We had a similar issue and the cause was the way the SAML server (Ping Identity) output the XML in the SAML assertion. It was sending AttributeValues that were NULL and sent them like below. This caused the IVE to generate an error in the event log. I suggest you open an case with JTAC and get the contents of the SAML assertions that are being sent from your SAML server if you can. <saml:AttributeValue/> ... View more

We have a handful of users who are having problems on WiMax connections such as Clearwire. I'd be curious to know if anyone else has seen this. jkopko - You might want to see if the user gets dropped packets with SSL transport mode instead of ESP. I agree with the others to look at the user's home router as well. ... View more

This feature is not available now but it will be in a future release now which is now in the beta testing phase. ... View more

It sounds like client cert issues to me. This will happen when there is a problem establishing the SSL client certificate authentication between the browser and the server. Some common causes are: the cert is expired the user enters the wrong PIN/password to unlock the keystore (applies to smart cards) IE thinks the cert is present, but it is not. I have seen this with smart cards when the card is not in the reader Issues with the card reader software or the reader itself I would look at the user's certs in IE. Make sure the proper CA certs are in the browser too. ... View more

What type of authentication are you using? This is a common problem for certificate based logins. ... View more

We have seen this problem a lot with OpenDNS. Luckily you can turn off the DNS hijacking in OpenDNS by disabling Typo correction I just worked with a user where his ISP was using OpenDNS for their DNS servers. I believe you can opt-out of Comcast's "Domain Helper" service. http://blog.comcast.com/2009/08/domain-helper-national-rollout-begins.html ... View more

Theodore, We had the exact same issue. Bookmarks from Resource Profiles would disappear from Roles. I opened a case with JTAC and they said it was due to some dangling references in configuration. I had to send them my user.cfg and they fixed it the broken references. I can't say if it has fixed the problem yet when we add more Resource Profiles, but the old Bookmarks that were lost have been put back into the Roles. As for 6.4R3 we jsut upgraded our lab environment to this version and it seems stable. No issues as of yet. We had lots of problems with 6.5R1 and Network Connect. ... View more

We had a small group of users test Network Connect 6.5 and 2 people said they were prompted to reboot their PC after NC installed. Then were asked to reboot again after rebooting the 1st time. I have never seen any reboot requirements before with NC. Has anyone else? We do not have GINA or TOS Bit enabled. Also there is a new prompt that comes up asking you if you want to run the file neoNCSetup.exe. You can choose Always, Yes, or No. Not sure why Juniper added this. Seems to just confuse the end user even more. Message Edited by drf on 09-16-2009 01:59 PM ... View more

We are not using host checker. Basically we want to be able to upgrade the server OS and have absolutely no affect to the client components i.e. no NC auto upgrade. We want to push the NC version out using our own deployment tools. Our Desktop organization has strict rules on this. ... View more

I have seen this same issue with Firefox on 6.4R1. I assumed it was a bug. Since we are going to use 6.5 which has the option to preserve the client proxy settings I decided not to pursue it any further. The changing of the proxy pac to instantproxy.pac has caused us too many problems. ... View more

The only thing I have heard is that they are working on some new client. They need to remove the requirement that the server and client have the same version. We have areas in the company that go into a freeze and cannot do any software updates. We need to have a way to control the distribution of the client independent of the server version. I guess we will have to submit an enhancement request. Message Edited by drf on 09-16-2009 12:52 PM ... View more

Yes just add additional domains separated by a comma. You should remove 192.168.84.180. That is not a DNS domain. sample.com, na.sample.com, eu.sample.com, ......... ... View more

We would also like to see SAML 2.0 support. However last time we spoke with a SSLVPN product manager he said they have no demand for it and would like to see a business case on why SAML 1.1 will not work. This was last year. I guess if enough customers ask for it, they will think about it. If they claim to support SAML, don't you think they would keep current with the standands?? ... View more

We had some users with the same problem. Here was the fix given by Sprint. I have not tested it myself In Smartview, go to the Tools->Settings Menu and look for Rules EngineÓ. If you donÕt see that tab, close the app and reopen it again as many times as necessary. In that tab, uncheck the first box Use Rules EngineÓ. The issue is that the air card software thinks NC is a new connection as if you plugged in an Ethernet cable so it thinks another Internet connection exists. ... View more

In the Role go to General - UI Options. Change the Start Page to Custom page and set it to the URL that you want. The IVE will take the user to this page after login and rewrite the page. Make sure there are no "Don't Rewrite" rules for that URL ... View more

I think we have fixed it now. It was a configuration problem with our persistence (sticky) settings with is based on source IP address. I'll have to run some more tests to make sure. ... View more

Hey did you ever resolve this? We are having a similar problem with our F5 BigIP. NC always uses SSL instead of ESP. Without the load balancer it works fine with ESP. ... View more

You can write a script to parse the user access logs and pull out the information that you want. Either use syslog or FTP archive to another server where you would run the script. We actually use syslog to send the logs to a NetIQ system that does all the metrics/reporting. ... View more

I am guessing that you mean the homepage where the user gets his bookmarks and browsing capabilities. I do not believe this is possible. You can only do the customization that Juniper provides through the admin console such as changing the colors and logo. ... View more

I believe it is supported in 6.4R1. I had a user test it and he said it worked. I have not tried it myself. ... View more

Can you change SecondaryLoginPage.thtml and implement a custom error code for 1002? Since it is in the SecondaryLoginPage.thtml then you know it came from the secondary authentication server. <% IF LoginPageErrorMessage %> <% IF LoginPageErrorCode == 1002 %> ERROR MESSAGE GOES HERE <% END %> <% END %> ... View more

The steps are in the Administration Guide http://www.juniper.net/techpubs/software/ive/6.x/6.3/ ... View more

I haven't fully tested this one yet, however a few advanced TAC engineers have advised me not to install an R1 release and to wait for R2 or R3 where they fix the bugs from R1. I can say form personal experience the R1 releases have been unstable. I did test the new Credential Provider with smart cards in beta and it did not work. ... View more

As far as I know Network Connect can only restrict access based on IP and Port ... View more

Try this in your custom sign-in page. Use a CSS style <input type="text" name="username" id="username" style="width: 150px" maxlength="100" autocomplete="off"/> <input type="password" name="password" id="password" style="width: 150px" maxlength="100" autocomplete="off"/> ... View more

Instead of disabling the sign-in URL you can set the only Auth Realm to an Anonymous realm which uses an Anonymous Auth Server. Then have no role mappings. Then the user would see the message: "You are not allowed to sign in. Please contact your administrator." You can also change the Instructions on a new sign-in page to say this login page has been disabled Or you can map the anonymous user to a role that has no access and just displays a greeting message that this login page has been disable. Or maybe you can set that role to auto redirect to another login URL (/noservice) using a custom start page url. You would have to set a Don't Rewrite rule so it goes direct. But if you want a customized "page disabled" page with a redirect then I think custom sign-in pages is the way to go. ... View more

There is a cookie that saves the last sign in URL. If the users clear their cookies does that help? It should redirect them to the default sign in page if no cookie exists. ... View more

Do you mean different sign-in URLs or different URLs displayed after they login to the Role? ... View more

You can use the Template Toolkit in the Custom Sign-In pages. The sign-in pages guide says that the USE directive is not supported but I found that it does work. In your custom page add this code <% USE CGI %> <% CGI.remote_host() %> ... View more