Pulse Secure formerly SSL VPN
Showing results for 
Search instead for 
Do you mean 
Reply
Highlighted
Contributor
Posts: 63
Registered: ‎08-01-2011
0
Accepted Solution

Pulse Issue - Connection failing on #1, ok on #2 try

Using an iPad2 (up to date firmware) and Pulse (also updated to iTunes current).

 

When Pulse tries to connect the first time (after opening), it fails with a "Connection Error The server is not responding" message.  (Have screen shot if needed)

If you click the OK button and then try to Connect again, all is well.

This happens without fail, every single time you freshly open Pulse.

 

I can recreate by fully "closing" the Pulse app on the iPad, then re-opening and trying to connect.

 

I've checked the logs and don't see any fails on the SA side.

 

Any ideas where to look? 

I -am- new (and learning) our Juniper configuration, etc.

Casey

MAG2600 cluster (Active/Passive)
8.0R4.1 (build 31475)
Moderator
Posts: 2,347
Registered: ‎11-19-2007
0

Re: Pulse Issue - Connection failing on #1, ok on #2 try

What ive OS?
What do the iOS console logs show? Do you see both connections in the SA user access log?
Recognized Expert
Posts: 416
Registered: ‎11-25-2009
0

Re: Pulse Issue - Connection failing on #1, ok on #2 try

Hi,

 

Is this happening only on this Ipad or other IOS devices using pulse?

 

As Zantyterp said, the console logs and the logs from pulse client will help

 

Thanks,

Jay

Moderator
Posts: 2,347
Registered: ‎11-19-2007
0

Re: Pulse Issue - Connection failing on #1, ok on #2 try

Do you have any type of restriction on the URL that would prevent it from working on an initial connection?

Contributor
Posts: 63
Registered: ‎08-01-2011
0

Re: Pulse Issue - Connection failing on #1, ok on #2 try


zanyterp wrote:
What ive OS?
What do the iOS console logs show? Do you see both connections in the SA user access log?


We're currently running: 7.0R1 (build 16007) on the SA-2000

 

I'm working on getting our cluster updated to 7.1R10

 

I have the console log from the iOS, however I'm not sure which is pertinent and which isn't.

I've attached the deviceconsole.log in zip format.

 

AS for the logs on the SA side, I only see the connection on the 2nd try.







Casey

MAG2600 cluster (Active/Passive)
8.0R4.1 (build 31475)
Contributor
Posts: 63
Registered: ‎08-01-2011
0

Re: Pulse Issue - Connection failing on #1, ok on #2 try


jayLaiz wrote:

Hi,

 

Is this happening only on this Ipad or other IOS devices using pulse?

 

As Zantyterp said, the console logs and the logs from pulse client will help

 

Thanks,

Jay


Jay, it happens with all 4 of the iPads we have been using.

Shouldn't matter, but 2 are iPad2 and 2 are iPad"3"

 


 

Casey

MAG2600 cluster (Active/Passive)
8.0R4.1 (build 31475)
Contributor
Posts: 63
Registered: ‎08-01-2011
0

Re: Pulse Issue - Connection failing on #1, ok on #2 try


zanyterp wrote:

Do you have any type of restriction on the URL that would prevent it from working on an initial connection?



Negative.

None that I'm aware of.

 

 

Casey

MAG2600 cluster (Active/Passive)
8.0R4.1 (build 31475)
Contributor
Posts: 63
Registered: ‎08-01-2011
0

Re: Pulse Issue - Connection failing on #1, ok on #2 try

I've also found this at the end of the JunoPulsePluginApp.log

 

20120717152152.288871 Pulse Mobile[p12189.t1799] info Got complete response for https://scnetssl.co.shasta.ca.us/dana-na/html/blank.html (LoginManager.m:142)

 

20120717152152.303540 Pulse Mobile[p12189.t1799] error WebView failed to load with error: The operation couldn’t be completed. (NSURLErrorDomain error -999.) (LoginManager.m:330)

