About ldarby

ldarby · ‎06-25-2021

Let me tell you, even as an employee of Pulse/Ivanti I have been unable to raise a feature request for the desktop client, which would improve the load balancing situation with many PCSs, i.e. it would benefit a lot of customers. Feature requests may only be raised by account managers and they'll only do it if the lack of the feature is a direct threat to their commision.

ldarby · ‎06-25-2021

Hi jlmickens, As SFTP is just the SSH protocol then the protocol you need in vTM is Generic Server First. Regards, Laurence

ldarby · ‎06-03-2021

Hi Steve, It's not really clear to me what you want to do - do you want URLs matching one pattern to go to one set of servers (pool), and URLs matching another pattern to go to a different pool? You can do that with TrafficScript (or just RuleBuilder which is a GUI for TrafficScript). If it's not what you want to do, TrafficScript can probably still do it. Please see the TrafficScript Guide at at https://www-prev.pulsesecure.net/techpubs/Pulse-vADC-Solutions/Pulse-Virtual-Traffic-Manager, and https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB44677. Also please upgrade ASAP as 18.3 is vulnerable to this: https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44790/ Regards, Laurence

ldarby · ‎05-26-2021

Thanks thebr for finding the answer already, note there is public version of that url which is https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB43942.

ldarby · ‎05-18-2021

Hi luissoal, Yes you'll need to do a new install, per condition 4 on https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB44475, which links to https://community.pulsesecure.net/t5/Pulse-Secure-vADC/Upgrading-and-reinstalling-Traffic-Manager-Virtual-Appliances/ta-p/32981 for how to do it. Also please upgrade to the latest 21.1 now, not 20.3, because of https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44790 If the IP addresses stay the same then you can use the same licenses, which are in the backup file, otherwise you can raise a support case to have the licenses re-hosted to a new IP. Note that there's a known issue with importing backups from versions before 17.2, which is that the network interfaces have changed names. To make the import work smoothly you can manually extract the backup tar and edit the files conf/zxtms/hostnames, change the interface names to match the new machines, then re-tar up the backup file. (Upgrading in place works because the upgrade process can see the rename happen, but importing the backup can't tell what the mapping from the old names to the current names is). If you need further assistance with this and if you have an active support contract then please open a support case. Regards, Laurence

ldarby · ‎03-23-2021

Hi lvfranz, If you're using the Virtual Appliance, and if you have a support contract then you could raise an RFE for this functionality. Note that vTM already has a similar feature, if NAT is enabled then it adds these iptables rules: Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 ACCEPT all -- * ens4 0.0.0.0/0 0.0.0.0/0 state NEW 0 0 ACCEPT all -- ens3 * 0.0.0.0/0 0.0.0.0/0 state NEW 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 2/min burst 5 LOG flags 0 level 5 prefix "NAT forbidden: " 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 If you're using the software version of vTM instead, then this doesn't manage iptables rules (except for the ip transparency rules), that's up to the admin, so you could have any iptables setup with that. Regards, Laurence

ldarby · ‎03-01-2021

Hi tenajsystems, As of vTM 20.1 the control cert can be a cert chain, not just a self-signed cert. Updating the cert for now is a manual process, which is to manually replace the cert/key files and edit the config in conf/zxtms/hostname with a text editor. (Note the cluster config needs to be manually sync after editting anything in conf). There is open RFE-1453 to automate this process. If you need further assistance with this, and have a support contract, then please open a support case with us. Regards, Laurence

ldarby · ‎03-01-2021

Hi sernafa, The error message is saying the backend server is responding with a header such as this: HTTP/1.1 200 Ok Content-Length: 0, 0 https://tools.ietf.org/html/rfc7230#section-3.3.2 says this: If a message is received that has multiple Content-Length header fields with field-values consisting of the same decimal value, or a single Content-Length header field with a field value containing a list of identical decimal values (e.g., "Content-Length: 42, 42"), indicating that duplicate Content-Length header fields have been generated or combined by an upstream message processor, then the recipient MUST either reject the message as invalid or replace the duplicated field-values with a single valid Content-Length field containing that decimal value prior to determining the message body length or forwarding the message. Here, vTM's implementation behaviour is to reject the message, which is conformant, but probably isn't useful for you. A possible workaround might be turn off vTMs HTTP handling by changing the VS protocol to Generic Client First. If you have a support contract please raise a support case for further assistance, and if necessary to raise a bug with Eng to get the behaviour changed. Regards, Laurence

