About Billy_

Billy_ · ‎03-17-2011

Hi guys. I want SSLVPN user to use NC IP Address from LDAP Server(LDAP Attribute). They connect SA6500 Active/Active cluster. But I have faced on critical problem. In this case, both of SA6500 cluster nodes have to use same ip pool for users. It means, internal L3 switch can't split route for SSLVPN user. How can I get my goal? Is it possible using another Load Balancer in the internal network for solving problem?

Billy_ · ‎10-24-2010

Hi all. I've tested the SSLVPN connection with iPhone based JunOS pulse and SA2000. Authentication method is the Client Certificate authentication in order to use of "On demand VPN". But it didn't work. There was an "Authentication Fail" errer message on my iPhone when I try to connect. I couldn't find any log regrading this error in the SA2000. It seemed this error occured within SSL negotiation. I'm sure all coditions for Client Certificate Authentication was satisfied - Certificate of the SA2000 is self-signed certificate. - SA2000's certificate was installed in the iPhone as "Trusted root authority" - Client Certificate was issued by my local CA server. - Client Certificate was installed in the iPhone. - Certificate of my local CA was installed in the SA2000 as "Trusted Client CAs". This SA2000 has been used for Netconnect user via "*/" URL in the "sign-in policies". I added the specific URL in the "sign-in policies" for this test. I also added virtual port in order to isolate SA2000's certificate(one is for NC, another is for JunOS Pulse). Strange symptom is that it worked find when I connect to another SA2500 my local test device. IVE version(6.5R6) and entire configuration was almost same except sign-in policies. SA2000 had the specific url for junos pulse against sa2500 has only "*/" url. What can be problem? and which part I have to check? It is very difficult for me to investigate the logs of JunOS pulse from iphone. Following informations are Junos pules's log from iPhone and TCP dump from SA2000. ## Junos Pulse's log ### 20101015210828.462056 Pulse Mobile[p659.t775] info Connection status changed to Connecting (SSLVPNControllerImpl.m:549) 20101015210828.515695 Pulse Mobile[p659.t775] error Calling VPNConfigurationConnectionStart (SSLVPNControllerImpl.m:400) 20101015210828.545631 Pulse Mobile[p659.t775] error Done calling VPNConfigurationConnectionStart (SSLVPNControllerImpl.m:417) 20101015210829.98831 Pulse Mobile[p659.t775] info Connection status changed to Disconnecting (SSLVPNControllerImpl.m:549) 20101015210829.244517 Pulse Mobile[p659.t775] error VPNConfigurationSendMessage failed: Error Domain=com.apple.SystemConfiguration Code=0 "The operation couldna€?t be completed. (com.apple.SystemConfiguration error 0 - Success!)" UserInfo=0x1741e0 {NSDescription=Success!} (ConfigurationController.m:730) 20101015210829.266019 Pulse Mobile[p659.t775] info Connection status changed to Disconnected (SSLVPNControllerImpl.m:549) 20101015211239.281546 Pulse Mobile[p659.t775] info Connection status changed to Connecting (SSLVPNControllerImpl.m:549) 20101015211239.333389 Pulse Mobile[p659.t775] error Calling VPNConfigurationConnectionStart (SSLVPNControllerImpl.m:400) 20101015211239.360438 Pulse Mobile[p659.t775] error Done calling VPNConfigurationConnectionStart (SSLVPNControllerImpl.m:417) 20101015211239.900365 Pulse Mobile[p659.t775] info Connection status changed to Disconnecting (SSLVPNControllerImpl.m:549) 20101015211240.74977 Pulse Mobile[p659.t775] error VPNConfigurationSendMessage failed: Error Domain=com.apple.SystemConfiguration Code=0 "The operation couldna€?t be completed. (com.apple.SystemConfiguration error 0 - Success!)" UserInfo=0x80127c0 {NSDescription=Success!