We deployed 2 factor auth to our VPN environment by using AD username/password as the primary and User Certificates as the secondary. All mapping is done by username, but the Realm does confirm that the certificate is legitimate (can check certain parts of the cert) before allowing them in. This may not be an option for you, but we ended up developing a free solution to the certificates. A developer of ours used openSSL for Windows and built a .NET website around it to allow users to request / generate their own certificates. I don't know the specifics as to how he got it to work but I didn't get the impression it was especially difficult. The IVE is configured to trust client certs from (and only from) the CA that openSSL is using and the website allows users to self-generate certs to use for it. There are other solutions that work just as well but they will all cost. ... View more

There's no reason why you shouldn't be able to... does the issue still occur if you just give the access through WSAM without the application restriction? ... View more

Thanks I've already done so although I don't hold much hope in a resolution... looks like it's time to start researching alternatives to SVW, we've been using it for over a year now and it's clear that the feature is just not reliable enough to be used in a large production setting with non-standardized endpoints (which I thought is what it was designed for). Thanks again for your input. ... View more

I prefer to only use NC as a last resort because of what it does. WSAM acts as a reverse proxy and only allows what you give access to through it (even down to the process name) whereas NC actually puts that computer on your network and gives it an IP address. Sure it's restricted then by the ACL and Split Tunneling policies you put into place, but that simple difference gives me enough pause to only ever use NC when either the endpoint is a company controlled asset (company issued laptop, in which case Host Checker makes sure it is before proceeding) or when I have no choice due to the complexity / circumstances of the access being required. The use of NC then also requires you to make decisions about Split Tunneling (which most companies try to disable and many audits require it off), bandwidth consumption, etc. In the end, as said before it depends on what your needs are, but me personally I prefer WSAM under most situations. ... View more

It's good to know what I thought originally is correct...that the software will and does install inside of SVW. The problem that I mentioned earlier is that this is not 100% effective. Especially after our upgrade to 6.5 we had many users with issues getting either Host Checker or WSAM to work correctly inside of SVW. Host Checker most common problem was that it would constantly redownload the ESAP package (up to 3 times in a row) everytime they went to log in, WSAM most common problem is that while it would launch and show connected it would never actually send data through it. In both cases the fix for this was to uninstall both pieces of software and have them installed / run outside of SVW. For the majority of users this was not necessary, but it happened to enough of our user base for it to be obvious that there is some problem with installing Juniper software inside of SVW. ... View more

cbarcellos-- I understand how SVW works, but I always assumed that it made an exception for the installation/ upgrade of Juniper software. If this is not the case then WHY is it allowed to even be attempted to install? The IVE knows perfectly well that the user is inside of SVW (because Host Checker told it they were) so why doesn't it AT LEAST give a notice that it cannot install the software inside of SVW? It boggles my mind that such a simple thing would be totally overlooked... if the Juniper client software cannot be correctly installed inside of SVW then why does it try anyway? I can't even begin to count the amount of lost produciton hours because of this undocumented problem... and all because there's no check before it goes to install the software as to whether the user is inside of SVW or not. As an aside-- I spoke too soon about Host Checker being fixed. We do still have issues with users of various kinds being unable to log in because Host Checker isn't upgrading properly. Often uninstalling Host Checker fixes it but not always. ... View more

Our upgrade went pretty smoothly. Much to my pleasure we had nearly zero issues with Host Checker upgrading (like we did after 6.4 upgrade) so that alone made it worth while. One thing to note that we didn't fully notice until the upgrade-- Juniper changed the way their software asks permission from the end user to install/upgrade/run. Now you'll get a small prompt window that will ask permission to run. Luckily there's an "Always" option too so you can accept it once and forget about it which is nice. The one major issue we had will most likely not affect most other users since it's specific to Secure Virtual Workspace. For some reason the VPN components (HC, WSAM, etc) are unable to install / upgrade properly if it is done within the SVW environment. For example Host Checker would redownload the "UnifiedSDK.zip" up to 4x everytime SVW was launched. We also found WSAM would fail to operate properly as well in some cases. This only impacted about 10% of our userbase that use SVW, but when you've got a total of about 200 users it's noticable. I just found a workaround for this, and that was to purge Juniper software from the end user's machine and have them reinstall everything through a sign-in URL that didn't use SVW. After that they're perfectly fine. I will note, however, that I cannot say that this is an issue only with 6.5... I'm pretty sure previous versions had this same issue but it just became more obvious of an issue now after the upgrade and us not focusing on Host Checker problems. Pretty sure UnifiedSDK.zip always redownloaded multiple times in SVW in versions past. So overall I'd call our upgrade to 6.5R3.1 a success, it is already worlds better than 6.4, but the SVW issues muddied what otherwise would have been a very pain free upgrade. ... View more

