09-16-2009 05:14 AM
I've ran into something weird with my 6.4R3 SA4500 cluster:
I use HostChecker to perform pre-auth validation on my clients.
On a station, one browser might work (IE or Safari) but Firefox won't. The problem occurs on Linux, Mac and Windows stations.
I've seen something in the KB, but it's related to 5.x versions so I guess this should be fixed.
I've noticed the same problems on a SA2500 lab cluster too. Problem was noticed on 6.4R2 and is still in 6.4R3.
Am I the only one seeing this problem ? I'm starting to think that our datacenter is built upon an indian cemetery...
Thanks for your help !
09-16-2009 12:29 PM - edited 09-16-2009 12:55 PM
09-16-2009 12:55 PM
We have the same issue:
"Host Checker did not get installed properly."
The weird thing is clients can go to different URL/Sign in Policies which use the same HC Policy and it works fine.
09-16-2009 01:02 PM
09-16-2009 02:08 PM
I dont know what you mean by "connection missing" ? For the URL, we are pointing to a REALM, the Realm in question is pointing to a host checker policy.
The user goes to the site, attempts to launch host checker and gets ' Host Checker could not be installed '.
We are evaluating the Cisco ASA VPN so far, so good, and much cheaper. This issue has been haunting us since day 1. Juniper has no interest in fixing any of the Host Checker/Net Connect problems. They are only interested in adding useless features. If I sound bitter its because I am.
09-16-2009 02:17 PM
When I meant "Connection" I meant if you had checked the appropriate Host Checker Policy. But from your response it seems you already have. Have you tried unchecking it then logout then logback in and recheck. I know it sounds stupid and Windows like but when I run into problems that do not make sense I try not to overlook anyting or discount any "strange" possibilities. We're on 6.4R1 and fortunately always been able to resolve the no host checker problems that come up.
I wish you luck man. I feel your pain.
09-17-2009 04:41 AM
Thanks for all the answers, good to see that I'm not the only one who's experiencing this bug.
It might be a browser update problem, but I got the symptoms on the latest Firefox and/or IE8.
Giving admin privileges to the Windows users helped, but it's not an acceptable workaround.
I'll try the "remove/recreate" method, I know from experience with web resources that this is actually a solution.
09-22-2009 08:03 AM
Even stranger, users can log into the same host checker policy on a different URL.
I just updated Firefox with the lastest Java Code and now it works from Firefox but not on IE.
09-22-2009 08:36 AM
We have several users out of about 100 that do the same thing. Some folks it works in I.E. only, others it works in Firefox only. It should work in both. Sometimes I've fixed this by removing the host checker from Add/Remove Programs, then reboot and install the Host Checker 'Manually' with the install from Installers from the SA. Reboot and try again. This has fixed the I.E. only or Firefox only issue for most machines.
I've just upgraded our SA4000 to 6.4R3 without issue. I know it's off the subject but has anyone tried the WAN Accelleration offered in 6.5? We have Juniper WXC's in all offices and was curious what 6.5 would offer.
09-22-2009 09:08 AM
I can comment on the WAN acceleration. This is not really a feature of 6.5 per se. 6.5 now provides the ability to implement the WXC WAN acceleration client in a seamless manner to network connect users through the Host Check feature. That is the integration offered. If you want to implement the Juniper WAN acceleration client in an NC environment then it is a nice feature for you.
As for the client itself - that is a different topic. I beta tested it and have the production version up and running in my lab now and could offer you my 2cents if you cared.
09-22-2009 11:04 AM
The solution described at the below site (towards the bottom of the site) resolved one of my longstanding Host Checker issues. It has to do with the Agent String being too long. A dead giveaway of this being your problem occurs when you do a Help, About in IE. If you get a Error 53 then this is probably your issue. It could be your issue even if this doesnt happen. Once we removed some entries from the key described on the site our issue went away.
When the Host Checker tried to launch we would also get an error in the lower left of the screen saying " Setup failed due to inadequate client capabilities "
10-06-2009 02:05 AM
You guys having problems do you have a proper CA certificate.
What I see from the UAC HC is that I really need to trust everything always with a self signed cert.
Remember that both the browser and the java has a keystore.
Just curious if u're seeing this with self-signed or with a proper certifcate where the client has the CA cert in the relevant keystores.
Another thing is if you are connected directly to the IF of the device or your have firewall policies/filters infront of the device ?
10-08-2009 06:28 AM
I have been experiencing a VERY similar issue immediately after upgrading to 6.4R3 (from 6.2R5). Host Checker is required for nearly all our users to sign in, and many would get "You are not allowed to sign in" because Host Checker failed to launch / upgrade. No other errors or popups on the user side; they would type in their credentials, hit sign in, and a few seconds later get that error. The only solution we found was to have the user manually install Host Checker.
Has anyone found a solution to this? It destroyed my smooth upgrade track record with the IVE and caused some serious production issues. I have a ticket open with Juniper to find a root cause but they keep asking for debug logs I don't have because obviously getting the users to log in was more important than collecting log files from them.
It almost seems to be part of a larger issue... a few % of my users will continually experience issues with the client software and have to reinstall them from scratch. Can't find any rhyme or reason other than there's something horribly glitchy about this release... and here I thought it was safe to upgrade to an R3 release...