} (ConfigurationController.m:730) 20101015211240.95669 Pulse Mobile[p659.t775] info Connection status changed to Disconnected (SSLVPNControllerImpl.m:549) 20101015212533.877219 Pulse Mobile[p723.t775] info Control App started at 2010-10-15 12:25:33 GMT (SSLVPNControllerImpl.m:47) 20101015212533.877709 Pulse Mobile[p723.t775] info Reloading configurations (ConfigurationController.m:382) 20101015212533.922086 Pulse Mobile[p723.t775] info Got configuration named cert_vpn2 (ConfigurationController.m:399) 20101015212533.948905 Pulse Mobile[p723.t775] info Got configuration named cert_vpn1 (ConfigurationController.m:399) 20101015212533.977691 Pulse Mobile[p723.t775] info Got configuration named ttt (ConfigurationController.m:399) 20101015212533.999779 Pulse Mobile[p723.t775] info Configuration ttt is enabled (ConfigurationController.m:404) 20101015212533.999954 Pulse Mobile[p723.t775] info Loaded 3 configurations (ConfigurationController.m:415) 20101015212534.4578 Pulse Mobile[p723.t775] info Connection status changed to Disconnected (SSLVPNControllerImpl.m:549) 20101015212534.4810 Pulse Mobile[p723.t775] info Registering for updates from config ttt (ConfigurationController.m:551) 20101015212534.7425 Pulse Mobile[p723.t775] info Config state changed from 1 to 2 (ConfigurationController.m:778) 20101015212534.43747 Pulse Mobile[p723.t775] info Application did finish launching (ControlAppMobileDelegate.m:60) 20101015212534.55361 Pulse Mobile[p723.t775] info Adding splash screen (ControlAppMobileDelegate.m:90) 20101015212534.350418 Pulse Mobile[p723.t775] info Removing splash screen (ControlAppMobileDelegate.m:460) 20101015212534.654194 Pulse Mobile[p723.t775] info Got 0 cookies from the plugin (ConfigurationController.m:670) 20101015212534.654447 Pulse Mobile[p723.t775] info Config state changed from 2 to 0 (ConfigurationController.m:778) 20101015213959.240783 Pulse Mobile[p780.t775] info Control App started at 2010-10-15 12:39:59 GMT (SSLVPNControllerImpl.m:47) 20101015213959.241516 Pulse Mobile[p780.t775] info Reloading configurations (ConfigurationController.m:382) 20101015213959.287410 Pulse Mobile[p780.t775] info Got configuration named cert_vpn2 (ConfigurationController.m:399) 20101015213959.314067 Pulse Mobile[p780.t775] info Got configuration named cert_vpn1 (ConfigurationController.m:399) 20101015213959.340601 Pulse Mobile[p780.t775] info Got configuration named ttt (ConfigurationController.m:399) 20101015213959.369557 Pulse Mobile[p780.t775] info Got configuration named Test_VPN (ConfigurationController.m:399) 20101015213959.391917 Pulse Mobile[p780.t775] info Configuration Test_VPN is enabled (ConfigurationController.m:404) 20101015213959.392083 Pulse Mobile[p780.t775] info Loaded 4 configurations (ConfigurationController.m:415) 20101015213959.396687 Pulse Mobile[p780.t775] info Connection status changed to Disconnected (SSLVPNControllerImpl.m:549) 20101015213959.396859 Pulse Mobile[p780.t775] info Registering for updates from config Test_VPN (ConfigurationController.m:551) 20101015213959.399466 Pulse Mobile[p780.t775] info Config state changed from 1 to 2 (ConfigurationController.m:778) 20101015213959.432753 Pulse Mobile[p780.t775] info Application did finish launching (ControlAppMobileDelegate.m:60) 20101015213959.446169 Pulse Mobile[p780.t775] info Adding splash screen (ControlAppMobileDelegate.m:90) 20101015213959.770075 Pulse Mobile[p780.t775] info Removing splash screen (ControlAppMobileDelegate.m:460) 20101015213959.969240 Pulse Mobile[p780.t775] info Got 0 cookies from the plugin (ConfigurationController.m:670) 20101015213959.969394 Pulse Mobile[p780.t775] info Config state changed from 2 to 0 (ConfigurationController.m:778) 20101015214002.119299 Pulse Mobile[p780.t775] info Connection status changed to Connecting (SSLVPNControllerImpl.m:549) 20101015214002.174946 Pulse Mobile[p780.t775] error Calling VPNConfigurationConnectionStart (SSLVPNControllerImpl.m:400) 20101015214002.202351 Pulse Mobile[p780.t775] error Done calling VPNConfigurationConnectionStart (SSLVPNControllerImpl.m:417) 20101015214002.882411 Pulse Mobile[p780.t775] info Connection status changed to Disconnecting (SSLVPNControllerImpl.m:549) 20101015214003.63918 Pulse Mobile[p780.t775] error VPNConfigurationSendMessage failed: Error Domain=com.apple.SystemConfiguration Code=0 "The operation couldna€?t be completed. (com.apple.SystemConfiguration error 0 - Success!)" UserInfo=0x1af510 {NSDescription=Success!} (ConfigurationController.m:730) 20101015214003.82285 Pulse Mobile[p780.t775] info Connection status changed to Disconnected (SSLVPNControllerImpl.m:549) ## TCP dump (SSL negotication part) ## Attached..

