure.net    One comment that I feel ok about making in a public forum is that for users of the Pulse product I think that the long term impact will be nothing but positive. As a reseller of Pulse I am excited about the future.   As a Juniper reseller I stand by my earlier post and I am sad and see nothing good when it comes to my Juniper business.   One of my SE's was also at the Summit and talked with someone from the Pulse team. He posted in a private forum but I am cutting and pasting his comments below:   <<<<<<<<<  I had the chance to talk to a member of the Pulse team on Twitter the other day. It was quite shocking to hear their perspective on the whole thing. Apparently the Pulse team is VERY happy now, since they no longer have the weight of a huge networking company (who was not interested in the product) to have to deal with. Much more freedom, much less red tape. No more depenancies on other teams within Juniper.   He basically said it felt like a startup but with a shipping product and tens of thousands of customers. He was very excited, saying they "were finally FREE!" Honestly from the sounds of it we may actually be better off on this, because from the way he was explaining things I think we're going to see a lot more (and a lot quicker) effort invested into the product, regardless of who owns it. >>>>>>>>> Cut from a post by Chris Jones from the Juniper Ambassador team   So, if you a Pulse user (I say this as a user and a reseller) then I think that this will be a good move in the long run. I think the product, support and sales effort will improve.   My understanding also is that the main reasson that SSL was never developed for the SRX was due to the fact that it would cut into SSL-VPN sales. So, maybe Juniper will now reconsider and at least put it on the road map for a delivery some year down the road (hope springs eternal).   ... View more

You are incorrect - they sold off the entire Pulse unit which includes SSL. ... View more

Kevin - you know so darned much about this product and the backstory. Thanks for sharing your thoughts. Really appreciate it.   ... View more

Well the purchaser is a private equity firm that invests in technology. So I would guess that their objective is continue to improve and grow the product and then sell it off down the road based on some of their prior purchases. But that is nothing more than a giant SWAG. ... View more

Why didn't you generate the CSR from the SSL box itself? ... View more

That is not your config. It is a screen shot of one line of your policies. ... View more

Please share your config. ... View more

Don't know about netconf - but  you could do an extract with XML, delete the data and then reload the XML file and that will work. ... View more

Got it - yes, custom code is it indeed. ... View more

You can do quite a lot of custom changes to the default pages under:   Authentication / Signing-In / Sign-In Pages    You can change the display language for most of the fields.    As stated prior you can also suppress the display of the secondary username / password. However I don't understand why or how you would want to suppress username1. This is the default login username and must be entered versus the secondary authentication which is optional. ... View more

Sorry - not understanding what putting a single license server behind a load balancer would accomplish. ... View more

You cannot have two license servers. The only solution is the workaround I described in a prior post. This is the unofficial, unsanction but blessed workaround from the Juniper "dudes" ... View more

Ok - so on the SRX you allow port 443 to and from the MAG. That works great for all traffic that runs through the MAG to your internal networks.   However if you then configure Pulse to allow for VPN then you need to establish the "allow" rules on the MAG and on the firewall also. ... View more

AD as stated is for use with Microsoft Active Directory domains while LDAP is a standards based solution that can be used with almost any LDAP based authentication solution, including against Microsoft AD.   As most companies run AD it might seem to be straightforward - use AD as your AA choice. However it really boils down to how do you want to perform your authorization. Authentication is straightforward and either choice works.   For role assignment AD limits you to using security groups. IE - if member of security group "X" then role "Y" - which in many cases works just fine.   However with LDAP you have the entire set of directory objects available to you. IE - if member of department "Y" and residing in state "X" and your middle initial is "J" then assign to role "A"    So LDAP gives you much more flexibility in using directory attributes for role assignment.  ... View more

You can't configure the external VIP without also configuing local IP addresses for each node.  ... View more

Nope you can't - at least within a single role. You might try setting up two roles, one with NC and one with Pulse. Do merge roles and see what happens. I think it won't work but it is worth a shot.  ... View more

Not within the context of a single role. Not near an SSL box so I can't test but I was trying to think what would happen if you setup two roles and used the merge feature. My gut says it won't work but it might be worth a try.  ... View more

No it does not support it. I can't comment on the future.  ... View more

Interesting - I lease licenses in quantities of less than 25. I don't know what the minimum is but I have lease quantities of 12 on multiple boxes. ... View more

I am doing this from memory but on the Win 7 - network - auth - settings - there is a tab and it has an option to "validate server certificate" - I believe that to just do straight 802.1x cert authentication you need to uncheck that option. ... View more

Thanks! ... View more

Yes, two modules, and yes a license for each module (SSL one license, UAC one license) ... View more

Kannan - thanks for the reply. Appreciate the KB's and will check them out. A couple of comments   1. My statement about the documentation stands - it has errrors in it. I mentioned this to JTAC and they had no comment.  2. One question for you - from what I can tell Spengo authorization is only initiated / functions under the following conditions: A - user is already logged into an AD Domain. B - user attempts to access a resource through a browser (80 / 443.)    So if the user attempted to access a a resource via another protocol (say ftp) Spengo would not trigger an authorization attempt through the UAC box. Am I correct in that assumption? - IE - is is like a "hidden" captive portal from a functionality perspective.    If I am right then a follow up question. User attempts to access a resource through the browser. Authorization occurs, access is granted. They then attempt an ftp - will that ftp be successful? Assumptions are that in the UAC the resource policy is defined to allow access to both the http and the ftp traffic.    Just trying to gain an understanding of how this works and when to use it. Again, I am coming to think of it as a captive portal solution with no credential entry.   ... View more