HOWTO set up Juniper Network Connect VPN on Ubuntu Dapper

[darrenleeweber]

HOWTO set up Juniper Network Connect VPN on Ubuntu Gutsy-Gibbon amd64

I used all the tricks in the original post, but gutsy-amd64 needs some modifications.

After the first installation failed, I used ldd to check the config, ie:

sudo ldd ~/.juniper_networks/network_connect/ncsvc

That helped to identify what was missing. I had already installed some 32bit packages for gutsy-amd64, eg:

sudo apt-get install ia32-libs
sudo apt-get install ia32-sun-java5-bin
sudo apt-get install ia32-sun-java6-bin

(There is no equivalent for the ia32-sun-javaX-jre.)

For libstdc++2.10-glibc2.2, I did the following (maybe not the best way to do this, but it worked for me):

sudo -i
cd /usr/src
wget http://debian.oregonstate.edu/debian/pool/main/g/gcc-2.95/libstdc++2.10-glibc2.2_2.95.4-27_i386.deb
dpkg-deb -x libstdc++2.10-glibc2.2_2.95.4-27_i386.deb   libstdc++2.10-glibc2.2_2.95.4-27_i386
mv libstdc++2.10-glibc2.2_2.95.4-27_i386/usr/lib/* /usr/lib32/
mv libstdc++2.10-glibc2.2_2.95.4-27_i386/usr/share/doc/libstdc++2.10-glibc2.2 /usr/share/doc/
rm -rf libstdc++2.10-glibc2.2_2.95.4-27_i386
rm libstdc++2.10-glibc2.2_2.95.4-27_i386.deb

For libssl symbolic links, I used:

sudo ln -s /usr/lib32/libssl.so.0.9.8  /usr/lib32/libssl.so.0
sudo ln -s /usr/lib32/i686/cmov/libssl.so.0.9.8 /usr/lib32/i686/cmov/libssl.so.0

After that, it works, hurrah!

Thanks so much for the original post, it was a life saver for me! I still hate their flaky installation scripts that have not been updated now in years!

[darrenleeweber]

Did anyone manage to get this working in some form on an amd64 feisty install?

I created a 32bit chroot for firefox anyways.. and followed the instructions there. I can get it to install, but it can't ever connect. Probably something that the ncsvc service is trying to do that doesn't work because it's a 32bit chroot running on a 64bit kernel?

I just posted on how it works for me with gutsy-amd64, maybe that will help.

[beltratc]

Mad Scientist, et al,

Thanks for the great info. I've been able to connect, but can only access servers on the vpn by IP address: DNS doesn't seem to work. Any ideas?

Thanks,

beltratc

[madscientist]

Your DNS servers are managed through the /etc/resolv.conf file. When Network Connect comes up, it should overwrite your standard /etc/resolv.conf file with a new one, that points towards the DNS server on the other side of the VPN, inside the private network: presumably that DNS server has all the local hostnames that you can't resolve outside.

So, if you can't resolve the remote hostnames that means your /etc/resolv.conf file is not being set up properly in the first place, or else is being overwritten. Take a look at what that file looks like before you've brought up the connection (or after you take it down), then again right after the connection is made. Compare the timestamps to see whether the VPN is overwriting this file.

It's also possible that netconnect IS writing this file, but something else is changing it again: see post #5 in this thread for some info on my situation which was similar. But in my situation my lease expired rarely so I didn't see it that often. It's possible yours expires more often.

[foresto]

After some fiddling, I got it working on my Gutsy installation. I'm using sun-java6-bin instead of sun-java5-bin. I didn't bother with the libssl or rpm symlinks. (Actually, the latter would have been problematic because I happen to have a real copy of rpm installed, for unrelated reasons.) I do not have a password set for root.

The first time I tried to log in, I got the xterm window asking me for a root password. I just pressed enter, told it not to retry, and dismissed the rpm error message box. This created and mostly populated the ~/.juniper_networks/network_connect directory.

Next, I changed to the .juniper_networks directory, and ran:
sudo install -m 6711 tmp/ncsvc network_connect/

I then edited network_connect/xlaunchNC.sh, adding an "exit 0" line near the top, followed by chmod -w network_connect/xlaunchNC.sh to keep my change from being overwritten. (In hindsight, this may not have done anything after all.)

I had to load the "tun" kernel module by hand, like so:
sudo modprobe tun

After all this, I returned to my company's Network Connect web page, and pressed the Start button. This time, the java app window stayed open and said I connected successfully.


I think the keys for me were manually installing ncsvc as setuid root, and manually loading the tun kernel module. I still get prompted for the root password at login, but just pressing enter and letting that part of the script fail seems to do no harm. I'll probably edit the scripts to skip that step, and chattr +i them as previously suggested, to get rid of the nagging.

[cheahk]

I had this working on an old notebook running Gutsy. Then all of a sudden today, I could log in and connect, but I could not get to any of the resources at the company. I checked everything like "netstat -rn" and "/etc/resolv.conf", and sure enough, they were correct.