Billy_ · ‎07-23-2010

Hi, guys... One of my customer want to access to their local web service using Blackberry phone. I'm not sure , because I didn't find BB on SSLVPN Supported platform. I'll appreciate if somebody gives me useful information in deploying this case. Have a nice day~~

Billy_ · ‎06-30-2010

Thanks for reply. Both of SA and CITRIX have the same external authentication server(Active Directory). User's credential could be delivered to CITRIX server by Virtual Desktop Bookmark's SSO on SA. First time I try to this connection, it didn't work. I've got raw data from SA's internal port. It seemed Citrix WEB interface server of which the ip address was inserted on "Virtual Desktop profile" of SA sent the "HTTP 500 Internal Server Error". +---------------------------------------------------------------------- ##### SA => Citrix web interface server ##### POST /scripts/wpnbr.dll HTTP/1.1 Host: sbc.lgcns.com Pragma: no-cache Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */* Content-Type: text/xml Connection: close Content-Length: 468 <?xml version="1.0" encoding="ISO-8859-1" ?> <!DOCTYPE NFuseProtocol SYSTEM "NFuse.dtd"> <NFuseProtocol version="5.0"> <RequestAppData> <Scope traverse="subtree"></Scope> <DesiredDetails>all</DesiredDetails> <AppName></AppName> <ServerType>all</ServerType> <ClientType>ica30</ClientType> <Credentials> <UserName>testid</UserName> <Password encoding="cleartext">testpassword</Password> <Domain type="NT">TESTDOMAIN</Domain> </Credentials> </RequestAppData> </NFuseProtocol> ##### Citrix Web Interface server => SA #### HTTP/1.1 500 Internal Server Error Content-Type: text/html Server: Microsoft-IIS/7.0 X-Powered-By: ASP.NET Date: Wed, 30 Jun 2010 08:00:39 GMT Connection: close Content-Length: 1160 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content="text/html; charset=ks_c_5601-1987"/> <title>500 - .... .... .....</title> <style type="text/css">  </style> </head> <body> <div id="header"><h1>.... ....</h1></div> <div id="content"> <div class="content-container"><fieldset> <h2>500 - .... .... .....</h2> <h3>.... .... ........ ...... .... ...... .. .........</h3> </fieldset></div> </div> </body> </html> +---------------------------------------------------------------------- I guess SA sent user's credential using XML form and Citrix couldn't accept it.

Billy_ · ‎06-27-2010

My customer has contructed the CITRIX server-hosted virtual desktop for their IT infrastructure. Users have to connect the local CITRIX server using 'Xendesktop' client program. The problem is that he wants users outside the network connect to local CITRIX server through SSLVPN. I'm sure it simply works if user connect to the server using Network-Connect. But my customer want SSO. (Outside user doesn't have to input their ID/PW for both of CITRIX and SSL). Is it possible the authentication of NC and Xendesktop could be integrated? If not, is there any solution for archiving it? And Xendesktop's STA(Secure Ticket Authorith) could work over IVE's SSL session?

Billy_ · ‎10-05-2009

Hi guys~ I have been testing "Custom Radius Rules" of SA device with the "FreeRadius" external authentication server. But it seems this rule isn't triggered because free-radius response with only "Access-Accept" instead of "Access-Challenge". I have found some hints on another web site, he says free-radius doesn't send Access-Challenge if the authentication type is "PAP"(My Sa device might use PAP). To archive this goal, SA device sould send a request for an authentication protocol that requires multiple server-client exchanges (like EAP). How I configure my SA device to request authentication with EAP? or Some other solution which can help me to solve this problem would be O.K Thanks.

Billy_ · ‎09-03-2009

Thanks for your answer. kenlars Yes. This case met both of your 2 conditions. But I mentioned previously, user can only use the re writer on the following situation. 1) typing URLs on bookmarks page. => this function is not be used. 2) adding new bookmark page => this function is not be used. 3) typing URLs on browser's address bar (ex: "https://<SSLVPN URL>/dana/home/launch.cgi?url=<custom url>") You mean...if it met your 2 conditions, user can creat rewrite session by typing custom URL on their broswer's address bar?

Billy_ · ‎09-03-2009

Thanks for your answer. From what I understand, user can only use the re writer on the following situation. 1) typing URLs on bookmarks page. => this function is not be used. 2) adding new bookmark page => this function is not be used. 3) typing URLs on browser's address bar (ex: "https://<SSLVPN_URL>/dana/home/launch.cgi?url=<custom_url>") But in this case, it seems user session used re writer by typing only "custom URL" on the brower's address bar.

