2

I have a problem trying to connect to a VPN using "Juniper Network Connect". It happened after I upgraded from Mac OS X Yosemite (10.10) to Mac OS X El Capitan (10.11).

Ever since I upgraded to OS X El Capitan, though, Juniper Network Connect (VPN client) stopped working. First it just wouldn't launch. I also upgraded to the latest Java version from Oracle. Now although Network Connect launches it hangs at the "Establishing Secure Session" step. It seems as though the connection is established (since I lose internet access in this period) but it can't create a tunnel.

Before I had the same problem, and solved it using the solution provided here only making this:

sudo nvram boot-args="kext-dev-mode=1"

But for "El Capitan" it's not working.

Here are some lines of the log:

20151022170309.742528 Network Connect[p430.t2567] ncsvccontrol.error The service failed to configure the tunnel (ncsvccontrol.mm:262)

20151022170309.856101 Network Connect[p430.t2567] nc.mac.app.1202.error DSError 0x2cbc0fa0 domain=nc.mac.app code=1202 "ncproxyd failed to establish a tunnel, status = 4" 20151022170310.316057 Network Connect[p430.t76719] dsssl.error Cert hash is not SHA256. len=32 (DSSSLSock.cpp:1781)

Improve this question

5 Answers 5

Reset to default
2

Just disable rootless and it will work again!

Improve this answer
1
  • Thanks Sergio, I disabled rootless as you recommended and it just worked. Thanks a lot for your help. For the rest, the solution is just doing this : quora.com/…. And for those who want to know what are doing: quora.com/…. As I understand the reason Juniper stops working is because now, even with the root authorisation, it can't modify necessary configurations on the operating system. Disabling rootless it can modify what is needed and work again.
    – Wilson Alzate Calderón
    Commented Nov 2, 2015 at 1:14
2

As of July, it appears Juniper is still working on this. The conclusion of that thread claims you can get Pulse working again by:

  1. Downloading the Symantic Certificate Authority
  2. Rename Symc_Cross_Root.txt to Symc_Cross_Root.crt
  3. Open Keychain Access, select 'System' in the left pane
  4. Choose File>Import File... And navigate to the file you just renamed
  5. If you see something about a VeriSign class 3 certificate you're doing the right thing. Click the drop down next to 'Trust'
  6. Select 'Always Trust'. If you get a little blue icon next to the cert, you should be good to go.

Please note I've not tried this myself. It's a hack to get around unpatched and misbehaving software. While I generally like Juniper, I don't use their software products and I don't trust their tech team as far as I can throw the SRX550 that once shit out on me during a server move. This advice is coming to you from a stranger on the Internet, your mileage may vary, failure to fully test before upgrading in a production environment may cause herpes, etc. etc.

Improve this answer
2
  • Firstable, thanks for your answer. I tried your solution, including the certificate into the Keychain access and restarting my computer, but Juniper Network connect continues on "Establishing secure session...".
    – Wilson Alzate Calderón
    Commented Oct 25, 2015 at 2:46
  • @WilsonAlzateCalderón, whenever possible it's best to add log output to the original question, so others going through questions are more likely to see it. Have you contacted Juniper about this issue?
    – agentroadkill
    Commented Oct 25, 2015 at 3:23
1

I encountered the same issue, but managed to circumvent it using Pulse Secure. Which you may found the download link in the following page: https://www.ias.edu/ias_vpn_installers

Improve this answer
2
  • Hi Fischcheng, thanks for your response. I installed Pulse Secure, but i am not able to connect to my VPN, because we are using Juniper Network Connect and it continues on "Establishing secure session". I don't understand what exactly makes Pulse Secure to fix the problem. I Uninstalled Juniper Network Connect but I continue without connection-
    – Wilson Alzate Calderón
    Commented Oct 29, 2015 at 3:21
  • I'm not entirely sure why Pulse Secure works, but Network Connect not. AFAIK, both softwares are made by the same company, Juniper. However, Pulse Secure now is an independent one.
    – Fischcheng
    Commented Nov 18, 2015 at 17:24
0

Install Open Pulse Secure and add a connection by providing the url to sslvpn site. It will ask for credentials, provide as you do with network connect. You should be able to connect to vpn.

Improve this answer
0

As for me (Mac OSX 10.12 Sierra) it helps to reboot in the Recovery Mode and in the terminal execute following command: "csrutil disable". But this decision is very insecure!!!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .