The JTAC engineers I've dealt with so far have not specifically recommended replacing certs. I plan on doing so once I have safe working code. The last section of kb29004 does mention certificate replacement.   The HC disconnects I observed were all in the range of 10-20 minutes after initial connection. Our config uses ESP and in this scenario, HC establishes a separate SSL connection at login. With 7.4R5, a healthy system has one ESP connection and one SSL connection established for the duration. Testing more to see if this is different in 7.4R9.1. ... View more

Anyone else seeing HC timeouts with the new 7.4R9.1 code?   Our HC runs every 10 mins and after upgrading from 7.4R5 to 7.4R9.1 I am getting HC timeouts on a Win7 and MacOS  Pulse clients.   Since HC is done over SSL I'm wondering if this new code's fix of disabling heartbeat extensions is impacting it. ... View more

I've done it before and it works with a few caveats. The filtering is configured under: User Roles, <role name>, General, Restrictions, Browser.   Your example user-agent strings don't look correct. EAS user-agents strings are different from device type or browser user-agents. For iPhone, the EAS user-agent will be something like "Apple-iPhone/703.144". If you wanted to allow all iPhones regardless of iOS version allowing "Apple-iPhone*" would work. Apple is pretty straightforward. Android EAS lacks standardization and will be a lot more work. Using TouchDown will make your life much easier for filtering.   Microsoft updated the EAS spec in Exchange2010 and it allows devices to stop sending the user-agent in the HTTP header after the initial connection setup. Even though this goes against HTTP RFC recommendations, Microsoft chose to make this change to reduce bandwidth consumption. To accomodate Windows devices that use this new EAS spec, I changed my user-agent filtering from a whitelist to a greylist where I denied some strings and allowed others.   The final caveat is that user-agent can be changed on some devices. I believe there are Android apps/hacks that allow the user to change user-agent.   ... View more

Was this ever resolved? ... View more

Have you tried unchecking Allow ActiveSync Traffic Only on the sign-in policy? ... View more

Ended up moving to 7.4R9.2 and still having issues with Pulse dropping on HC timeouts. After my initial 7.4R9.1 testing, I was unable to reproduce it. Tested more with 7.4R9.2 and didn't have any problems. Figured it was an anonomally and went ahead and deployed 7.4R9.2. Now have atleast 5 Pulse users reporting this disconnection behavior. Some have been resolved with reboots others have not. So far only afflicts Pulse. NC seems unphased. ... View more