- Pulse Secure Community
- :
- About NetworkBod
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
since
02-18-2021
08-18-2022
NetworkBod
Contributor
35
Posts
23
Kudos
4
Solutions
08-16-2022
09:26:AM
Hi Everyone, we've probably all had it when a user contacts the service desk from a hotel etc stating they cannot connect to the Wifi as Captive portal / splash page is failing to display within the 'Pulse Hotspot authenticator' to complete the connection. Im just interested in other people's view on resolving this to make it a better experience for the user yet maintaining device security. In my instance the Pulse Client is in lockdown mode but we also have Windows Firewall blocking most connections in/outbound which will be preventing Pulse from showing the Captive Portal. The only way i can think of to completely resolve is to open the Windows Firewall Outbound rules further, as the Pulse Client will lock down the connection anyway and only allow the necessary traffic to show the Captive portal correctly. Yet i doubt this will be sanctioned from our security team. There must be a way, anybody got any advise on this or any nifty Windows Firewall rules to allow captive portal to show but again maintain security. Thanks.
... View more
08-12-2022
08:35:AM
1 Kudo
Out of interest what Pulse/Ivanti Client version are you using on your devices? I ask as i have a problem with a different AV failing host checker on older clients for example 9.1.13 but on the new 22.2 Client host checker passes fine. Im holding off using the newer ESAP versions until we have pushed out the latest client to all users.
... View more
08-12-2022
04:25:AM
Hi, Im just about to change the Device certificate for the 'internal port' and thought ahh when i remove the internal port from the current certificate and click save, will i lose access to the GUI as in theory no cert will be assigned to the internal port? Or is this safe to do so i can then allocate internal port to the new cert? Path to setting - System>Configuration>Certificates>Device Certificates If a Pulse Rep could confirm thanks.
... View more
08-10-2022
08:56:AM
2 Kudos
@C_J Sorry i replied earlier but it failed to post.. its a typical ISP response really. I would ask for it to be further investigated, need to keep escalating till it gets to an Engineer who can properly diagnose the problem. I have a few users on Three UK who are not changing IP and still getting disconnected from our Pulse Secure VPN every few mins. I've had it in the past whereby ISPs only allow full VPN functionality for Business Accounts only. But with a lot more working from home then i guess this policy changed for most ISPs. Something to try but maybe not a true test as your Pulse connection maybe using different VPN protocols but to possibly rule out the Pulse/Ivanti connection you could always install an alternate Free VPN (e.g Windscribe) on a personal device and test if you get similar disconnects. This would definitely point the problem to something on the 'Three' network using VPNs.
... View more
08-08-2022
02:35:AM
1 Kudo
@C_J Hi, 'Three UK' users on my network are also experiecing this problem, looking at the logs sometimes the IP is changing frequently and at other times the connection just drops then reconnects every few minutes. I have over 1500 users connecting via Pulse using various ISPs including other 4/5G ISPs and the problem is only effecting the handful of users who use 'Three UK' network. I have advised them to contact Three support as im pretty sure its 'something' on the Three side thats causing the problem. Still waiting to hear back from them. Did you also raise with Three Support? interested in their response.
... View more
08-01-2022
03:29:AM
Hi, could a Pulse rep help with my query as below. I've been waiting for client r9.1R16 to be released but just read KB45301 and it seems that after R9.1r15 it goes to the Ivanti Client 22.2r1, could you confirm this is correct? and is this Client compatible with Connect Secure r9.1R16? Its getting confusing with the Pulse/Ivanti versions crossovers. https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB45301 Thanks.
... View more
06-17-2022
05:43:AM
1 Kudo
FYI - Pulse have released KB45235 to address this certificate validity problem, the KB states the 'Trusted Server CA Shows incorrect validity for EE Certification Centre Root CA' but it can effect other certificates. Its cosmetic only and will be resolved in a later release. thanks.https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB45235/?kA13Z000000X0I4
... View more
05-27-2022
02:18:PM
1 Kudo
@zanyterpThanks zanyterp, I've raised a case and support are investigating. Definitely an odd one, the cert checks out all ok using OpenSSL which validates the end date in 2119 all ok. The cert also looks correct within Pulse, it just seems to be the "Certificate Validity Check" within Pulse which is calculating the incorrect end date. Could it be the validity checker is effected by the 2038 Unix time formatting bug. Hopefully support will get to the bottom of it. Cheers
... View more
05-25-2022
03:42:AM
1 Kudo
Hi, I've noticed a 'Trusted Client CA' Certificate has a warning in the log stating "Certificate 'XXXXX' is about to expire within next 60 days" but if I check the certificate the end date is years away 2114. If I run the certificate validity checker it says it will expire end of next month. This cert is for authentication so important to understand why the date is not as per the end date on the cert? It was around this time last year when I imported this CA cert so could it be the trusted client CA certs have a max 1 year validity irrespective of what is on the actual cert. :/ I always find dealing with Certificates is a 'Dark Art' so if anyone has seen this before be useful to know, Cheers.
... View more
05-18-2022
01:36:AM
2 Kudos
@cgoodw1 Hi.. I recently updated to 9.1R15, just checked our logs and can confirm that AUT24326 are still present. Do you have any filters applied on the log? Thanks.
... View more
05-12-2022
04:21:AM
1 Kudo
@zanyterp Hi, Yeah i had just updated to 9.1R15 tested access and all ok, then updated ESAP to 3.9.9 which is when Crowdstrike started to fail compliance. Rolled back to our previous version ESAP 3.9.5 and that works fine. Your support have pended the case as want logs etc but difficult for me to obtain as other work going on so i wont be able to reenable 3.9.9 to test futher for a couple weeks. Be useful to know if anyone else in the community here is using Crowdstrike and have had the same issue with ESAP 3.9.9 or not. Thanks.
... View more
05-11-2022
02:04:AM
1 Kudo
Just a note incase anyone else uses Crowdstrike, i attempted to update to ESAP 3.9.9 and compliance started to fail stating "Crowdstrike Falcon 6.37.15103.0 does not comply with Policy. Compliance requires real time protection enabled." even though Crowdstrike was running locally all ok. I rolled back to 3.9.5 to fix. I also had to uninstall / reinstall the Pulse client from my test laptop as i presume ESAP 3.9.9 updated something locally. I've raised a case so hopefully sorted in next release. thanks.
... View more
04-19-2022
04:19:AM
1 Kudo
Thanks SuperG, after investigating it was exactly how you describe, i also found that our Group Policy was also blocking the connection so had to add www.msftconnecttest.com endpoints to allowed list in the Windows Firewall Group policy settings. Hopefully thats sorted most, but as you say as each captive portal is configured differently so impossible to troubleshoot all. Cheers.
... View more
03-31-2022
06:45:AM
1 Kudo
@zanyterp Hi It seems to be the Pulse Captive Portal detection thats causing the problem, when this is turned off it connects to the Wifi in question all ok. When captive portal detection is enabled a wireshark capture shows the lookup to www.msftconnecttest.com and is resolved, but Pulse displays the 'cannot reach page' within its embedded browser. Im on client 9.13 so will retest on latest 9.14 before logging a case.
... View more
03-29-2022
06:06:AM
1 Kudo
@zanyterp Hi. Just been testing this morning, at first i thought it was something in the lockdown exceptions so i removed these and set lockdown exception to 'false', retried and problem persisted. I then turned off the captive portal option within the Pulse Client config and it connects to the Wifi in question all ok. Its just a Free Wifi open connection within a local establishment which has some T&C's to accept to get online. It is odd how when Pulse captive portal option is turned off the device just connects straight through to the connection without having to accept the T&C's but Pulse is not involved at this stage so must be a Microsoft thing. We're curently using Pulse Desktop Client v9.1.13 (11723). Think its worth retrying with the latest client before raising a case? i havent checked the release notes yet so unsure if this is an issue thats already resolved. Thanks.
... View more
03-28-2022
03:55:AM
1 Kudo
Hi Everyone, On some Wifi connections that use captive portal the Pulse Secure 'Hotspot authentication' page appears but states 'cannot reach this page' when trying to access http://www.msftconnecttest.com, and Wifi fails to complete connection. Lockdown mode is enabled so will i need to create a rule to allow this address so connection can complete? Just to note this only happens on some captive portals others connect through fine.
... View more
03-21-2022
05:13:AM
1 Kudo
@zanyterp i ended up just adding LDAP as secondary auth server, works all ok now Thanks.
... View more
03-21-2022
05:07:AM
1 Kudo
@zanyterp Hi, yes i did raise a case and was passed to your Dev team to resolve in a future release. Thanks.
... View more
02-25-2022
09:56:AM
1 Kudo
Hi, my user authentication is done using certificate authentication via cert server, have just noticed that because of this its not displaying if a users password is about to expire. Previously we used LDAP server and when this is set as a auth server within the realm you get an option to 'enable password management' to display password expiry. Anyone know if its possible to get the password expiry to show for a user when not using LDAP auth server? as im currently only using LDAP for directory/attributes so i dont get the 'password' options within the realm. Thanks.
... View more
02-23-2022
08:58:AM
Has anyone came across info message NWC30706 in the user logs before? Its not causing any problem but im interested in finding out why its happening from a security point of view. It seems to occur periodically on both our IVE's which have different ISP's. IP within the log usually trace back to a Internet Web scanner, our security team confirm the IP's are opportunistically scanning the internet and is not a risk to organization, from our FW logs it does look like they are scanning port 4500 on the external interface of IVE. The message in the log displays a random user session 'i believe' so be good to know why a web scan of the ext port is generating the log message as below associated to a current user session :O. Example of log message as below. Info NWC30706 2022-02-22 12:58:31 - ive - [users private IP here x.x.x.x] [email protected](REALM)[ROLE] - Realm mapping error for remote (unknown external IP here - x.x.x.x) port ext Thanks.
... View more
01-10-2022
07:55:AM
Hi Everyone, Currently on Opswat V3 here and eager to update to V4 slightly hestitant as we still have a handful of Win7 devices (sigh), noticed in the latest ESAP release notes for Opswat v4 that only Windows Firewall V6 and V10 are supported but one of our current Win7 policies uses Windows Firewall v7 detection/remediation. Is anyone here using Opswat V4 and able to create a Win7 policy for its firewall detection / remediation? If not is there a custom process i could monitor, I have found the service name which looks to be mpssvc unsure if there is a specific process i can monitor for this :/. Thanks.
... View more
12-23-2021
07:59:AM
1 Kudo
[email protected] Ah sorry just realised the Rewriting filter is in a different section to the web rewrite policy. There is no rewrite filter, so i'll log with support to assist. Thanks again.
... View more
12-23-2021
07:53:AM
[email protected] Hi... just checked and there is a rewrite policy, i believe its the standard rewrite policy (Initial Rewrite Policy) which is set to 'Rewrite content (auto-detect content type)' and is applied to all roles and all resources (*.*). Do you think this needs amended? or will i just log with suport to assist further? Thanks for your help on this, cheers
... View more
12-20-2021
02:02:AM
1 Kudo
[email protected] Hi, we're currently on 9.1R13, yes the blank page appears just after login to login.microsoftonline.com. As you suggested i tried IE and it worked, although a banner appears stating IE is not supported and i'll be logged out. Do you think 9.1R13.1 fixes this? i checked the release notes and can only see HTML5 SSH fixed issues. Thanks.
... View more
12-18-2021
02:41:AM
1 Kudo
Many thanks for your response, I'll certainly look into the SAML method. At the moment I'm struggling to get the office365 landing page to display. I created a web resource profile heading to the office365 login page which displays fine but upon login just a blank white page appears. Does the resource profile for this require any special settings such as compression or anything else? There's no errors in the logs and the web requests look fine but it's struggling to display the page for some reason. Many thanks.
... View more
12-08-2021
08:59:AM
Hi all, just after some advise on the correct way to setup accessing office365 apps (Outlook etc) via web app link (resource profile) within Pulse with SSO (Azure AD) if possible. Anyone done this before? thanks
... View more
11-03-2021
06:09:AM
Hi Everyone, Currently testing Pulse in 'Machine then User' setup using certificate auth. Its working all ok but noticed a couple of oddities in the user log. Such as user 'system' attempting to connect instead of the current user thats just logged in, then a few seconds later the the correct users details are passed through and connection is established, and Host checker failing but then immediately passing a second later. I think Pulse is just a bit quick off the mark when other system services etc are still starting, is it possible to delay the Pulse Service / Program autostart by a few seconds to see if it fixes this? Would it be the Service i need to delay? or the Pulse application? Thanks.
... View more
08-05-2021
04:26:AM
Hi Everyone, Currently setting up a Machine then User connection, i want machine connections to get an IP from a different range to the user connection. I use Windows 2016 DHCP servers which now has support for the DHCP option 118 'i think'. So im just wondering is it best to create a Virtual VLAN within Pulse or use option 118 to achieve what i want? Thanks.
... View more
07-13-2021
05:47:AM
Hi all, Im currently looking into setting up certicate authentication for Windows hello for Business users - i have setup cert server and imported Trusted Client CA root cert (without keys) to Pulse, and created new realm etc which all works, but few questions as below.. When Devices connect through is there any handshake as part of the Certificate authentication process? to me it just looks like Pulse checks that there is a valid CA cert present and makes sure the cert is not revoked via CRL/OCSP if enabled. Im trying to assess the security implications of this, if someone (i.e. an attacker) was able to export or get hold of the client cert on a device then install to another non work laptop id presume Pulse would still accept it with or without the keys. Does anyone have best pratice guides on this? I'd think making sure certificate and keys are non-exportable and also storing cert in TPM is a must. We do use other security measures such as Host checker so mainly want advice on securing certificate authentication. Thanks.
... View more
06-25-2021
07:37:AM
Hi Everyone, Im wanting to create a new connection in a 'Machine or User' setup using certificates. Currently i have 2x certificates in the machine store from my CA which are pretty much identical so in testing Pulse Desktop client always asks to select which cert to use and i guess will cause the machine auth to fail as it wont know which cert to use, within the Pulse Secure connection settings under 'certificate matching' i can see 'custom enhanced key usage OID / Text' but this doesnt help me as both are the same in each cert. Is it possible to use other Certificate attributes for matching? as in my case i could use Subject CN, OU etc which is different. Many thanks.
... View more
Latest Tags
No tags yet
© 2017 Pulse Secure, LLC. Use of this website assumes acceptance of our Legal Notices and Privacy Policy.
Pulse Secure has updated its Privacy Policy effective June 28, 2017.