Billy_ · ‎09-03-2009

Thanks for your answer. Automatically, WEB Page(Custom start page) of internal Server can be openned on User's IE Browser right after user creats this session. It means this role has custome start page(role->UI option->Custom page->Startpage URL). But it must not be rewrited because this role has a rewrite policy that gets this session not be rewrited (Don't rewrite content: Redirect to target web server) on the top of "selective rewrite policy list". In other word, any user can not created the rewrite session.

Billy_ · ‎08-30-2009

Currently running 5.5R5 in production

Billy_ · ‎08-30-2009

My customer has a problem on restricting the user access though the IVE. Based on IVE configuration, user might not be able to access to external portal sites using rewrite session. But I can find a lot of user access logs which indicates user have been accessing to Internet through rewrite. ------------------------------------------------------------------------------------------------------------- WebRequest ok : Host: www.naver.com, Request: GET / HTTP/1.1 WebRequest completed, GET to http://www.naver.com:80// from 202.131.29.71 result=200 sent=16 received=0 in 1 seconds WebRequest ok : Host: www.naver.com, Request: GET /css/naver_20090803.css?0824 HTTP/1.1 WebRequest completed, GET to http://www.naver.com:80//css/naver_20090803.css?0824 from 202.131.29.71 result=200 sent=43 received=67848 in 0 seconds WebRequest ok : Host: www.naver.com, Request: GET /js/error.js HTTP/1.1 WebRequest completed, GET to http://www.naver.com:80//js/error.js from 202.131.29.71 result=200 sent=27 received=220 in 1 seconds WebRequest ok : Host: www.naver.com, Request: GET /js/reatcmp.html?0608 HTTP/1.1 WebRequest completed, GET to http://www.naver.com:80//js/reatcmp.html?0608 from 202.131.29.71 result=200 sent=36 received=3457 in 0 seconds WebRequest ok : Host: nv1.ad.naver.com, Request: GET /adshow?unit=002P HTTP/1.1 WebRequest completed, GET to http://nv1.ad.naver.com:80//adshow?unit=002P from 222.122.16.244 result=200 sent=32 received=5704 in 1 seconds ...... ------------------------------------------------------------------------------------------------------------- These are detailed information of IVE for user session. 1. Authentication server : External AD server 2. Session option of role 1) Persistent Session : Disabled 2) Persistent Password caching : Disabled 3) Browser request follow through : Disabled 3. "Web" of user role is enabled to use of starting custom page after user sign-in. 4. All of User access to Internal resources via NC 5. Option of "Web" 1) User can type URLs in the IVE browse bar : Disabled 2) User can add bookmarks : Disabled 3) Mask hostnames while browsing : Disabled 4) Persistent cookies : enabled(default) 6. selective rewrite policy 1) *.* -> "All roles" -> allow (default) What can be cause of this problem?

Billy_ · ‎06-24-2009

Hi guys.~~ I'm trying to design the Custom sign-in page on SA device with two-factor authentication. Primary authentication server is AD , secondary is RSA. Users have to input their credentials (for both of Primary and Secondary server) on a single custom sign-in page. Question. 1. How can I submit secondary username and password using javascript function? Following example is javescript for single authentication. ------------------------------------------------------------------------ function sendit() { document.frmLogin.submit(); Login(); } function Login() { return true; } . . . <form name="frmLogin" action=login.cgi method="POST" ...... <input type=text id=txt_id name="username" class="textbox" .... <input type=password id=txt_pass name="password" class="textbox" ... ------------------------------------------------------------------------ 2. I'll display authentication fail messages on custom sign-in page based on "LoginPageErrorCode". But it seems IVE returns same error code whichever primary or secondary authentication fails. It meeans I don't know which of primary and secondary authentication would fails. Are their any solution dividing error code of primary and secondary authenticaion? 3. As I read the document "Custom Sign-In Pages Solution Guide", there are a log of login error code. I wonder whether the following error codes is returned when we use AD and RSA. 1002 : Invalid Username or Password 1012 : The password is too short 1022 : Account Locked Out 1023 : Account Expired Thanks..

Billy_ · ‎02-15-2009

Hi guys.. I have a problem in deploying WEB Rewritting of SA4500. Everything work find except moving previous page. :Scenario ------------------------------------------------------------------------------------------ User will fill in there information in the register page. If some of those things are wrong information, alert message will pop up. At this time, user have to click "OK" button on the pop-up window and Java script let them move to previous page. (This is same with clicking "previous" button in IE Browser) But only error page appeared with "Expired Page" instead of previous page. ------------------------------------------------------------------------------------------ What can be solutoin of this issue?

