Pulse client from 7.1r2 causing client network disruptions

[mattspierce]

We upgraded from 7.1r1 to 7.1r2 Last weekend.  Since then we have had about 20 or so clients out of about 400 call in with network issues.  The clients are not able to dhcp an address after the pulse client upgrade.  We have had them reboot of course and they still are affected.  Deselecting the Juniper Network Agent from the client adapter allows for them to connect.  Adding it back breaks their connectivity.  Uninstalling, rebooting and reinstalling usually fixes the issues.  A few clients have had to have their Junos client removed, IP and Winsock reset then reboot and reinstall.  I doent seem to matter if they are using wirless or wired.  The problem has occured on windows 7 32 and 64 bit versions, as well as on several windows xp pro systems.  Has anyone else run into this issue?

[mattspierce]

Ok, I got a hold of some additional details.

WindowsSystem Log

Log Name:      SystemSource:        Application PopupDate:          6/17/2011 8:25:50 AMEvent ID:      26Task Category: NoneLevel:         InformationKeywords:      ClassicUser:          N/AComputer:      mpierce6420w7.corp.adtran.comDescription:Application popup:  : \SystemRoot\system32\DRIVERS\jnprna6.sys failed to loadEvent Xml:<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">  <System>    <Provider Name="Application Popup" />    <EventID Qualifiers="16384">26</EventID>    <Level>4</Level>    <Task>0</Task>    <Keywords>0x80000000000000</Keywords>    <TimeCreated SystemTime="2011-06-17T13:25:50.962446400Z" />    <EventRecordID>24455</EventRecordID>    <Channel>System</Channel>    <Computer>mpierce6420w7.corp.adtran.com</Computer>    <Security />  </System>  <EventData>    <Data>    </Data>    <Data>\SystemRoot\system32\DRIVERS\jnprna6.sys failed to load</Data>    <Binary>0000000002003000000000001A000040280400C06C0200C000000000000000000000000000000000</Binary>  </EventData>

</Event>Log Name:      SystemSource:        Microsoft-Windows-Kernel-PnPDate:          6/17/2011 8:25:51 AMEvent ID:      219Task Category: (212)Level:         WarningKeywords:      User:          SYSTEMComputer:      mpierce6420w7.corp.adtran.comDescription:The driver \Driver\jnprna failed to load for the device Root\JNPRNA_MP\0003.Event Xml:<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">  <System>    <Provider Name="Microsoft-Windows-Kernel-PnP" Guid="{9C205A39-1250-487D-ABD7-E831C6290539}" />    <EventID>219</EventID>    <Version>0</Version>    <Level>3</Level>    <Task>212</Task>    <Opcode>0</Opcode>    <Keywords>0x8000000000000000</Keywords>    <TimeCreated SystemTime="2011-06-17T13:25:51.103454400Z" />    <EventRecordID>24460</EventRecordID>    <Correlation />    <Execution ProcessID="4" ThreadID="64" />    <Channel>System</Channel>    <Computer>mpierce6420w7.corp.adtran.com</Computer>    <Security UserID="S-1-5-18" />  </System>  <EventData>    <Data Name="DriverNameLength">19</Data>    <Data Name="DriverName">Root\JNPRNA_MP\0003</Data>    <Data Name="Status">3221226536</Data>    <Data Name="FailureNameLength">14</Data>    <Data Name="FailureName">\Driver\jnprna</Data>    <Data Name="Version">0</Data>  </EventData></Event>

Windows Security Log

</Event>Log Name:      SecuritySource:        Microsoft-Windows-Security-AuditingDate:          6/17/2011 8:25:55 AMEvent ID:      5038Task Category: System IntegrityLevel:         InformationKeywords:      Audit FailureUser:          N/AComputer:      mpierce6420w7.corp.adtran.comDescription:Code integrity determined that the image hash of a file is not valid.  The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.
File Name:\Device\HarddiskVolume2\Windows\System32\drivers\jnprna6.sysEvent Xml:<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">  <System>    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />    <EventID>5038</EventID>    <Version>0</Version>    <Level>0</Level>    <Task>12290</Task>    <Opcode>0</Opcode>    <Keywords>0x8010000000000000</Keywords>    <TimeCreated SystemTime="2011-06-17T13:25:55.472127600Z" />    <EventRecordID>1046414</EventRecordID>    <Correlation />    <Execution ProcessID="4" ThreadID="60" />    <Channel>Security</Channel>    <Computer>mpierce6420w7.corp.adtran.com</Computer>    <Security />  </System>  <EventData>    <Data Name="param1">\Device\HarddiskVolume2\Windows\System32\drivers\jnprna6.sys</Data>  </EventData></Event>

[mattspierce]

I'm working a case through our reseller.  We have to work through them to get to jtac.  I also attached the offending file incase someone wants to check its hash out.

[Kristof]

Hi Matt,

My personal opinion, and I'm not ignoring you have a problem here is to stay on the latest recommended release of the IVE OS being 7.0Rx.

I work at a reseller and I'm always trying to keep up with the most recent recommended version on all devices but not more recent than that just because of things that might be not fully fine tuned in version that Juniper released recently.

Kind regards,

Kristof

[mattspierce]

Thanks for the advice.  We've been implementing SAML 2.0 through the SA and there have been fixes in the .1 code base that assist in that project.  Thats why we're scooting along close behind the releases.

I've verified on a client that the upgrade jnprna6.sys file has a different md5 hash values than one from a client that has been resinstalled.

Jnprna6.sys functional bdb87db2a8204fb9477f7116d19136d1

Jnprna6.sys nonfunctional 24d33700e48039289c780712defa4bb1

[K]

Any idea on how you solved this problem or how you see mad5 hash for jnprna6.sys  files?

[mattspierce]

The fix was to come up a fix process.

Removed all the unnecessary programs.  CA/Shopnow/McAffee and all Juniper modules.\

Ran the Pulse Cleaner tool. *Juniper support recently dropped this tool on me during another client issue.*

Ran the following commands. “netsh int ip reset reset.log” and “netsh winsock reset”

Deleted all files in c:\windows\temp and %temp%.  *This is a typical step for fixing msiexec errors.*

Reboot. Reinstall. 

I ran md5 on the relevant dll files using md5deep, a free tool for getting hashes on a windows box.  Any md5 hashing tool will do.  

[mattspierce]

We havn't seen more of this issue since moving to 7.1r4 by the way.