 

20120717152152.310081 Pulse Mobile[p12189.t1799] error Connect operation failed with error: The server is not responding (LoginViewController.m:94)

 

 

Casey

MAG2600 cluster (Active/Passive)
8.0R4.1 (build 31475)
Moderator
Posts: 2,347
Registered: ‎11-19-2007
0

Re: Pulse Issue - Connection failing on #1, ok on #2 try

Thank you for the files and the update. At least part of the issue is that you are doing Host Checker for Windows devices and, it appears, not for your iOS devices. This is set to require and enforce, which means it runs when the user first pulls up the page. I am not sure which realm you are doing this against or what realm you want your iOS users to login against. Some things to try: 1) Create a realm only for mobile devices and set that on a new URL 2) Remove the require and enforce option on the realm(s) you have it set for currently on your default URL. 3) Upgrade to 7.2 and create a Host Checker policy for your iOS devices as well as your Windows devices on that same realm
Contributor
Posts: 63
Registered: ‎08-01-2011
0

Re: Pulse Issue - Connection failing on #1, ok on #2 try

[ Edited ]

zanyterp wrote:
Thank you for the files and the update. At least part of the issue is that you are doing Host Checker for Windows devices and, it appears, not for your iOS devices. This is set to require and enforce, which means it runs when the user first pulls up the page. I am not sure which realm you are doing this against or what realm you want your iOS users to login against. Some things to try: 1) Create a realm only for mobile devices and set that on a new URL 2) Remove the require and enforce option on the realm(s) you have it set for currently on your default URL. 3) Upgrade to 7.2 and create a Host Checker policy for your iOS devices as well as your Windows devices on that same realm

ok, hititng on option 3 first...  If I've read correctly, 7.2 doesn't play on SA-2000 devices??

 

We currently have a "MAC" realm, which is what's being utilized for the iOS devices (as well as OSX devices, which are very far and few between).

Under Authentication Policy, Host Checker

There are no checks in the checkboxes.  Is there another place to check for Host Checker being enforced?

Host Checker is enforced in our normal realm (4 evalutes and the only require/enforce is Cache Cleaner policy).

We are currently configured to merge settings for all assigned roles.  Does that cross Realms also (i.e. roles in any realm?)

 


 

Casey

MAG2600 cluster (Active/Passive)
8.0R4.1 (build 31475)
Moderator
Posts: 2,347
Registered: ‎11-19-2007
0

Re: Pulse Issue - Connection failing on #1, ok on #2 try

Yes, you are correct that the SA2000 will not load 7.2 (sorry I missed that you were using an SA2000). The settings do not merge cross-realm; however, if you have multiple realms on a single URL, all Host Checker policies that are set for require and enforce are run before access to the URL is given. I don't know if you have a URL specific for your Mac/iOS users, but I do see from my big browser that you have all 3 on your default URL. With the confirmation that you have at least one that does require and enforce, that should be what is causing this behavior for your iOS devices. Can you try one of the other options and see what happens?
Contributor
Posts: 63
Registered: ‎08-01-2011
0

Re: Pulse Issue - Connection failing on #1, ok on #2 try

I removed the requires from all realms.

Appears to work correctly now.

 

So in order for the iOS devices to work correctly, I'm gonna have to create a seperate URL for them?

otherwise, this issue will be reside (assuming I re-enable our requires)?

 

Also, any idea if this is something that's fixed in the newer versions of IVE?

Casey

MAG2600 cluster (Active/Passive)
8.0R4.1 (build 31475)
Moderator
Posts: 2,347
Registered: ‎11-19-2007
0

Re: Pulse Issue - Connection failing on #1, ok on #2 try

You are correct on the behavior when using "require & enforce" and the behavior is the same as there is nothing to fix. It is working as it should.
If you moved to evaluate on the realm and enforce on the role (with a role for ios users to map against), you should be able to use one URL as well.