Haha Jickfoo, I don't think it's that scary... I upgraded my one production SA-2000 last night to 6.5R3.1 and we've had no reported issues, although it's important to note it's only used by a few users hence why it was upgraded first. Tomorrow morning we upgrade our major production SA-4000's from 6.4R4 to 6.5R3.1 so I'll let you know if we encounter any problems... I'm optimistic that Host Checker seems to be upgrading properly for users but tomorrow will tell definitively as I'll have over 200 users logging in, all requiring Host Checker to do so. As an aside, if you're worried about Host Checker (or other VPN software) not installing / upgrading properly automatically when the user logs in, I recommend creating a /downloads sign in page that lets users log in (without Host Checker or anything) and gives them access to a Share you've set up with the manual installers for each piece of software. This has proven incredibly useful for me during the turbulent 6.4 upgrades and even if 6.5 fixes that (and I pray it does) it's still good to have around. ... View more

Access Logs will tell you the max concurrent per hour per IVE or Statistics for the entire cluster... but something tells me if it were that simple you wouldn't be asking. Just in case I thought I'd give the easy answer... anything more specific than that and I imagine it would require a lot of log manipulation Counting Realm logins while uncounting log outs over a period of a day sounds rough... ... View more

I wish I could share your enthusiasm... I used to up until 6.4 (maybe you skipped it?)... 6.4 was, in my experience, quite a step back. Our biggest issue was Host Checker not automatically upgrading for the end user (and instead they just get the generic "You are not allowed to sign in"), but the memory leak we found that forces us to reboot every week is also a huge pain. Before 6.4 (my first IVE was running 5.2) every upgrade was a pleasure. The last 2 upgrades (to 6.4R3 and to 6.4R4.1) nearly destroyed my Support Center so I'm hoping the extra staffing their planning for our upgrade to 6.5 is found to be unnecessary. My issues with 6.4 aside I do have 6.5 on a lab IVE and it is very nice. Love the integration with VMView and ActiveSync. ... View more

Are you using the same exact role for both login types? Local vs AD authentication has nothing to do with what access you get with Network Connect, it only changes how you log in. This makes me more inclined to think you may be using different roles for each type and they're not the same. ... View more

SonicBoom that's great to hear, I am planning on upgrading from 6.4R4 to 6.5R3.1 next week. Not only to hopefully address some memory leak issues I've been having but also Host Checker not automatically upgrading. ... View more

I agree that your best bet for this scenario is to use OWA rather than Outlook... not only from a simplicity standpoint but from a security standpoint... no company should allow their email to be downloaded / saved to a non company computer like that. We permit OWA from anywhere in the world, and if users want to use Outlook they have to VPN in using or by connecting to a company computer. It's perfectly adequate for any remote email needs... and if they really need the added functionality of Outlook they can go through the extra steps to do so. ... View more

It sounds to me like you have Active Directory OU's confused with Active Directory Security Groups... as far as I know Juniper only supports role mapping based on security groups, not OU. ... View more

1- Is this necessary to give computer name for SSL VPN? May we have to create this computer name as account on AD? -- You do not have to create it yourself, just tell it what OU you want it put in and what name you want and the VPN will create itself automatically. I know this is required if you are going to give access based on group memberships in AD... and I don't believe it's optional anyway. 2- Is this necessary to give admin name and password? what is the purpose of this? Yes, although I'd recommend creating a service account with admin rights just for the Juniper. It's probably at least needed for creating itself on AD as mentioned above. 3- What authentication type I have to select? kerboras, NTLM? Whatever it's set to by default always worked for me. If it differs that'd be based on your AD requirements. If you are looking for anything more specific I'd recommend talking to your Juniper SE or opening a ticket with Juniper. ... View more

Is the share actually \\<servername>\<username>? In other words if my username is john.doe and the server is Fileserver1, would my share be located at \\fileserver1\john.doe ? Is that the literal path? This will only work if the username they log in as is the same name as their share. ... View more

What username does the auth server come back with versus what you have listed in the role mapping? In AD 2003 it's just by username, but maybe it's not in 2008? Does 2008 include the domain in the name? DOMAIN.LOCAL/John.doe as opposed to john.doe? ... View more

