Hi,   We're currently running 7.2R9.2 and since we started to implement WSAM via the Windows Pulse client (to allow Outlook Anywhere access), users have been complaining that after sleep mode the Pulse is connecting but Outlook won't connect to the Exchange server. We've configured the WSAM policy to the Exchange server destination. Users have to log out and login again. This behaviour is not consistent.   Curious to hear if other people have similar experience?   We're planning on upgrading to 8.0 but needs testing first. ... View more

Hi,   Does anyone know if HSTS Strict Transport Security is supported on the SA? I understand most major browsers support it now and it seems the best way currently to prevent sslstrip MitM attacks.   http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security ... View more

Hi,   Is it possible to let user sessions roam between 2 realms?   Currently we have 2 realms with both have a Sharepoint site via Pass-through Proxy enabled (via role-mapping). The problem is that only one of realm URLs can be configured to redirect users to when the're not logged in (using the IVE hostname). So the following is happning:   We have 2 realms. realm1.com and realm2.com. Sharepoint site is configured as sharepoint.com. IVE hostname is set to realm2.com   1. User logs on to realm1.com 2. User clicks on link in email (sharepoint.com) 3. User is redirected to realm2.com and prompted for credentials.   The only way to by pass this is to educate the users to:   1. User logs on to realm1.com 2. User clicks on bookmark for sharepoint site (this executes realm1.com/launch.cgi?sharepoint.com and activates the user's session) 3. User clicks on link in email (sharepoint.com) 4. User enters sharepoint site without entering credentials.   Allowing for sessions to travel between realms would possibly fix this.   Any ideas?   JH ... View more

Due to many limitations with the Web-rewriter we decided to test Sharepoint 2010 using Pass-through proxy as suggested by Juniper. Unfortunately we're still hitting many limitations. Was wondering if others have these issues as well as I can't find anything related to this in the KB or forum.   1. IE needs to be set to compatibility mode, otherwise ribbon won't work (page tab won't work) 2. When trying to edit a page you can't add a new web part simply won't do anything 3. Styling seems to be broken in many areas.   I'm afraid that when continuing to test we'll find other things that won't work as expected. Looking forward to hear from others if they found work-arounds for this or if we simply have a broken configurtation causing these issues.   Kind regards,   -JH ... View more

Hi, Does anyone know what location to use to put a batch script to run on the Pulse client? I remember that WSAM was only able to run local scripts, but seems that the Pulse client can run remote scripts after it's been copied to the local machine: http://kb.pulsesecure.net/InfoCenter/index?page=content&id=KB21018: "Junos Pulse copies over the script file to the local file system and executes the script either at the time of establishing a user session or when the session is terminated." I assume this is all configured on the IVE under Role -> VPN Tunneling? JH ... View more

Hi, Has anyone got Manage Alerts to work from Outlook -> File -> Info -> Manage Rules & Alerts when using via the SA rewriting? When not using rewriting it works fine (as documented by MS) But it say "Cannot connect to the server" when through rewriter. I've not been able to find any information. List of limitations in Sharepoint 2007 and 2010 doesn't mention anything about this. JH ... View more

Hi, Has anyone managed to get Exchange Control Panel to redirect for Exchange 2010? I do have exchange/owa working with SSO as well, but exchange/ecp is slightly different. To logon it uses redirects from OWA. Curious if it's best to create a different profile for this or to change the OWA profile? JH ... View more

I've enabled the option to save the password for the pulse client on the SA. This seems to work some of the times (when doing restart) but when clicking "sign out" on the web portal (realm) then user is prompted again for credentials after a restart. Can any one explain why it would not save credetials after doing a sign out on realm? ... View more

Hi, Is it possible to auto login to the SA web page (realm) after the Junos Pulse client has logged in on a Windows client? Auto logn does seem to work the other way around (user first logs in to web portal (realm) then auto login to junos client). I'd like to get a similar user experience to Android Junos pulse where user can click bookmarks from Junos Pulse App. JH ... View more

Does anyone know where to find the developer guide to help a developer write a custom dll for the host checker? Here is the documentation how to implement the package, but can't find details on how to develop it. We're interested to find out if it's possible to do certiifcate pinning using the host checker. ... View more

Hi, I was wondering if someone could explain me the security implications of choosing PTP over using the rewriter for a web application. I know that Juniper recommends using the rewriter, but if there are functional limitations to the applications when using the rewriter pass-through-proxy is recommended. I'd like to know what additional security risks may be involved when choosing one over the other (if any). Kind regards, JH ... View more

Hi, I know this isn't a RSA forum, but curious if any one has actually managed to get SSO working for the RSA Self Service portal on a Juniper SA, as I assume more people are using 2 factor auth. In an ideal world the Juniper SA would have the option for a user to reset a their token PIN similar to the change (AD/LDAP) password feature on the IVE, but since that's not a feature, next best thing is to use RSA's own tool. I've battled trying to get form based SSO to work, since it's a 2 step auth it's just a bit more complicated and I'm not clever enough apparently. All the best, ... View more

Currently our Windows users who use email externally get the Pulse client pushed and this Pulse client is configured to use WSAM to tunnel email trafffic to our Exchange server. We'd like to achieve the same for our Mac users (now we get more and more Mac users). I understand that WSAM doesn't work on Mac and we've tried JSAM (but users understandebly do not like the Java hassle). We also like to offer a consistent experience to the users therefor our preferred thought is to offer the Pulse client to them as well. I understand we then need to configure a VPN tunnel. My question is, what are the best options to serve Outlook email to our Mac users via the Juniper SA SSL VPN. Would there be any benifit in upgrading to version 8.0R2? We're currently on 7.4R6. -JH ... View more