Easy Patching with IVE (SSLVPN)

I don't know what your experiences are with IVE patching but mine have been relatively painless. There are a few easy rules that I follow to ensure that things go well.

First is to know when patching is required. Go to the Juniper support website, login and make sure you are setup for alerts/bulletins. Remember you need to enable yourself for both software and hardware.

Next is test (if you can). If you have a test IVE or a smaller IVE used for a smaller office, upgrade that and test before your main sites. If you have different client builds accessing your IVEs, see if you can get as many of them as possible to connect to the upgraded test box. Have someone (maybe you) create a risks and issues log of all the events during the testing and during the upgrade planning.

Read read READ those release notes. Seriously, read them cover to cover and envisage how the changes apply to your environment.

Prep you clients.

• Don't use too many browsers. I'm aware that the IVE supports a wide range a browsers but for the upgrade it would be easier to limit the browsers that you ask people to use. That way you can easily brief users on all the options/menus/changes etc. IE is the default that I use for Windows clients.
• Make sure they have your IVE URLs in the Trusted Sites of your browsers. This will limit the problem of users missing the security warnings or the browsers potentially blocking the SSLVPN clients when they connect for the first time after the upgrade.
• Use the Juniper Installer Service. In a Windows environments these are a godsend. Two clients are available in your IVE's Maintenance | System | Installer section of the GUI and they come in exe or msi formats. What they do is once they are installed with admin privileges they enable further IVE client installs to occur without the end user needing admin rights. Have a read of the Appendix of the Juniper Client Side Changes (this doc is for v7.1 of the IVE OS) document to see how this helps.

During the upgrade

1. Don't panic. JTAC is there for you, contact them here and these upgrades are (touch wood) relatively bulletproof.
2. First take backups. Multiple ones, both single file backups and XML backups.
3. Clear down the logs before you upgrade. (To speed things up)
4. Don't worry about the time taken, I've found that SA's can take a good 20-40 mins to upgrade sometimes. The rule of thumb is when you are about ready to go get your console cable out to check what's going on, that's the time that it will finish upgrading.
5. If in a cluster the other IVE's will upgrade after the first one has (and generally they will be quicker than the first one)
6. Understand the Rollback Button in Maintenance | System. Any changes you make post upgrade will be lost if you use the Rollback Button. The IVE takes a point in time image to create the rollback image. Any config changes are only written into the live flash memory.
7. Have a testing script that you've gone through with your management team and if applicable with user input as to what needs to be tested. That way if your script is completed correctly you've not missed anything important. This is especially useful if your upgrade is taking part in the dead of night, so you do not have to work from a fallible mental list.

Troubleshooting post upgrade

You've upgraded the IVE and now there will be the odd client having connection problems. Generally they will be related to the IVE software loaded on the client and the browser. Remember most of the IVE traffic goes through the browser so any problems with the browser might cause problems with the IVE. Your 3 steps to heaven are:-

1. Clear down browser cache. Seriously, this works for 90+% of all post upgrade problems. If you have full control of the clients you could even script this or create a GPO for it ahead of time.
2. Get the user to remove/uninstall all the Juniper Software from the client. If you are using the Installer Service they will auto re-install (you are using the service aren't you?) & try again. This fixes most of the remaining problems.
3. If you are having problems with Pulse and/or Network Connect on a Windows client then it's time to get technical. This is the final step before going to JTAC and does involve some technical know how & maybe admin rights on the client.

Uninstall pulse, any other vpn client, and anything else loaded into the driver stack. (sniffer wireshark etc… leave AV/Firewall driver for now, but if it still doesn't work try uninstalling it)

Then run from an admin command prompt

netsh int ip reset reset.log

netsh winsock reset

(Only one will work, they are the same command for the various versions of Windows) It will reset and rebuild your IP/TCP stack on the client

Reboot and reinstall.

So far the plan above has kept my upgrades relatively trouble free.

If you have found it useful please leave a comment. Also if you have any tricks or tips of your own please shout out and I'll add them on.

Chris

Quantix win CNA Mobility Solution of the Year 2008

Last Thursday night we scooped the CNA award for Best Mobility Solution delivered in 2008. This project was based on an integrated Juniper SA & Citrix implementaion for our great customer HCA Healthcare.

Please find the press release below.

Quantix Celebrates Awards Success
Specialist managed service provider wins Mobility Solution award with innovative HCA Healthcare solution

Quantix, a provider of enterprise applications, support and managed services, is celebrating its success in the Channel Network Awards (CNA), held at the prestigious Hilton Hotel on Park Lane, London. Quantix won the Mobility Solution category for the innovative mobility solution it provided for HCA Healthcare and was also a finalist in the Business Awards Nottinghamshire 2008 in the Innovation Through Technology category for its Business Continuity Managed Service.

