HOWTO set up Juniper Network Connect VPN on Ubuntu Dapper

[amirmku]

Hi
Even getting a popup for password, I closed the browser and TYPED junipernc in terminal
using which Iwas able to add server, userid and REALM but after that i got following message

Hey DEVIN,
Thanks I got to read your post where u had similar problem I too downloaded java6-jdk package, and now i could log in hey thanks again................

But I hav one small problem every time I start juniper it ask me only password but no user id.
If I want to login with different user id how to do that?
Any suggestion.

[DevinD]

Hey amirmku,

Sorry I meant to get back before - I would've suggested making sure java is updated (the popup window etc and junipernc needs java), but it seems you've done that now. When you run the script, it creates a profile. If you open the script in the editor, you'll see on the first few lines after the comments (comment lines are preceded by a "#" in shell scripts)

_profile=default

You can actually change this if you want to (i've got it set up so i have 2 profiles for the 2 vpn's i use). The way the script works is that it prompts you for vpn settings the first time it runs, then saves all that info in a config file, and after that it'll always launch with the settings from the config file, saving you from entering them again. This is a problem if you typed them wrong the first time though. However, all you have to do is edit the config file. In your home directory (this is the default location) type

ls -a | grep vpn

and you should see at least the two files .vpn.default.cfg and .vpn.default.crt (a "." at the beginning of the filename means it's a hidden file). The .cfg file is the config file, .crt is the certificate. Open the .cfg file in a text editor (or with "less") and it should look something like

HOST="host.domain"
USER="username"
CERT="/home/user/.vpn.default.crt"
REALM="realm"
JAVA=/usr/bin/java

You can simply edit the settings directly, or delete the config file (or, for safety, rename it .vpn.default.cfg.bak or something of the like in case you need it back) and when you rerun the script it should prompt you for everything again.

I hope this helps, let me know if anything else bugs you.

Devin

[DevinD]

I realised my mind was wondering and the first part of my response may not connect so well to the second - my point was that, where it says "_profile=default", then the config file will be .vpn.default.cfg, if i set it to "_profile=anothervpn", the config file would be .vpn.anothervpn.cfg and so forth, this is how i had different profiles.

[hhwangbo]

I have attached a screenshot of the message I get when I enter the IP address of my VPN connection. Still not working unfortunately.

I have the exact same problem when using an IP address. I don't have a hostname - only an IP address for my VPN.

Any thoughts on addressing this?

[CodeFooTyping]

I've been fighting will this error for well over a year now, and I stll haven't found a resolution. It ends with "Failed to connect/authenticate with IVE. Error 10" It's preceded by "dsclient.error state select role failed, error 10 (dsclient.cpp:322)"

20100326130405.708365 ncui[p13674.t13695] ncapp.info New ncapp log level set to 3 (nccommon.cpp:75)
20100326130405.708462 ncui[p13674.t13695] ncapp.info Version : 6.5
Release Version : 6.5-0-Build14951
Build Date/Time : Dec 9 2009
Copyright 2001-2008 Juniper Networks
(ncapp.cpp:153)
20100326130405.929961 ncui[p13674.t13695] dsclient.info state: kStateSignin (dsclient.cpp:248)
20100326130405.930001 ncui[p13674.t13695] dsclient.info --> GET / (authenticate.cpp:162)
20100326130405.976170 ncui[p13674.t13695] dsclient.info <-- 302 https://connect.boeing.com/dana-na/a...lt/welcome.cgi (authenticate.cpp:194)
20100326130405.976213 ncui[p13674.t13695] dsclient.info state: kStateWelcome (dsclient.cpp:256)
20100326130405.976234 ncui[p13674.t13695] dsclient.info --> GET /dana-na/auth/url_default/welcome.cgi (authenticate.cpp:162)
20100326130406.215728 ncui[p13674.t13695] dsclient.info <-- 200 (authenticate.cpp:194)
20100326130406.215919 ncui[p13674.t13695] dsclient.info state: kStateLogin (dsclient.cpp:288)
20100326130406.215949 ncui[p13674.t13695] dsclient.info --> POST /dana-na/auth/url_default/login.cgi (authenticate.cpp:162)
20100326130406.511419 ncui[p13674.t13695] dsclient.info <-- 302 https://connect.boeing.com/dana-na/a...09c0326a42af58 (authenticate.cpp:194)
20100326130406.511484 ncui[p13674.t13695] dsclient.info state: kStateSelectRole (dsclient.cpp:312)
20100326130406.511515 ncui[p13674.t13695] dsclient.info --> GET /dana-na/auth/url_default/welcome.cgi?p=select-role&id=state_4a26c645612a1439bb09c0326a42af58 (authenticate.cpp:162)
20100326130406.676220 ncui[p13674.t13695] dsclient.info <-- 200 (authenticate.cpp:194)
20100326130406.676282 ncui[p13674.t13695] dsclient.info state: kStateSelectRole (dsclient.cpp:320)
20100326130406.676369 ncui[p13674.t13695] dsclient.error state select role failed, error 10 (dsclient.cpp:322)
20100326130406.676669 ncui[p13674.t13695] ncapp.error Failed to connect/authenticate with IVE. Error 10 (ncapp.cpp:179)

I am using Xubuntu 10.04 having the same issue. And it is not related to this issue ->http://kb.juniper.net/index?page=con...5000&actp=LIST. Just to test this i set up a fedora32 bit VM and it worked automatically. So it is not a setting on the server side. Everything else seems right.

Is there something that i have missed?

