https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB43600 ... View more

Is it ESP or SSL ? Because 8.2 still does not support TCP window scaling. So SSL(TCP) connection works fine in the LAN but degrades as soon as the latency increase. ... View more

SIGNIN-URL: https://company.com/custormer1 => REALM_MULTITENANT SIGNIN-URL: https://company.com/custormer2 => REALM_MULTITENANT SIGNIN-URL: https://company.com/custormer3 => REALM_MULTITENANT REALM "REALM_MULTITENANT" custom_expression : loginURL = "https://company.com/custormer1" -> ROLE "ROLE_customer1" custom_expression : loginURL = "https://company.com/custormer2" -> ROLE "ROLE_customer2" custom_expression : loginURL = "https://company.com/custormer3" -> ROLE "ROLE_customer3" ROLE "ROLE_customer1" "VLAN/Source IP" => assign to VLAN100 ROLE "ROLE_customer2" "VLAN/Source IP" => assign to VLAN200 ROLE "ROLE_customer3" "VLAN/Source IP" => assign to VLAN300 ... View more

But after the host-checker validation on my test-client it just shows "Missing vertificate. Check that your certificate is valid and up-to-date, and try again." even it should be checking for the same cert. Make sure that the certificate installed is a "client certificate". HC don't care about the certificate extended key usage but to connect to PCS you need a "TLS Web Client Authentication (1.3.6.1.5.5.7.3.2) " certificate. ... View more

Pulse Installer Service can be deployed. This service will run with admin privileges and will take care of installing "SetupClient" or "PSAL" on behalf of a non admin users. PIS will do the installation in the user profile ! So if you have some AppLocker policy that prevent running binaries from user profile, the AppLocker rules must be updated (by example: allow execution of applications signed by "PulseSecure") ... View more

The PCS client compare the certificate (or cert hash) seen by the client to the certificate hosted on the PCS server. If you put some kind SSL interception the certificate on the MitM server must be the same cert the is installed on the PCS server. Be careful: not all TLS traffic is HTTP ! (nCP/oNCP) ... View more

strace -f -s 100 -o strace.txt ./ncui -h -f my.cert.der -c DSID=xxxxxx tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 inet addr:111 P-t-P:111.228 Mask:255.255.255.255 inet6 addr: fe80::b761:1e1d:3581:ee73/64 Scope:Link UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1400 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:1 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:500 RX bytes:0 (0.0 b) TX bytes:76 (76.0 b) In the strace output 29475 "\x60\x00\x00\x00\x00\x24\x00\x01\xfe\x80\x00\x00\x00\x00\x00\x00\x3c\x27\x46\x9b\xd9\xcb\x99\xa0\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x16\x3a\x00\x05\x02\x00\x00\x01\x00\x8f\x00\x79\xda\x00\x00\x00\x01\x04\x00\x00\x00\xff\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02", 2048) = 76 29475 write(4, "20170406001032.413773 ncsvc[p29475.t29475] adapter.warn Bad ip packet len 76 - should be 0 (adapter."..., 109) = 109 \x60\x00\x00\x00\x00\x24\x00\x01 \xfe\x80\x00\x00\x00\x00\x00\x00 \x3c\x27\x46\x9b\xd9\xcb\x99\xa0 \xff\x02\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00\x16 \x3a\x00\x05\x02\x00\x00\x01\x00 \x8f\x00\x79\xda\x00\x00\x00\x01 \x04\x00\x00\x00\xff\x02\x00\x00 \x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x02 00000000 60 00 00 00 00 24 00 01 fe 80 00 00 00 00 00 00 00000010 3c 27 46 9b d9 cb 99 a0 ff 02 00 00 00 00 00 00 00000020 00 00 00 00 00 00 00 16 3a 00 05 02 00 00 01 00 00000030 8f 00 79 da 00 00 00 01 04 00 00 00 ff 02 00 00 00000040 00 00 00 00 00 00 00 00 00 00 00 02 text2pcap -e 86dd out.pcap tcpdump -r out.pcap -n -e reading from file out.pcap, link-type EN10MB (Ethernet) 00:43:21.000000 0a:01:01:01:01:01 > 0a:02:02:02:02:02, ethertype IPv6 (0x86dd), length 90: fe80::3c27:469b:d9cb:99a0 > ff02::16: HBH ICMP6, multicast listener report v2, 1 group record(s), length 28 ... View more

net.ipv6.conf.tun0.disable_ipv6 = 1 The problem is related to this packet 00:21:15.000000 0a:01:01:01:01:01 > 0a:02:02:02:02:02, ethertype IPv6 (0x86dd), length 90: fe80::6638:20f2:f6cb:1ded > ff02::16: HBH ICMP6, multicast listener report v2, 1 group record(s), length 28 This packet was extracted by stracing the ncsvc process ... View more

You just need to disable IPv6 on the tun0 interface. ... View more

https://social.technet.microsoft.com/wiki/contents/articles/31983.remote-desktop-protocol-maximum-supported-resolutions.aspx ... View more

On the admin page, the packages can be downloaded from Maitenance -> System -> Installers page ... View more

Check the README in /usr/local/pulse ... View more

In PCS 8.1R7, the client is still 32bit but some 32bit system libs are installed "yum install glibc.i686 nss.i686 zlib.i686" in PCS 8.2R1, there in no Pulse Linux client. ... View more

+1 ... View more

Should be fixed in 8.1R4.1 Problems Resolved in 8.1R4.1 Release PRS-329631 :If JIS is installed, after upgrade, user sees popup error while downloading setup client. ... View more