The CNA Awards recognise business solutions supplied to clients by the channel and the Mobility Solutions category looks for innovative and scalable solutions where a reseller has understood the specific needs of the client. Quantix provided HCA Healthcare with an innovative solution to allow secure access to proprietary and graphically intensive medical applications from any machine with a web browser. This presents medical personnel with the ability to gain access to x-ray images, patient records, and surgical modelling applications from any machine with a web browser in a secure manner. This would allow them to consult with clients and view images in a home environment but also provide a rapid response to consultation on urgent surgery.

“We’re thrilled to have won this award and to have had our solutions recognised in an event as prestigious as the CNA Awards,” said Quantix Managing Director Richard Salmon. “The work we have done for HCA Healthcare is a true testament to the need for mobile solutions and we look forward to providing further benefits to their mobility needs.”

The mobility solution deployed at HCA Healthcare reduces the waiting time for patients needing urgent surgery, as consultants can access vital information from any connected device, reducing the time needed to view any relevant radiography images.

“Winning at the Channel Network Awards has always been difficult and this year doubly so with the increased number of entries and the highest quality ever,” claimed John Chapman, judging organiser. “One of the toughest categories this year was for Mobility Solutions and for Quantix to come away as winner of this category is great testament to their ingenuity, skill and focus on what the customer was trying to achieve. The judges were particularly impressed with the way Quantix overcame some tough technology and operational issues”

Quantix’s RapidRecovery business continuity solution was also a finalist in the Innovation Through Technology category of the Business Awards Nottinghamshire 2008 which recognise business achievements and helps organisations celebrate their contribution to the regions’ economy.

Thanks,

Andy

Advanced EndPoint Defense is no more...until Juniper find a replacement!

Advanced EndPoint Defense was announced for the Juniper SSL VPN appliances in May 2005.

This was an initiative to integrate the technology Symantec had acquired through the WholeSecure acquisition earlier in 2005. The licence allowed customers to activate Malware protection on the SA appliances that was embedded into the IVE OS.

Unfortunately as Symantec have discontinued the product the OEM has now been disbanded, which has resulted in the AED partcodes being removed from the price list. At this moment in time Juniper haven't announced a replacement agreement, but I would expect this early 2009.

If you are already running AED and have any additional questions please mail me at andrews@quantix-uk.com

Thanks,

Andy

The latest features availabile in IVE OS 6.2

What's new in Juniper’s SSL VPN Version 6.2?

Today’s enterprise environment must support a broad range of devices while simultaneously allowing customers to make access control decisions on a wide variety of variables. Customers also want to cut down on the number of calls in to their helpdesks related to end user compliance issues. Version 6.2 greatly extends Juniper’s endpoint security offering in each of these areas as outlined below.

Endpoint Security - Automatic Remediation
Juniper Networks Secure Access v6.2 adds auto-remediation capabilities for non-compliant endpoints, enabling customers to remediate automatically those devices that do not meet policy prior to allowing them on to their network, minimizing support calls from users of non-compliant endpoints. Auto-remediation capabilities include:

• For all antivirus applications supported by Host Checker - Launching an antivirus process (if it’s not already running)
• Launching an antivirus scan
• Downloading a virus definition file – if the antivirus definition file isn’t recent enough
• Invoking real time protection – if it’s not already enabled
• Firewall auto-remediation for Microsoft Windows XP and 2000, and Microsoft Vista, turning the firewall on (if it is not running)
• Automatically modifying registry settings to pre-defined values as specified by policy for compliance

Customer Benefits
Enables the solution to auto-remediate endpoints before allowing them on to the network, minimizing the support calls from non-compliant users.

Endpoint Security - Pre-Defined Patch Management Checks

Juniper Networks Secure Access v6.2 extends endpoint assessment capabilities to now include in the appliances the ability to support pre-defined patch management checks. Pre-defined endpoint patch management checks include the ability to inspect the endpoint for targeted operating system or application hot fixes, enabling SSL VPN customers to easily define policies that can be directly linked to the presence or absence of specific hot fixes for defined operating systems and/or applications. The pre-defined patch management checks can also be performed according to the severity level of the vulnerability (critical, high, medium, low, etc.) and can be used to enforce access to certain roles or deny access to certain roles.

Customer Benefits
Enables customers to more easily define policies that ensure access control is tied to the presence or absence of certain critical hot fixes for operating systems and applications.