Billy_ · ‎02-11-2009

I'm sorry, it was my mistake. When I test it, application engineer had modfied some codes on the back-end server. Now it works fine. ^^ I appreciate your hlep. Thank you very much~~

Billy_ · ‎02-10-2009

Thanks for your help ruc~~ ^^ I have configured it as you mensioned before, but it doesn't work. It seems web-rewriting of SA4500 can not deliver User-Defined variables (org, branch, user) to back-end web applicatoin. I've got same result as I connect to Back-end server without User-Defined variables. https://[SA4500_FQDN/dana/home/launch.cgi?url=loan.abc.com/loanstart/loan.asp?org=value1&branch=value2&user=value3 https://[SA4500_FQDN/dana/home/launch.cgi?url=loan.abc.com/loanstart/loan.asp ==> Same result. Following information is what I configured in SA4500. ------------------------------------------------------------------------------------------------------------------------ Inside Server FQDN : loan.abc.com URL on external link : http://loan.abc.com/loanstart/loan.asp?org=value1&branch=value2&user=value3 Sign-in Policy : vpn.abc.com/ -> Loanrealm Authentication of Loanrealm : Anonymous Auth Server Role mapping of Loanrealm : * (all user ) => LoanRole LoanRole Parameter - General : Only "web" option is enabled. - Session Option : Only "Enable browser follow through" Option is enabled. - Bookmark of "web" : http://loan.abc.com/* - Web ACL : *.*/* allowed. - Selective rewritting : http://loan.abc.com/ => Rewrite content (auto-detect content type) --------------------------------------------------------------------------------------------------------------------------- Are there more options I have to configure? I'm dying to solve this problem..TT Thanks...

Billy_ · ‎02-10-2009

Thanks ruc.. End user will access to the Back-end server's page by clicking on links on some external web page.(Number 3) For example, Normal access link is http://loan.abc.com/loanstart/loan.asp?org=value1&branch=value2&user=value3 Is it possible?

Billy_ · ‎02-10-2009

Hi guys... I have a problem in deploying SSLVPN Web rewriting feature... Back-End webserver is protected by SA4500. I'll let VPNUSER access to back-end server's webpage without authentication (Anonymous authentication) and they would access the page typing URL(ex:https://vpn.aaa.com,DanaInfo=/loan.bbb.com,/start/orglink.asp?org=bank&office=branch&user=jhon). The values in the URL "bank","branch","jhon" are variable which would be used by back-end web applicatoin. I created bookmark page "http://www.bbb.com" and only "Web Rewritting" must be used. I've tested this case but failed. Is it possible?

Billy_ · ‎10-20-2008

Hi, team. I wonder if this case is caused by IVE or Windows OS of NC client. It occurs when NC user get an ip address whose account mapped more than one roles and ip pools of NC profile. For example, username 'juniper' has two roles. (role#1, role#2) Location of role#1 is higher than role#2 and "Stop processing rules when this rule matches" option is not used. Each of roles have their own NC profile(ip pool). It seems if entire ip addresses of role#1 are not available, user 'juniper' gets an IP ADDRESS from role#2's ip pool. But next time user 'juniper' connects to IVE, it still gets the IP ADDRESS of role#2 which it had been assigned before ,even though some IP ADDR of role#1 are available. What's the reason of this issue? Thanks.

Billy_ · ‎11-25-2007

Hello, My name is Billy and I have two questions. 1. Does NC service disconnected in a moment when USER ACCOUNT XML configuration is imported? 2. If it is true, Can I avoid it by separating Local Auth-Server? In other word, if SA device has two Local Auth-Servers, updating only one Auth-Server's User account by importing XML has influence upon another Auth-Server? Message Edited by Billy on 08-28-2008 02:28 AM

Same ip pool on the Active/Active Cluster.

Authentication Failed error from JunOS Pulse iPho...

Rewriting policy with Blackberry phone.

Re: CITRIX Xendesktop with IVE

CITRIX Xendesktop with IVE

Custom Radius Rules with FreeRadius

Re: Users have been accessing to the INTERNET thro...

Re: Users have been accessing to the INTERNET thro...

Re: Users have been accessing to the INTERNET thro...

Re: Users have been accessing to the INTERNET thro...

Users have been accessing to the INTERNET through ...

Custom sign-in page with 2 factor authentication.

Moving Previous Page of WEB REWRITTING

Re: Direct connect webpage by typing URL

Re: Direct connect webpage by typing URL

Re: Direct connect webpage by typing URL

Direct connect webpage by typing URL

Assigning ip address issue.

NC Service disconnected when XML is imported.