Thanks Jay, it look working fine. ... View more

Both desktop and iphone doesn't work until I changed the Resource address to IP instead of alias under Autopolicy:SSO Any way I can use alias but not ip address ? Attached the screen shot for your ref. Thanks ... View more

Hi Jai, Attached the log we tested. Thanks ... View more

Hi, the following is the user log: thanks, lawpak Info AUT22886 2012-06-22 11:20:20 - XXXXX-SA-01 - [10.0.0.1] DOMAIN\kat.law(Domain Users)[IT Support, Domain Users, Open Asset, GlobalPilot, Project Images, CRM] - Session timed out for DOMAIN\kat.law/Domain Users (session:00000000) due to inactivity (last access at 11:04:23 2012/06/22). Idle session identified during routine system scan. Info WEB20174 2012-06-22 11:04:39 - XXXXX-SA-01 - [10.0.0.1] DOMAIN\kat.law(Domain Users)[IT Support, Domain Users, Open Asset, GlobalPilot, Project Images, CRM] - WebRequest completed, GET to http://crm:5555//domainCRMProdEnv/m from 192.168.101.216 result=401 sent=31 received=0 in 0 seconds Minor ERR24617 2012-06-22 11:04:39 - XXXXX-SA-01 - [10.0.0.1] DOMAIN\kat.law(Domain Users)[IT Support, Domain Users, Open Asset, GlobalPilot, Project Images, CRM] - Fetch Kerberos TGS for user kat.law, TGT user kat.law, realm HK.domain.COM, host crm failed: Fetch TGS fetch error: Server not found in Kerberos database Minor ERR24617 2012-06-22 11:04:39 - XXXXX-SA-01 - [10.0.0.1] DOMAIN\kat.law(Domain Users)[IT Support, Domain Users, Open Asset, GlobalPilot, Project Images, CRM] - Fetch Kerberos TGS for user kat.law, TGT user kat.law, realm HK.domain.COM, host crm.hk.domain.com failed: Fetch TGS fetch error: Server not found in Kerberos database Info WEB20169 2012-06-22 11:04:39 - XXXXX-SA-01 - [10.0.0.1] DOMAIN\kat.law(Domain Users)[IT Support, Domain Users, Open Asset, GlobalPilot, Project Images, CRM] - WebRequest ok : Host: crm, Request: GET /domainCRMProdEnv/m HTTP/1.1 Info WEB24618 2012-06-22 11:04:39 - XXXXX-SA-01 - [10.0.0.1] DOMAIN\kat.law(Domain Users)[IT Support, Domain Users, Open Asset, GlobalPilot, Project Images, CRM] - Web SSO: Fetched Kerberos TGT Ticket Client: [email protected], Server: krbtgt/[email protected], auth 06/22/12 11:04:39, start 06/22/12 11:04:39, end 06/22/12 21:04:39, renew 01/01/70 07:00:00, current 06/22/12 11:04:39 Info WEB20174 2012-06-22 11:04:28 - XXXXX-SA-01 - [10.0.0.1] DOMAIN\kat.law(Domain Users)[IT Support, Domain Users, Open Asset, GlobalPilot, Project Images, CRM] - WebRequest completed, GET to http://crm:5555//domainCRMProdEnv/m from 192.168.101.216 result=401 sent=31 received=0 in 0 seconds Info WEB20169 2012-06-22 11:04:28 - XXXXX-SA-01 - [10.0.0.1] DOMAIN\kat.law(Domain Users)[IT Support, Domain Users, Open Asset, GlobalPilot, Project Images, CRM] - WebRequest ok : Host: crm, Request: GET /domainCRMProdEnv/m HTTP/1.1 Info AUT22670 2012-06-22 11:04:23 - XXXXX-SA-01 - [10.0.0.1] DOMAIN\kat.law(Domain Users)[IT Support, Domain Users, Open Asset, GlobalPilot, Project Images, CRM] - Login succeeded for DOMAIN\kat.law/Domain Users (session:00000000) from 10.0.0.1. Info AUT24326 2012-06-22 11:04:22 - XXXXX-SA-01 - [10.0.0.1] DOMAIN\kat.law(Domain Users)[] - Primary authentication successful for DOMAIN\kat.law/Domain AD from 10.0.0.1 Info AUT22673 2012-06-22 11:04:10 - XXXXX-SA-01 - [10.0.0.1] DOMAIN\kat.law(Domain Users)[IT Support, Domain Users, Open Asset, GlobalPilot, Project Images, CRM] - Logout from 10.0.0.1 (session:00000000) ... View more

HI Zanyterp, No, actually, there is no any binding for the web site, and it is working fine under our internal network but sslvpn. I have tested after added the delegated host to the web stie, but it is failure, it kept prompt me enter the id and password. regards, lawpak ... View more

our DC is windows 2003 and AD version is 2003 as well. regards, lawpak ... View more

Hi Kannan, I tried the command "setspn -x" on my DCs, but the result look like there is no "-x" option, the result is listed on below: (My AD version is 2003) And i have tested it without SSO also, it still keeps prompt me to input login ID and password. regards, lawpak ------------------------------------- setspn -x Usage: setspn [switches data] computername Where "computername" can be the name or domain\name Switches: -R = reset HOST ServicePrincipalName Usage: setspn -R computername -A = add arbitrary SPN Usage: setspn -A SPN computername -D = delete arbitrary SPN Usage: setspn -D SPN computername -L = list registered SPNs Usage: setspn [-L] computername Examples: setspn -R daserver1 It will register SPN "HOST/daserver1" and "HOST/{DNS of daserver1}" setspn -A http/daserver daserver1 It will register SPN "http/daserver" for computer "daserver1" setspn -D http/daserver daserver1 It will delete SPN "http/daserver" for computer "daserver1" ------------------------------------- ... View more

I find a minor ERR24617 2012-06-21 14:47:37 - XXXXX-SA-01 - [202.XX.XX.XX] XXXXXXX\kat.law(XXXXX Users)[IT Support, Domain Users, Open Asset, GlobalPilot, Project Images, CRM] - Fetch Kerberos TGS for user kat.law, TGT user kat.law, realm HK.XXXXX.COM, host crm_vpn.hk.aedas.com failed: Fetch TGS fetch error: Server not found in Kerberos database Does it related? regards, Lawpak_ ... View more

Yes, I stayed at same environment, if it points to either one of the host, it is working fine. And it is working fine as well then without SSLVPN. How to check the user log, as i'm just a beginner of SA. Yes, I applied SSO already. how I start to troubleshoot? Regards, Lawpak ... View more

I was busy recently, so i don't do any test on it, I collected more information and create another post https://forums.pulsesecure.net/topic/pulse-connect-secure/148296-sa-with-nlb this one can be closed. thanks, lawpak ... View more