Endpoint Security - Pre-Defined Host Checker Policy Enhancements
Juniper Networks Secure Access v6.2 adds several enhancements to existing pre-defined host checker policies (in addition to automatic remediation and pre-defined patch checks). New features include:

• The ability to create policies that look for any endpoint security package from a specific vendor. Customers will be able to create policies that allow machines running any McAfee AV package, for example.
• The ability to create antivirus policies that look for virus definition files no older than X updates old, where X is anywhere from 1-10. This allows customers to create policies that are more flexible while still providing a reasonable level of security assurance.
  

Customer Benefits
Allows customers to maintain assurance of endpoint integrity while simultaneously providing more flexibility to end users.

Allows Secure Access devices to fit more seamless into existing security infrastructure.


Enterprise Mobility

The reality of today’s IT environment is that end users are increasingly demanding choice when it comes to the device(s) on which they do their work. This leaves IT managers with the responsibility to adapt and provide secure access from these varied platforms. Version 6.2 extends Juniper’s reach and allows the Secure Access platform to continue as the standard for remote access across many of the world’s top organizations.

• Endpoint Security/Enterprise Mobility – Windows Mobile Host Checker
• Host Checker on Windows Mobile – as mobile deployments grow, customers have begun to look to Juniper to provide endpoint security functionality for their Windows Mobile devices, enabling them to ensure a strong endpoint security posture, similar to what is provided on traditional endpoints. Version 6.2 adds Host Checker for the supported Windows Mobile platforms.

Customer Benefits
Allows customers to ensure the same integrity verification capabilities for their mobile devices that they have deployed on their traditional devices.

Enterprise Mobility - Clientless ActiveSync on Windows Mobile
The Clientless ActiveSync feature provides customers with a secure connection from a Windows Mobile device to the Exchange server with no client installation on the device. This allows customers that only wish to synchronize email a means to do so without requiring the Windows

Secure Application Manager client on the mobile device.

Customer Benefits
Allows customers to synchronize their email without authenticating to the SSL VPN device via a client such as WSAM or via the web browser, greatly simplifying the end user experience.

Enterprise Mobility - Extended Support for Windows Mobile
Version 6.2 extends Juniper’s support for Windows Mobile devices with several new features.
Windows Mobile 6.0 support – as new versions of Windows Mobile have been made available, Juniper has provided support across both the clientless access method, as well as WSAM.

Version 6.2 adds support for Windows Mobile 6.0.
Windows Mobile Smartphone Edition – Version 6.2 extends supported Windows Mobile platforms from the PDA edition to also include the Smartphone form factor.

Customer Benefits
Provides freedom for end users to purchase Windows Mobile devices running the latest OS versions and form factors, while still providing a secure connection to the corporate network.

Enterprise Mobility - JSAM and Core Access Support for Solaris 10
Solaris 10 has been added as an additional supported platform for both the JSAM and the Core Clientless access methods.

Customer Benefits
Further solidifies the Secure Access platform as the standard for remote access across an entire enterprise, regardless of the types of devices that must be supported.

Network Connect – As organizations continue to replace their outdated IPSec VPN remote access gateways with the Juniper SSL VPN solution, Network Connect becomes a more popular option across these deployments. Version 6.2 responds to this popularity with several features that increase deployment flexibility and puts greater control over remote access security and performance in the hands of the administrator.

Network Connect – Windows Vista Credential Provider
With the introduction of Windows Vista, Microsoft has replaced its GINA functionality with a new feature known as Credential Provider. In the 6.2 release, Juniper Networks has Credential Provider functionality for Network Connect, providing a mechanism for creating a Network Connect tunnel when the user logs in to their endpoint. The Network Connect Credential Provider has been implemented as a Pre-Logon Access Provider (PLAP). Wherever possible, NC will attempt to provide Single Sign-On by using the same credentials provided for NC to attempt domain authentication.

Customer Benefits
Allows end users to connect to the corporate network via Network Connect while they are logging on to their machine.

Allows a single set of credentials to be submitted for both SSL VPN authentication as well as machine/domain authentication.
onnect.

Network Connect – Bandwidth Management
Bandwidth management is the ability to control the rate of traffic sent or received on a network interface. It is performed by policing (discarding excess packets) and can be used to ensure that a peer is allocated a specified amount of bandwidth. Traffic that is less than or equal to the specified rate is guaranteed to be sent, whereas traffic that exceeds the rate may be dropped or delayed. Bandwidth management is configured per-role, per-IVS, and/or per-interface, with the ability to control both guaranteed minimum, as well as configured maximum bandwidth.

Customer Benefits
Allows customers to manage the throughput of remote access connections, either for specific groups of users or across their entire Secure Access deployment, providing an additional level of service assurance across their u

Network Connect – Windows Client Reconnect Behavior
This new feature will allow the Network Connect client to seamlessly recover from disconnect events. If Windows NC is disconnected for any reason other than session timeout or Secure Access session termination, the client will continuously attempt to reconnect until a network connection is established, rather than timing out. The system tray icon will indicate that NC is attempting to reconnect, but there will be no other prompts to the end user. During this time, the user can Exit or Sign out of NC to stop the client from reconnecting.