I finally found the problem. It was the "~/.juniper_networks/network_conenct/ncsvc.log" file that had grown too big, about 2.4 GB in size (or something). I just did a "> ncsvc.log" to zero it out, and everything is working fine again.

Does anyone know of an elegant way to rotate this file, or even to turn off debugging/logging to this file?

-K

[QettoE]

I'm kinda late, but have your administrator change your IVE box application from Windows to Java and everything will work.

[Matt Waddell]

Perhaps nobody cares anymore, but i was wondering if anyone has had any luck getting the Secure Application Manager (part of IVE) to work under wine. I've had some limited success logging into the vpn https gateway with IE + wine, as well as getting the SAM installed and running (under wine as well). Although the SAM loads and connects to the VPN, it doesn't appear to tunnel any traffic generated by other apps run under wine (i.e. remote desktop). I'm unable to resolve internal DNS registered names, nor am I able to connect directly to IP addresses. My guess is that this has something to do with wine's winsock implementation.

When I try to enable DNS tunneling (I forget what the button is called) (enabled in one of the "Advanced" tabs of the SAM config systray program), I see this being printed to stdout by wine:

BTW: I'm using wine-0.9.33

fixme:winsock:WSCInstallNameSpace (L"Juniper Secure DNS (Top)" L"c:\\Program Files\\Juniper Networks\\Secure Application Manager\\gapsp.dll" 0x0000000c 0x00000000 {e90a7329-700e-4312-abc0-9b384bbb53bf}) Stub!

It's possible that this is wine-unimplemented winsock function is essential.

I've also noticed some other differences between running the SAM in windows and through wine. For one, the Protocol Catalog list (again in one of the Advanced tabs of the SAM config systray program) is completely empty when run under wine. When run under windows this list is populated with protocols which are implemented in the following DLLs:

mswsock.dll
rsvpsp.dll
winrnr.dll
samnsp.dll


Anyhow... That's all I've been able to figure out for now. Perhaps someone else has had luck with this. I want my company to support the linux client too (((

[flovo77]

Hi all, 'Installation check failed' took me about an hour to figure out...

• fresh Feisty/Gutsy (won't matter anyway) installation
• Network Connect is unable to connect and ends up with 'connection failed'
• The diagnosis message contains 'Installation check failed', as reported in post 36 and post 99

In my case, not using a /tmp symlink pointing to a directory at my crypto fs anymore is the woraround, see http://www.juniperforum.com/index.php/topic,5454.0.html and http://www.juniperforum.com/index.php/topic,5455.0.html.

=> Network Connect fails if /tmp and /etc are mounted on different partitions!
Florian

see

Hi, I am trying to get network connect working on Debian and found this page. I followed the instructions. The network connect dialog popped up but I couldn't connect. The diagnosis message indicates the NC installation check failed. The NC service is not running. Anyone has idea how to fix this problem?

Thanks!

[theanswriz42]

HOWTO set up Juniper Network Connect VPN on Ubuntu Gutsy-Gibbon amd64

I used all the tricks in the original post, but gutsy-amd64 needs some modifications.

After the first installation failed, I used ldd to check the config, ie:

sudo ldd ~/.juniper_networks/network_connect/ncsvc

That helped to identify what was missing. I had already installed some 32bit packages for gutsy-amd64, eg:

sudo apt-get install ia32-libs
sudo apt-get install ia32-sun-java5-bin
sudo apt-get install ia32-sun-java6-bin

(There is no equivalent for the ia32-sun-javaX-jre.)

For libstdc++2.10-glibc2.2, I did the following (maybe not the best way to do this, but it worked for me):

sudo -i
cd /usr/src
wget http://debian.oregonstate.edu/debian/pool/main/g/gcc-2.95/libstdc++2.10-glibc2.2_2.95.4-27_i386.deb
dpkg-deb -x libstdc++2.10-glibc2.2_2.95.4-27_i386.deb   libstdc++2.10-glibc2.2_2.95.4-27_i386
mv libstdc++2.10-glibc2.2_2.95.4-27_i386/usr/lib/* /usr/lib32/
mv libstdc++2.10-glibc2.2_2.95.4-27_i386/usr/share/doc/libstdc++2.10-glibc2.2 /usr/share/doc/
rm -rf libstdc++2.10-glibc2.2_2.95.4-27_i386
rm libstdc++2.10-glibc2.2_2.95.4-27_i386.deb

For libssl symbolic links, I used:

sudo ln -s /usr/lib32/libssl.so.0.9.8  /usr/lib32/libssl.so.0
sudo ln -s /usr/lib32/i686/cmov/libssl.so.0.9.8 /usr/lib32/i686/cmov/libssl.so.0

After that, it works, hurrah!

Thanks so much for the original post, it was a life saver for me! I still hate their flaky installation scripts that have not been updated now in years!

Works like a charm on my Gutsy 64 bit install. Thanks man!