ldarby · ‎03-01-2021

Hello, Multiple traffic IPs in Azure aren't currently supported, we have an RFE for this, RFE-1199. According to the internal notes on that RFE, it's possible to get have multple TIPs, with a software install of vTM in Azure (which I believe but haven't confirmed doesn't have that "All traffic managers are running inside Azure" message) and also some custom scripting, that calls these two commands appropriately on failover: Remove any existing mapping: `az network nic ip-config delete --resource-group <group> --nic-name <nic> --name <TIP-name>` Add mapping to correct vTM: `az network nic ip-config create --resource-group <group> --nic-name <name> --name <TIP name> --private-ip-address <ip>` If you're a customer who needs this, please follow up with your account manager, both for registering your interest in the RFE and for prof-serv time for delivery of the script. (the script is written already, but looks like it needs testing, and I don't have approval to post it here). (Edit: I see you opened a support case for this already before I responded here, apologies. The above still applies for any other customers wanting this though) Regards, Laurence

ldarby · ‎02-01-2021

Hi Brother_Fox, Apologies for the lack of response here. If you haven't already found out, the way to do this is configure the ldap authenticator in Catalogs > Authenticators (and not System > Users > Authenticators). Then you can use the auth.query() function to query it with the user/password (and see the auth.query() docs for an example with HTTP), then probably connection.close("...") with the right SMTP syntax to reject connections. This article might be helpful in extracting the user/password from SMTP traffic: https://community.pulsesecure.net/t5/Pulse-Secure-vADC/HowTo-Inspect-and-synchronize-SMTP/ta-p/29185. If you need further assitance writing the Trafficscript then Pulse Secure can help but this would be under a professional services engagment, please see https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB44677. Regards, Laurence

ldarby · ‎02-01-2021

Hi jda, You would need to use a custom health monitor for this. Here is a script one of my colleagues already wrote: #!/bin/bash export $(echo "[email protected]" | sed -rn 's/--([a-z_]+=[^ ]+)/\1/gp;') exec curl -sS -D - http://$node:$port$path | head -1 | grep -q '^HTTP/1\.. [234]..' This uses curl with the pool's node name, which should send the appropriate Host header. Regards, Laurence

ldarby · ‎01-29-2021

Also I just want to note that the deployment guide referenced above is a little out of date, vTM now has the 'Load-balance Pulse Connect Secure' wizard that automates most of the vTM setup steps (which aren't specific to vTM + PCS in Azure).

ldarby · ‎01-29-2021

Hi doppeli, Pulse vTM is not mandatory for HA with PCS on Azure, it's just Pulse Secure's LB that we have tested with, support, and sell, so we have not put in any resources in to supporting 3rd party load balancers. If you want to try Azure or other LBs, it probably will work, you would need to set it up and test it to find out. Regards, Laurence

ldarby · ‎03-18-2015

Hi, There will be an announcement in the next 3-6 months for when to start contacting Brocade for SteelApp Support, please see https://supportkb.riverbed.com/support/index?page=content&id=S26154 for further details. Regards, Laurence Darby

ldarby · ‎03-25-2014

It's pretty harmless - it was changed from WARN to INFO in version 9.1. There's basically no impact of increasing trafficscript!array_elements far enough to stop the error happening - when the message happens that's what STM does internally.

Re: How to get connected thorugh command line, whe...

Re: sftp load balancing

Re: Pulse vTM-VA - application load balancing?

Re: Adding non managed VTM to Service Director usi...

Re: Updating very old version to latest Traffic Ma...

Re: ip forwarding rules

Re: Updating Pulse Secure vTM Control Port(9080) C...

Re: Response had invalid Content-Length '0, 0'

Re: Pulse VTM as Azure internal load balancer

Re: Traffic script rule to request a client to Aut...

Re: HTTP monitor on the FQDN name of the node not ...

Re: Set up Pulse Connect Secure on Azure with High...

Re: Set up Pulse Connect Secure on Azure with High...

Re: When should we start using the Brocade Support...

Re: "TrafficScript exceeded the number of pre-allo...