About bally

bally · ‎06-25-2019

Hi Zanyterp, Thanks for coming back to me. That is correct, it appears that the Location Awarness rules are ignorned and the client will attempt to reconnnect despite the huge list of IP addresses that are configured in the configuration file. But sounds like that is something I have to review as does the config look correct to you? In terms of issues, it appears that when in the office, even if you get an IP address of 10.x.x.x the VPN will be active and sends the internet traffic out the internet then backround.

bally · ‎06-25-2019

Hi All, Hoping this will be an easy one :) We are finding that Pulse Secure client will automatically attempt to reconnect after Windows 10 has been put into sleep. For example, user is working from home > sleeps Windows 10 > comes back into the office and the Pulse client will automatically try to reconnect. We have 'whitelisted' all the office IP addreses but this doesn't seem to make a difference. Is there anything missing from the configuration as below? Or anyway I can stop this behaviour as this is causing problems when in the office. schema version { version: "1" } machine settings { version: "27" guid: "xx" connection-source: "preconfig" server-id: "xx" connection-set-owner: "xx" connection-set-name: "xx" connection-set-last-modified: "2019-06-24 11:02:11 UTC" connection-set-download-host: "xx" allow-save: "false" user-connection: "true" lock-down: "false" splashscreen-display: "false" dynamic-trust: "false" dynamic-connection: "true" eap-fragment-size: "1400" captive-portal-detection: "true" enable-browser: "true" FIPSClient: "false" clear-smart-card-pin-cache: "false" block-traffic-on-vpn-disconnect: "false" wireless-suppression: "false" lockdown-exceptions-configured: "false" } ive "xx" { friendly-name: "xx" version: "23" guid: "xx" client-certificate-selection-rule: "AUTO" server-id: "xx" connection-source: "preconfig" factory-default: "true" uri: "xx" connection-policy-override: "true" connection-lock-down: "false" use-for-connect: "true" use-for-secure-meetings: "false" uri-list-use-last-connected: "false" uri-list-randomize: "false" sso-cached-credential: "false" connection-identity: "user" connection-policy: "manual AND ( NOT ip(physical, 10.0.0.0-10.255.255.255 172.16.0.0-172.31.255.255 192.168.1.0-192.168.4.255 192.168.9.0-192.168.15.255 192.168.22.0-192.168.22.255 192.168.33.0-192.168.33.255 192.168.88.0-192.168.88.255 192.168.200.0-192.168.203.255 192.168.205.0-192.168.206.255 192.168.254.0-192.168.254.255))" client-certificate-location-system: "false" reconnect-at-session-timeout: "false" }

bally · ‎05-17-2019

Hi Zanyterp, Managed to get this working! We have to select only x509 as the only accepted for Authentication Class. Windows 10 authentication using either username+password or WHfB would work. But to answer you question incase anyone else needs future help: 1) Yes - Username+Password login to Windows 10 device would work. This would SSO correctly as the per the Pulse document guide. 2) Same as above 3) Error/authentication on the PCS log: Info SML31067 2019-05-13 18:49:39 - ive - [127.0.0.1] Default Network::System()[] - SAML AuthnRequest generation succeeded for SigninUrl:'https://URL', SSO Service URL: 'https://login.microsoftonline.com/xxx/saml2' On the Azure side, barring the error message above, the log would say: Status: Failure Error code: 75011 Failure Reason: Authentication method by which the user authenticated with the service doesn't match requested authentication method. Contact the app owner.

bally · ‎05-16-2019

Hi All, We have intergrated Pulse Connect Secure with Azure AD as per: https://www-prev.pulsesecure.net/download/techpubs/current/1540/pulse-connect-secure/pcs/9.0rx/ps-pcs-sa-9.0R3-Microsoft-Azure-AD-MFA-SAML-IdP-deployment-guide.pdf However, we seem to be having an issue when a user logins into there Windows 10 device using Windows Hello for Business (WHfB). When authenticating the user will get the following error message: <* Sign in Sorry, but we’re having trouble with signing you in. AADSTS75011: Authentication method 'X509, MultiFactor' by which the user authenticated with the service doesn't match requested authentication method 'Password, ProtectedTransport'. *> We have added X509 in the Authn Context Classes but the error remains. Comparision Method for Authentication Classes is set to 'Exact'. Can anyone please advise?

Re: PCS Client reconnection

PCS Client reconnection

Re: Windows Hello for Business + Azure SAML + Wind...

Windows Hello for Business + Azure SAML + Windows ...