You can change the font size in the Bookmark section of the access, but only an admin can do it... I agree that this should be something the user can change because this is the biggest reason why I can't use Telnet / SSH bookmarks and instead have to give users access via WSAM and putty. ... View more

I was able to fix my issue by using <USERNAME> variable in Basic Auth instead of <USER>. Juniper confirmed apparently there's a bug with basic auth properly passing domain information in <USER> or something like that. ... View more

Do you have that "Allow only ActiveSync Traffic" checkbox set too? Does turning it on / off make a difference? Definitely should open a ticket about this one... something's not right ... View more

@deaconz wrote: No significant latency to speak of because of the agent. Its just with Network Connect that ALL traffic comes to a standstill. We are working a case with Websense right now. Back on topic... I'm wondering if there's something misconfigured with your Network Connect policies... something that doesn't cause an issue unless Websense RF is involved. Just sounds to me like the Remote Filtering agent is trying to query the remote filtering server and timing out. What kind of access are you giving the computer through NC? Can it talk to the Websense Remote Filtering server / Filtering Service on the ports it needs? I forget exactly how Remote Filtering works (we never implemented it due to cost since it only protects your laptops during the time that they aren't on your internal network or VPN) but I believe it's supposed to shut off when it figures out it's on your network and will be filtered by your Websense Filtering Service, right? ... View more

@DanSmart wrote: I can't help on this issue, but just want to add that Websense 7 has been the bane of my existance. Be thankful you never had to deal with 6.x, Websense 7.1 is actually one of the most stable versions I've used in the past 4 years. There's definitely a learning curve but aside from stability issues in the past I'm not unhappy with how things are now. I'd definitely recommend opening tickets with Websense to address your problems... these days it's harder to get a tech on the phone than it used to be but unlike Juniper at least their Level 1 techs are still very knowledgable and have always been helpful to me. Sorry Juniper, but your Level 1 support for the past year has stank compared to previous years... something's very wrong when customers know more about the product than level 1 support. ... View more

@deaconz wrote: What is unstable about 6.4R4? I have to reboot my IVE's weekly to avoid a memory leak that will eventually cause the web UI to stop responding and not let anyone new log in. Have an open ticket with Juniper, confirmed a bug in the code... still waiting for a fix. What part of Windows 7 isn't supported in 6.4? I have Windows 7 users running WSAM without issues... the only thing I had to do was create a custom rule for detecting Windows 7 in Host Checker. ... View more

Your account probably doesn't have admin rights on the domain then... you'll most likely need to get them to create you a service account for the Juniper that's got domain admin rights in order for this to work. ... View more

Do you have the AD Password Management configured? User Realms -> <Your Realm> -> Authentication Policy -> Password -> Check the box for Enable Password Management. You'll also want to note that it mentions requiring that your Auth Server config for this AD environment be given an account with admin rights to be able to reset people's passwords for them. I've been using it like this for years, and all logon issues are relayed through the VPN. Expired Password please reset, Account is disabled, Account is Expired, etc. ... View more

None of your settings will be changed; as long as the version you're upgrading from is supported (and 6.4 is definitely supported for upgrading to 6.5) then everything will be maintained when it upgrades. The only thing I would caution on would be upgrading to such an early revision of a version. If you look in the release notes, 6.5R2 has a long list of fixes from 6.5R1 which makes me personally prefer to wait until 6.5R3 because that doesn't sound very stable to me... but then I see you're on 6.4R1 which is about as unstable as they come so I guess it should be better than what you're doing now. Over the past 3 years of supporting SA devices, I've come to the conclusion that: You NEVER upgrade to R1 releases (been biten way too many times by undocumented issues) and you do not upgrade to R2 releases unless you REALLY need/want to. R3 and above are normally pretty good... although I'm on 6.4R4 and it's still pretty unstable so I'm not sure anymore. ... View more

I'm all sorts of confused on this one... you're saying you're running 6.4R4 but don't want it to install NC 6.4R4 on the client machines?? Remember that Network Connect is, at least for Windows machines (I have no experience with Macs), the only Juniper SSL VPN client software that you can have multiple versions installed. You can have Network Connect 6.4 and 6.5 and 6.2 all installed at once. So what are you trying to do here again? You want to run 6.4R4 on the IVE, but run 6.5 on the clients?? How did you manage to test that successfully? As far as I know the IVE will force you to install whatever version of software it's running. ... View more