Customer Benefits
Ensures a seamless end user experience with improved response to network conditions and other network connectivity disruptions.

Network Connect – 256-bit AES Support
Network Connect now supports 256-bit AES encryption, completing support for this level of encryption across the SSL VPN access methods.

Customer Benefits
Allows security sensitive customers to increase the encryption levels used for their remote access connections.

Terminal Services - Citrix Published Application Support
Version 6.2 expands support for Citrix Terminal Services by allowing customers to display Citrix Presentation Server published applications directly to end users on the SSL VPN bookmark page. This enhancement makes it easier for end users to see exactly which applications they can access through their remote access session directly from their home page, regardless of whether those applications are accessed through Citrix or accessed directly.

Customer Benefits
Improves the end user experience by displaying all application bookmarks on a single screen.
Saves on administration time by minimizing the task of configuring Citrix application bookmarks directly on the SSL VPN, as those bookmarks are pulled directly from Presentation Server.

Terminal Services - Windows Server 2008 Support
In version 6.2, Juniper has added support for the latest version of Terminal Services, running on Windows Server 2008 (Codename: Longhorn).

Customer Benefits
Allows customers to test or rollout the latest version of Microsoft’s Terminal Services functionality as soon as possible, providing deployment flexibility.

Enables RemoteApp support to run seamless windows of applications when the client is running RDP 6.0 (or higher).

Streamlined Management - XML Import/Export and Push Configuration
Version 6.2 adds additional functionality to the existing XML Import/Export and Push Configuration features, completing support for all SSL VPN policies. Additionally, these functions have been improved to minimize restarts that can result in service impact.

Customer Benefits
Allows administrators further granularity in deciding which policies to synchronize between disparate devices or clusters.

Allows administrators to make configuration changes via XML Import and Push Config without worrying about service restarts, allowing greater management flexibility without any user impact.

Streamlined Management - IVS Shared Authentication Services
This feature allows Instant Virtual Systems (IVS) customers to provide access to authentication services that can be shared across virtual systems. This enhancement allows the customer to place the authentication service on a particular VLAN and share that VLAN across all IVS on a given system or cluster.

Customer Benefits
Allows Service Providers to host shared authentication services, such as RADIUS, in their networks as an additional value added service for each of their IVS/Shared Network-based SSL VPN services customers.
Allows enterprises utilizing IVS the ability to share a single authentication infrastructure across their entire user population.
.
Streamlined Management – RADIUS Accounting NC Assigned IP Address
This enhancement allows customers the ability to send the IP address assigned by Network Connect, in addition to the user’s source IP, to a RADIUS accounting server for auditing and billing purposes.

Customer Benefits
Allows customers a better view into the activities performed by users on their network when connected via Network Connect, aiding in auditing and billing.



If you have any questions regarding any of the Juniper products, then please visit the Quantix website or call 0115 983 6200 to speak to one of our Juniper Consultants.

Thanks,

Gav

Considering Citrix?

Historically if an organisation wanted to securely publish internal applications to a remote workforce via the web, then Citrix (in it's various guises) was seen as the only viable option.
With this though came the often experienced frustrations, namely, cost (Citrix is not cheap), compatibility, administration and printing...I'm sure those of you who are reading this are shuddering at those two words... Citrix & Printing....

Anyway, now there is an alternative... Many of you may have either read about or have tested the new Terminal services offered within Windows 2008. The most intriguing element being the new RemoteApp functionality. In a nutshell RemtoeApp is the ability to publish applications in a seamless terminal service window. To compliment this, new to Windows 2008 is the ability to deploy these remote applications via a web portal or buy distributing .msi files via AD.

This new functionality is a direct attack by Microsoft on the remote app publication space that has previously been dominated by Citrix. An judging by the results, it may well be successful.

Taking the above one step further is the ability to publish these remote applications securely over the web. This previously was carried out using Citrix Nfuse, using SSL as the means of encryption.

But, with the recent release of version 6.2 of the Juniper SSL VPN software with native support Windows 2008 Terminal Services and more importantly the RemoteApp functionality this has finally created a direct alternative to Citrix Presentation server.

Using the Juniper SSL VPN to 'front end' Windows 2008 Terminal Services not only provides a more scalable and secure alternative to Citrix, but it does it at a fraction of the cost and with out the inherent frustrations.

For more information about the Juniper SSL VPN go to: http://www.quantix-uk.com/SSLVPN.aspx or feel free to contact one of our Juniper Consultants on 0115 983 6200