HOWTO set up Juniper Network Connect VPN on Ubuntu Dapper

[TomtheWombat]

This may have been said before, but for amd64 use the junipernc script from madscientist but make the following changes when you install it:

Install ia32-sun-java6-bin (along with other java things mentioned on his site) and set it as the default java:

sudo aptitude install sun-java6-plugin sun-java6-jdk sun-java6-jre
ia32-sun-java6-bin
sudo update-java-alternatives -s java-6-sun

Then run the junipernc script as you usually would. Juniper network connect will not run in 64bit java. YOu won't be able to connect using your browser (it only supports 64bit plugins.)

[chazn85]

i am getting the Error 10 cannot connect to NVE error with version 6.4. i feel this is the last step in getting this working so any pointers would be appreciated!

[Sigma47]

Then run the junipernc script as you usually would. Juniper network connect will not run in 64bit java. YOu won't be able to connect using your browser (it only supports 64bit plugins.)

TomdaWombat can you clarify this statement? I recently started a job which requires JNC. I am running 9.10 64bit and plan to do the mad scientist install with the redirect to the 64bit java files; is that a correct approach? and for the question then... Running the script will connect me to the VPN right? so I don't actually have to go to the "web sign-in" page that usually starts JNC with firefox?

Thanks for the help...I am finally over the hump of Linux frustration and beginning to appreciate it!

[mynk]

I get the following error when I try

$ sudo update-java-alternatives -s java-6-sun
update-alternatives: error: no alternatives for java-rmi.cgi.

> Then run the junipernc script as you usually would. Juniper network connect will not run in 64bit java. YOu won't be able to connect using your browser (it only supports 64bit plugins.)

I realized that my colleagues are using 32 bit Karmic and it works for them. They get a final popup window which I don't see. I believe it is because I am using a 64 bit Karmic.

The juniperrc script constantly gives me -

Failed to load the ncui library.

The RSA string I found to be -

<input type="hidden" name="realm" value="RSA Secure ID">

No luck so far!

[madscientist]

A simple solution is to run my juniperrc script with the "-nogui" option; that avoids the need for Java at all IIRC. However, it's a bummer because you can't see the status of your connection.

However, it's not hard (at least it wasn't for me) to get it working on 64bit Karmic.

Unfortunately my detailed information on this is at home; I keep meaning to find the time to update the website. But, you need to install a 32bit version of Java, which is easy: run "sudo aptitude install ia32-sun-java6-bin" from the command line, or use Synaptic or whatever to install it.

Next you need to modify the juniperrc script so it uses the 32bit version of java by setting JDK_HOME appropriately.

[mynk]

I tried the -nogui option -

$ junipernc -nogui
Connecting to xxx-xxx.xxx.xxx port 443
Generating Certificate .... done.
Connecting to xxx-xxx.xxx.xxx : 443
$ echo $JDK_HOME

$

What should I set the JDK_HOME value to? I have installed the 32 bit java as instructed.

I see the dialog VNC has exited and it keeps looping in the same.

[madscientist]

??

In Network Connect, the graphical connection monitor applet is written in Java. If you invoke my script with the "-nogui" option, then this connection applet will not be invoked: hence, you do not need Java at all (and thus you don't need to set JDK_HOME). The actual VPN software, that handles the network, is not written in Java and can run without the monitor applet (although it's gross because you can't tell what the status of the connection is, very easily). The -nogui flag is a workaround to get the connection running, when you can't get Java working.

Setting JDK_HOME is necessary only if (a) the default Java is not correct (for example the default java on your system is 64bit and the Java app is a 32bit app), AND (b) you don't use the -nogui flag.

On my 64bit system I need to set:

JDK_HOME=/usr/lib/jvm/ia32-java-6-sun/jre

Note that you have to be sure this is set in the environment and exported before you run my script.

[fatmcgav]

Hi there,

I'm trying to get NetConnect installed on Ubuntu 9.10 x64.

I've managed to get the GUI run up by installing ia32 java6, then using mad-scientist's script, with a quick tweak to set the JDK_HOME to be JAVA6_32_HOME, which get's set at the start of the script...

I can run the script, and it compeltes the install, and then opens the NetConnect GUI. I then enter my user Password at the RSA Code prompt, and it appears to be working.

However it then fails with:

ncapp> Failed to connect/authenticate with IVE. Error 104
ncapp> Incorrect credentials. Please check the username/password/realm.

Now the only thing different about our VPN to the others i've read about in this thread is that we've got an additional authentication step in the form of a Client Certificate verification...

Is anybody familiar with this? Any tips on how to set it up?

Cheers
Gavin

[madscientist]

Hi all.

I've updated my page and also added a new version of the script. This version handles 32bit/64bit versions better (if it can't find the right bit size java to run things with it will ask you for a location). It also has some enhancements suggested by others, including support for KDE and the ability to connect to multiple servers. It will also try to figure out the correct "realm" value by checking the connection page, rather than assuming "RSA".

Hopefully this will work (it works for me but...)

Note that I really can't help anyone with questions about failures that occur after the connection is made: I am simply someone who uses the service on the client side. I don't have a lot of understanding of the intricacies of IPSEC/VPN, or how the Juniper server is configured (never even seen one), etc. Hopefully others reading this list are more knowledgeable in that area...

[LoneStarKen]

I'm so bummed. I had it all working fine with the junipernc script. Then they replaced their certificate with a godaddy certificate and I can't get connected. Getting:

ncapp> Failed to connect/authenticate with IVE. Error 5

From the ncui.log:

ncui[19701] dsclient.info state: kStateSignin (dsclient.cpp:233)
ncui[19701] dsclient.info --> GET / (authenticate.cpp:136)
ncui[19701] dsclient.info <-- 302 https://xxx.xxx.com/auth/url_default/welcome.cgi (authenticate.cpp:168)
ncui[19701] dsclient.info state: kStateWelcome (dsclient.cpp:241)
ncui[19701] dsclient.info --> GET /auth/url_default/welcome.cgi (authenticate.cpp:136)
ncui[19701] dsclient.info <-- 200  (authenticate.cpp:168)
ncui[19701] dsclient.info state: kStateLogin (dsclient.cpp:273)
ncui[19701] dsclient.info --> POST /auth/url_default/login.cgi (authenticate.cpp:136)
ncui[19701] dsclient.info <-- 302 https://xxx.xxx.com/auth/url_default/welcome.cgi?p=passwordExpiration&seconds=Server:250717 (authenticate.cpp:168)
ncui[19701] dsclient.info state: kStateError (dsclient.cpp:358)
ncui[19701] ncapp.error Failed to connect/authenticate with IVE. Error 5 (ncapp.cpp:174)
ncui[19701] ncui.info Sending kill signal (SIGQUIT) to ncsvc...  (ncapp.cpp:445)

I think it's related to the security certificate. Anyone got any ideas?