[CodeFooTyping]

I have never been able to get this to work and I have intensified my efforts over the last week. After continual failure and internet research, I started testing with different configurations on my main computer. I decided to try a baseline test, so I installed Fedora 11 32bit VM in Virtualbox. For this the only hiccup was that I needed to install xterm. Otherwise, it worked directly from the VPN portal. Next I set up a new plain vanilla, Ubuntu 9.10 64bit VM in VirtualBox. After install I updated my system, but left it 9.10 Then used the following steps from the Mad Scientists blog (Thanks!!).


I executed the following on the commandline

sudo aptitude install sun-java6-plugin sun-java6-jdk sun-java6-jre
sudo aptitude install ia32-sun-java6-bin
wget -q -O /tmp/junipernc http://mad-scientist.net/junipernc
chmod 755 /tmp/junipernc
sudo cp /tmp/junipernc /usr/bin

Then I logged into the server and when the option became available I started Network Connect. Just as expected from all that I have read I got the terminal popup. As instructed I hit enter twice and logged out.

Then I ran junipernc from the command line.
I entered the VPN server URL at the prompt. I entered the username when prompted. and also entered the realm (my company has more than one so I entered the one I normally choose here). Then I entered my password.

After watching the blinking lights for a little while thinking that it might work I got a "Failed to connect/authenticate with IVE. Error 10" response on the command line along with a popup that says "Unable to connect to IVE".

What am I missing???

I am going to try Ubuntu32 next, I am beginning to doubt that this will work in 64bits.

[configt]

After watching the blinking lights for a little while thinking that it might work I got a "Failed to connect/authenticate with IVE. Error 10" response on the command line along with a popup that says "Unable to connect to IVE".

What am I missing???

I am going to try Ubuntu32 next, I am beginning to doubt that this will work in 64bits.

Sounds like it could be a UID and PW authentication issue, OR, you have the 'cache cleaner' issue that I have with running this junipernc script. (see post http://ubuntuforums.org/showthread.p...94#post7771894)

After attempting to connect using the junipernc script, get the last several lines of your ~/.juniper_networks/network_connect/ncui.log

Here is what mine looks like:

tail ~/.juniper_networks/network_connect/ncui.log

20100719224332.961443 ncui[p16023.t16051] dsclient.info <-- 200  (authenticate.cpp:194)
20100719224332.961498 ncui[p16023.t16051] dsclient.info state: kStatePostCacheCleaner (dsclient.cpp:344)
20100719224332.961540 ncui[p16023.t16051] dsclient.info --> POST /dana-na/cc/ccupdate.cgi (authenticate.cpp:162)
20100719224333.51895 ncui[p16023.t16051] dsclient.info <-- 200  (authenticate.cpp:194)
20100719224333.51955 ncui[p16023.t16051] dsclient.error state post auth cache cleaner failed, error 10 (dsclient.cpp:346)
20100719224333.52114 ncui[p16023.t16051] ncapp.error Failed to connect/authenticate with IVE. Error 10 (ncapp.cpp:179)

As you can see, there is some sort of 'cache cleaner' failure that prevents correct authentication. If this is also your issue, I am sad to say that there is no solution to the problem (yet) other than asking your VPN admin to disable this checker function.

Here is a link from Juniper's support page that explains what this cache cleaner thing does, and there is further information on their website about how to disable it on the VPN server:
http://www.juniper.net/techpubs/en_U...uring-nsm.html

[ssottile70]

Hello,

I have the same issue using Kubuntu 64bit. The madscientist script gives me the following error:




20100720172911.832802 ncui[p5580.t5607] dsclient.info <-- 200 (authenticate.cpp:194)
20100720172911.832876 ncui[p5580.t5607] dsclient.error state host checker failed, error 10 (dsclient.cpp:282)
20100720172911.832996 ncui[p5580.t5607] ncapp.error Failed to connect/authenticate with IVE. Error 10 (ncapp.cpp:179)
20100720172949.473851 ncui[p5580.t5601] ncui.info Sending kill signal (SIGQUIT) to ncsvc... (ncapp.cpp:454)



Anybody knows how to fix the problem?

Same error using jvm 32bit.

Thx
Salvo

[ElectricKetchup]

So I'm getting the same errors as the previous people. Here's what I did as a work around so that I can get network connect working:

1) Removed all firefox and java related packages with aptitude remove
2) Downloaded 32 bit firefox and 32bit java from mozilla and sun.
3) Unpacked the two downloads.
4) sudo ln -s /home/jacob/Downloads/jre1.6.0_21/lib/i386/libnpjp2.so /usr/lib/mozilla/plugins/
5) Go to my company's VPN website with the firefox I downloaded

Also note that before I did that, I had also tried running the mad scientist juniper script. I have never gotten that script to successfully get the network connect client running, but it does seem to set the file permissions for the client, so it's handy for that.

Yes, this solution does suck. I would rather have the mad scientist script working so that I don't have to run a web browser. Luckily I don't use Firefox as my primary web browser because if I did, it would be a pain in the *** to have multiple versions of firefox coexisting at once.

[madscientist]

Just want to say that I don't have any great ideas as to why this is happening, but FYI, I'm using my script along with Juniper Network Connect 1.2 (Release Version 6.1-0-Build13103) on my Ubuntu 10.04 64bit system, and I didn't need to run any special version of FireFox, etc.

I did install ia32-sun-java6-bin to get a 32bit version of Java, but my script should be testing Java to be sure it's 32bit and warning you if not, so I'm assuming all of you are already using a 32bit java.

My script doesn't use FireFox at all (that's the point ) so I'm not sure why one would need a 32bit firefox.

So, other than that I don't have any ideas about this, but it WOULD be helpful if you'd all post the version of Network Connect you're using when you report problems. Maybe there's an issue with older (or newer!) versions.