- Pulse Secure Community
- :
- About imtravis_
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
since
10-29-2017
10-29-2017
imtravis_
Contributor
38
Posts
0
Kudos
0
Solutions
10-26-2009
07:59:AM
I've setup a Citrix Listed Applications resource under terminal services resources. I've enabled Java Support and uploaded JICA 9.7. It works the first time a client connects, but anytime after that (unless you clear the cookies on the client machine), otherwise it fails trying to launch the Citrix client, and gets an error. Error is: Invalid argument winlaunchterm.cgi Line: 81 Code: 0 Char: 9 We're running 6.4R3 (build 14619). Any help would be appreciated. Thanks.
... View more
10-13-2009
11:01:AM
I'd be down for that. I know a few years ago (pre j-net forum), I was involved with a startup Juniper User Group, and it was great sharing info.
... View more
10-13-2009
10:57:AM
Does your SharePoint support basic auth internally? I have ours set to use basic auth, and it's been working great (running MOSS 2007). I'm only running 6.4R3 in our test environment, and it seems to be fine. Haven't tried 6.5R1 yet. Could you try a rollback to 6.4 and see if it's possibly an "undocumented" feature of 6.5R1?
... View more
10-13-2009
10:54:AM
Another option could be to use a client certificate based authentication as a secondary, and just have the client certs installed from an internal resource only. Then only allow those devices with the cert to be able to authenticate. I believe you can base the client cert off of the MAC address.
... View more
10-13-2009
10:51:AM
I had the same issue, until I found ProperJava on sourceforge. Took me a bit to figure out that I was missing a file in the upload. If muttbarker sends you the bundle, looks like it should work.
... View more
10-13-2009
10:48:AM
Have you verified that you have the Web Interface running on http://1.1.1.1 ? What version of Xenapp are you running? Instead of using the "web interface" for Citrix via SA4000 we've gone to publishing apps directly through the SA4000 (quite nice, less clicking for users). You can use a "terminal session" to create a link to your citrix farm. I use a test account to verify that it'll publish the app, then I use the <USERNAME> <PASSWORD> variable to allow it to dynamically create the published app list based on the user login.
... View more
07-09-2009
07:06:AM
We don't do an "approved" list, we do a recommended list, and we limit what users have access to. That way if they are infected, there's a lot less chance they'll bring it in.. We limit by port, application, and destination.
... View more
07-09-2009
07:02:AM
I've had good luck with it on our 6.2 system, and our 6.3 test environment.. but officially the line from Juniper is (taken from their knowledgebase): When will Juniper Networks SSL VPN (Secure Access platform/IVE OS) support Microsoft Windows Internet Explorer 8? Knowledge Base ID: KB12365 Version: 4.0 Published: 25 Mar 2009 Updated: 25 Mar 2009 Categories: SSL VPN SSL_VPN_(IVE_OS) Synopsis: When will Juniper Networks SSL VPN (Secure Access platform/IVE OS) support Microsoft Windows Internet Explorer 8? Problem: Solution: Juniper Networks has qualified IE 8 in IVE OS 6.4. Hence, Internet Explorer 8 is supported in this release. NOTE: IVE OS 6.4R1 is now officially released and can be downloaded from the Juniper Support page. For additional information, consult the Release Notes and Supported Platforms documentation: SSL VPN (IVE) 6.4 Purpose: Specifications
... View more
06-17-2009
09:28:AM
We've setup our User directories with the following path, and it seems to work: \\dfsdomain\DFS\Root\User\<USERNAME> This is assigned to all users, and they'll end up with a link to their "User" drive. This has been working for us since 3.x days of IVEOS.
... View more
06-16-2009
03:40:PM
We're currently using the Citrix Listed Applications, and I'm currently testing the JICA, and so far it's working w/o the winlaunchterm.cgi. In the Terminal Service Resource Profile, I've enabled Java, uploaded the JICA, and chose to use it.. then modified the HTML to the following: <html> <head> <title>Citrix Java ICA Applet</title> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> </head> <!-- Notes: 1) << CODEBASE >> is a system value that will get replaced at the time the applet is launched. Please do not modify this value. 2) Please modify the remaining values as needed. 3) Please make sure all attribute names/values are enclosed in double quotes. --> <body> <applet code="com.citrix.JICA" codebase="<< CODEBASE >>" archive="JICA-browseN.jar,JICA-cdmN.jar,JICA-clipboardN.jar,JICA-configN.jar,JICA-coreN.jar,JICA-printerN.jar,JICA-seamlessN.jar,JICA-sicaN.jar,JICA-zlcN.jar,JICAEngN.jar,cryptojN.jar,sslN.jar,JICA-audioN.jar" width="1040" height="768" name="Citrix Java ICA" align="top"> <param name="code" value="com.citrix.JICA"> <param name="codebase" value="<< CODEBASE >>"> <param name="archive" value="JICA-browseN.jar,JICA-cdmN.jar,JICA-clipboardN.jar,JICA-configN.jar,JICA-coreN.jar,JICA-printerN.jar,JICA-seamlessN.jar,JICA-sicaN.jar,JICA-zlcN.jar,JICAEngN.jar,cryptojN.jar,sslN.jar,JICA-audioN.jar"> <param name="cabbase" value=""> <param name="name" value="Citrix Java ICA"> <param name="width" value="1040"> <param name="height" value="768"> <param name="align" value="top"> <!-- Please specify additional params here after the comment. <param name="paramname" value="paramvalue"> --> <param name="username" value="<<USER>>"> <param name="password" value="<<PASSWORD>>"> <param name="domain" value="Domain Name Here"> <param name="bpp" value="24"> <param name="icafile" value="<<ICAURL>>"> <param name="DesiredWinType" value="7"> <param name="ScreenPercent" value="110"> </applet> </body> </html> With it set to: Always use this Java applet. This combo is working for us. I'm just now trying to get it to not have the "Click Here to Connect " screen, so it'll launch automatically and log them in.
