- Pulse Secure Community
- :
- About jeronimo
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
since
11-04-2017
04-13-2021
jeronimo
Contributor
20
Posts
3
Kudos
1
Solution
04-13-2021
10:14:AM
1 Kudo
I partly agree. "X is free open source software" is far fetched and potentially applies to everything you buy. Linux is free but many paying solutions use Linux to provide some service. Concerning PSA and Guacamole, essentially you pay to get a nice integration, a GUI and whatnot. This is asking customers to pay again in order to get what finally? Would this "Advanced" license provide 4k resolution or anything else that people have asked for in the past? Or is this trying to get cash back from the fallout of the sloppy Guacamole integration that resulted in bad security incidents? Or did they underestimate the success of their solution and now want to cash that in? Initially, we bought PSA because we wanted an "official" VPN gateway providing a HTML5 RDP client combined with cya (cover your a**): this replaced a self-managed Guacamole install including reverse proxy etc. If it gets hacked, you're done. If PSA gets hacked and you're up-to-date you can blame someone else. The game is always the same. If it weren't for Covid, we wouldn't have renewed this year. Now it's clear, next year we're going back to solution #1 (or another vendor). Bye.
... View more
04-02-2020
03:00:AM
I have found two possibilites neither of which are very sexy. The first is to fiddle out the realm name from Acct-Session-Id ("-userid-(realm)...") The second is to create a separate authentication server for each realm (even if the auth servers do the same thing) and work with NAS-Identifier. Is there another possibility that I am missing? Cisco ASAs for example transmit a simple attribute called "ASA-TunnelGroupName" which includes exactly that. Thanks.
... View more
10-15-2019
07:40:AM
Hey, Currently evaluating Pulse Workspace. Can you confirm or correct me with the following? 1. PulseOne is advertised as needed only when you have several appliances, in order to manage them centrally. However, in order to use PulseWorkspace, PulseOne is required, even if there is only one appliance. 2. PulseOne in the cloud is free (comes with the Workspace license). If you want it on-prem you have to pay? :-\ Furthermore I am wondering what data is shared between PulseSecure Appliance and PulseOne (in the cloud). Honestly I do not feel terribly well with this. Thanks.
... View more
11-29-2018
07:45:AM
When a user does not have a role mapping (i.e. cannot sign in) and the realm is configured with a secondary authentication server, then primary authentication can be successful even though the user will never be able to finally log in. Is it possible to check the role mapping after first authentication and make it artificially fail (if it was successful) since the user will never be able to log in anyway? Thanks.
... View more
03-01-2018
04:22:AM
@Sad Urchinwrote: I used the following in custom expressions, and it worked: certAttr.serialNumber = "02" Request you to please try this and check Yep, no news there :)
... View more
02-28-2018
07:29:AM
Hi, Say I have an internal server at IP 1.2.3.4. I would like to access http://1.2.3.4/path/to/file by connecting externally to PSA using http://psa.example.com/signin-policy-path/path/to/file How do I do this? I tried using the "Custom Page" in the role's UI options but it only works successfully when going to http://psa.example.com/signin-policy-path/ and not when using for example http://psa.example.com/signin-policy-path/path/to/file (Yes, I did select "Also allow access to directories below this url") Thanks.
... View more
12-26-2017
09:01:AM
Tried contacting support about this. I have the feeling they just can't understand what you are telling them, much like every other first-level helpdesk. They provided workarounds like "use the username template" or "use a custom expression". That's not wrong, however I'd really love to know why things are as they are (certificate attribute matching does not work for subject attributes, what's so hard to understand about that?). I gave up. Too bad. (Well, Fortinet is worse.) BTW I don't think it's very professional to ask for the private key of my certificate in order to test in the lab... (ROFL on that one)
... View more
12-04-2017
10:48:AM
Answer to question #2 In order for complete authentication trace to work as expected you have to: * Provide the realm to trace * Provide the IP address in order to see PRE-LOGIN/USERNAME stuff happening (ONLY THAT!) * Provide the username in order to see what happens later If you don't provide a username and ONLY an IP address you will see nothing past login and vice-versa (no IP = no pre-login data, obviously). Answer to question #1 Policy trace shows: No match on rule 'certAttr.certDn.serialNumber = '1030xxxxxxx84'' This should be "certDn.serialNumber" and not "certAttr.certDn.serialNumber". So it appears you can only check attributes within certAttr and not within the subject. Feature or bug?
... View more
12-02-2017
04:24:AM
1 Kudo
Well, if you try to understand how Guacamole and RDP work together, you will find out that in fact the keyboard layout you use on your local machine does not necessarily need to be the one used in the remote session for it to work. What should work most of the time is at least setting the same keyboard layout 1) inside the RDP session 2) in the RDP connection settings in Guacamole/PSA So, no matter what physical keyboard you have installed to access PSA, if you set PSA to English and also add a US keyboard in the remote session, you should be +/- fine and be able to use whatever keyboard you have on your local machine. The only thing is that technically not-so-savvy users will probably not understand this and they also will probably be having a hard time managing multiple keyboard layouts (and switching between them) on the remote machine (depending on whether they currently are physically using that machine or using it via PSA).
... View more
12-01-2017
12:58:PM
1 Kudo
You know, a statement like "it's the limit since the admin guide says so" is completely unacceptable. I don't know why this should be a limit (it's neither a limit of RDP or a current version of Guacamole). Maybe it was with Guacamole 0.9.9 (which is about 2 years old!) which still seems to be used in this product. A little update to that part certainly wouldn't hurt...
... View more
12-01-2017
12:54:PM
Same problem here. PSA seems to contain Guacamole 0.9.9. Current version of Guacamole is 0.9.13 (a lot has happened since 0.9.9). 1920x1280 screen resolution on the destination definitely is NOT a limit of the RDP protocol nor Guacamole! They should get PSA updated.
... View more
12-01-2017
05:30:AM
Haha, never mind. My bad. The problem is not really the appliance. The SSH connection simply did not go through the firewall. Even though HTML5 access asks for login and password, it seems to do that before actually connecting to the destination. So it looked like the connection was working when it was not.
... View more
12-01-2017
05:03:AM
Hey, An HTML5 Access Resource Profile Bookmark allows to "Enable SFTP" Even though enabled, how do you actually use it? The only thing that happens is that the SSH connection no longer works (times out and returns to login) Thanks. Bye, Marki
... View more
11-30-2017
09:38:AM
Hi, I'm having trouble authenticating a client certificate. Everything works up to the role mapping of the realm. I am trying to use an attribute called SERIALNUMBER in the Subject field of the client certificate. If I configure role mapping to map a certificate attribute to a certain role it fails. (certificate attribute "SERIALNUMBER" is "..." --> assign these roles "Users") If instead I use the username generated by the username template from the authentication server (certificate server) then it works. Why can't I use the certificate attribute directly? The second problem is I tried using policy tracing for "Role Mapping", but it does not log anything specific related to role mapping. Info PTR10103 2017/11/30 01:44:16 - PULSE2 - [192.168.1.102] - admin(Admin Users)[.Administrators] - :xRealm - Policy Tracing turned on
Info PTR23331 2017/11/30 01:44:39 - PULSE2 - [192.168.1.102] - System(xRealm)[] - Sign-in browser = "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
Info PTR23331 2017/11/30 01:44:39 - PULSE2 - [192.168.1.102] - System(xRealm)[] - Sign-in Perferred Language = "en"
Info PTR23331 2017/11/30 01:44:39 - PULSE2 - [192.168.1.102] - System(xRealm)[] - Sign-in URL = "*/"
Info PTR23331 2017/11/30 01:44:39 - PULSE2 - [192.168.1.102] - System(xRealm)[] - Sign-in host name = "192.168.1.102"
Info PTR23331 2017/11/30 01:44:39 - PULSE2 - [192.168.1.102] - System(xRealm)[] - Sign-in host address = "192.168.1.102"
Info PTR23331 2017/11/30 01:44:39 - PULSE2 - [192.168.1.102] - System(xRealm)[] - Sign-in network interface = "internal"
Info PTR23338 2017/11/30 01:44:39 - PULSE2 - [192.168.1.102] - System(xRealm)[] - Requesting client certificate as required
Info PTR23329 2017/11/30 01:44:47 - PULSE2 - [192.168.1.102] - System(xRealm)[] - Resuming sign-in process
Info PTR23386 2017/11/30 01:44:47 - PULSE2 - [192.168.1.102] - System(xRealm)[] - Created user name "LT12345" from template "LT<certDN.serialNumber>"
Info PTR10104 2017/11/30 01:45:19 - PULSE2 - [192.168.1.102] - admin(Admin Users)[.Administrators] - :xRealm - Policy Tracing turned off Any idea? Thanks.
... View more
11-13-2017
08:22:AM
Well, the question is not about enhancement. The question is if we buy this product or not :) If I may ask, what version of Guacamole is being used? Everything prior to 0.9.12 is almost a year old...
... View more
11-13-2017
03:39:AM
I'm pretty sure it is there becuase I created the patch for it. :) 1) Look for "fr-ch-qwertz" on https://guacamole.incubator.apache.org/doc/gug/configuring-guacamole.html#rdp 2) https://issues.apache.org/jira/browse/GUACAMOLE-135 Thanks.
... View more
11-11-2017
03:56:AM
Guacamole supports swiss-french keyboard layout. PCS 8.3R3 (build 59199) does not include it in its keyboard layouts. Can you please add it ? Thanks.
... View more
11-08-2017
09:14:AM
I have decided that the best offer is the very simple Pulse Secure Access (no suite). Since it is the simplest solution, it must also be the cheapest. So I'd need to know where to find the maintenance costs just like for the other packages. I have demoed the appliance myself. It works nicely. If I wanted I could have contacted sales a long time ago as you say. However I just want to order and not chit chat for weeks. (Usually, sales people don't have any idea about the technical details behind the licenses anyway.) In order to be able to order I'd need to know prices however. They are all listed, that's very good. However the combination I mentioned is not listed, and it would be good for everyone to know the reason for that.
... View more
11-04-2017
03:28:PM
Hey, Assume you want a (working) appliance, what do you need to buy? 1) the appliance hardware, like #PSA3000 2) maintenance on the hardware, like #?????? And then there is software: 1) Pulse Connect Secure, like #CONSEC-xU(-zYR), with support (#?????) OR 2) Pulse Access Suite, like #STE-ESS-10CU, with support (#PAR-STE-ESS-GLD-10CU-1Y) So you need to acquire a license and pay maintenance for it, as usual. PLEASE CONFIRM! However, I see there exist perpetual licenses for Pulse Connect, as oppsed to Pulse Access. CORRECT? What are the maintenance costs for Pulse Connect perpetual? (#??????) Can someone fill in the blanks, i.e. a link to the product codes and prices for #??????. Why can't this be clear and easy for once ;-) Thanks
... View more
Latest Tags
No tags yet
© 2017 Pulse Secure, LLC. Use of this website assumes acceptance of our Legal Notices and Privacy Policy.
Pulse Secure has updated its Privacy Policy effective June 28, 2017.