... View more
03-11-2009
08:09:AM
If you're not able to see content, that's by design.
... View more
01-12-2009
09:38:AM
We used to go that route, but with 6.2R2.1 we went with using the xml, so we could then just publish the app to their links page in SSL. Seems to be a little easier for the end user.
... View more
12-02-2008
02:33:PM
We currently run two SA 4000s in production, then for our LAB we have a SA2000 running a LAB license, which enables all features.. might considure running a LAB license.. it's fairly cheap, but only allows a 10-user connection.
... View more
10-09-2008
01:55:PM
Most mobile devices have a limted list of trusted CAs (like my Moto Q only had about 10, while a pc has like 30). You will probably need to install the trusted CA cert into the mobile device. Depending on your mobile device, depends on how you would do this. Usually Verisign and Thawte show up on both, but not all of Thawte's and Verisigns Trusted CAs show up on both.
... View more
10-06-2008
02:24:PM
You may need to use the OU that covers all the users you're authenticating. So if you have admins under admins, and users under users, you may need to use DC=Domain, DC=Local for the OU to search. Although I agree LDAPS is the preferred method (as it's more flexible, and gives you the password expiration, errors from MS). Message Edited by imtravis on 10-06-2008 02:25 PM
... View more
09-16-2008
03:51:PM
Using IE, you can export the CA that it's not trusting on the mobile device, then copy the exported cert to the mobile device. Once on the mobile device, you can install the cert, and if it's a true CA, then it should come up as a CA on the mobile.
... View more
09-15-2008
07:40:AM
I haven't even seen 6.2R2.0 yet, much less 6.2R2.1. Any ideas when it will be released to the general user base?
... View more
08-25-2008
02:59:PM
I believe it doesn't allow the same user to log in multiple times for security reasons. I believe you'd need to create seperate accounts for each login.
... View more
08-22-2008
04:03:PM
Try doing the following for group memebership: BASE DN: dc=domain2, dc=domain1 Filter: cn=<GROUPNAME> Member Atrribute: member Travis
... View more
08-22-2008
07:20:AM
I think kenlars only wanted you to do it to test to see if the information that you are passing on to the SSO is correct. Once it's known to be correct, then we all can try and help with the variable.
... View more
08-20-2008
01:57:PM
If you auth against secure LDAP instead of AD (to your AD), then you can let the normal MS password error messages pass through. That's how we got around that issue. So when someone's password is due to expire, it will give them a notice when they log in, if they don't meet the standards, it notifies them. We tried using AD in the IVE, and it didn't pass the MS error messages through. I had even had a ticket open with Juniper a couple of years ago on this.
... View more
08-18-2008
11:14:AM
We've now upgraded to 6.2R1 (for ActiveSync support), and still have the same issue. Our clients running IE6 (XP), are still unable to connect via SSL, yet, the same machine once upgraded to IE7, all appears to work. Still getting the same error message on the IE6 machines. Has anyone else run into this issue? Using the Juniper default configuration for a Citrix web session.
... View more
08-18-2008
11:04:AM
Instead of servernames, try just using the IPs? See if that helps?
... View more
08-18-2008
11:02:AM
Another difference (if I remember correctly), is that SAM doesn't allow UDP packets, while NC does. (I could be wrong, but I believe I've had that issue before, and went from SAM to NC and it fixed the issue for some products).
... View more
08-18-2008
10:59:AM
Have you tried <USER>.suffix? I think that's the variable (I just checked our configurations and noticed that difference.
... View more
08-06-2008
11:59:AM
I spoke with JTAC, and the only way to do the self signed cert is by resetting the configs (which I did), and used the self signed cert. I then imported the system/user configs minus the certs, and then manually installed the certs again (from configs), so it wouldnt' overwrite the new self signed cert. Once I did that, I was able to download the self signed cert, and the phones now work, and the iPhone sends a warning, which you choose to accept the cert, then lets ActiveSync work.. Thanks again for your help privatepile.
... View more
08-06-2008
08:48:AM
Are they the same OS that's failing and working? Are the ones failing just home user pcs or are they locked down in any way? Does the user have rights to modify the "hosts" file?
... View more
08-05-2008
03:30:PM
It's single certs for normal, and for activesynce (like your example: One for normal access, ie. secure.domain.com, and another for activesync, activesync.domain.com). No wildcard certs. We're running WM 5/6 (multiple phones), and iPhones (the main driving force behind this implementation). We're using the Verisign Trial Cert, which requires a Verisign Trial CA to be added (which the phones don't seem to like). I did, however, try the trick of unchecking SSL required and once I did that, the cert issue cleared up (so now I'm not sure if I'm encrypted or not at that point, but thinking not), instead now I get server not found (Error code: 0x80072F78). Again, I appreciate your help.
... View more
08-05-2008
10:05:AM
When I test with a desktop, I get the login page, then I sign in, and get the frame, but page not found. I'm using a Verisgn TRIAL cert to the FQDN of the Virtual Port/Host of the IVE. When I try with the ActiveSync phone, I get certificate errors: Support code: 0x80072F0D on the Motorola Q. Thanks for you help. Message Edited by imtravis on 08-05-2008 10:16 AM
... View more
Latest Tags
No tags yet
© 2017 Pulse Secure, LLC. Use of this website assumes acceptance of our Legal Notices and Privacy Policy.
Pulse Secure has updated its Privacy Policy effective June 28, 2017.
