Known Issues

Release 9.1R15

Symptom: "ERROR_NETWORK_CHANGED" error shown when browsed on chrome.

Condition: FQDN based split-tunnel VPN connection along with server-side proxy is configured either manually or using PAC file.

Workaround: None.

Symptom: Pulse rebranding package generation fails on Monterey platform.

Condition: On Monterey where python 2.x support is not available.

Workaround: Pulse rebranding package can be generated on BigSur or a macOS where python 2.x support is available which can be deployed on all platforms including Monterey.

Symptom: All DNS queries go through virtual adapter including domains that are added in exclude split tunnel policy. .

Condition: IVE DNS and Physical adapter DNS are configured with same IP address on a FQDN based split tunnel plus SplitDNS enabled VPN connection.

Workaround: Configure different DNS IP addresses either on the physical adapter or virtual adapter.

Symptom: Failed to send UDP IPv4 traffic through PSAM Tunnel on macOSX.

Condition: Sending the data without mentioning the data length.

Workaround: Sending the data by defined data length.

Symptom: Intermittently facing resource access issues

Condition: SplitDNS feature is enabled.

Workaround: Disconnect and Reconnect the VPN connection.

Symptom: Intermittently observing the "Invalid PCS URL" pop up.

Condition: When VPN got disconnected due to some issues.

Workaround: Click Ok and Reconnect.

Symptom: BSOD in call out functions of splitdnsfilter driver (Inbound and outbound.) if third party drivers (Symantec, McAfee) are present in the network stack of Tunnel adapter.

Condition: Issue is caused by an interop issue between splitdnsfilter driver and other third-party drivers.

Workaround: Disable third party software.

Release 9.1R14

Symptom: IPv6 UDP traffic fails on PSAM tunnels.

Condition: IPv6 resource configured in the ICS and when PSAM tunnel established with IPv4/IPv6 connection, Failed to send IPv6 UDP traffic.

Workaround: None.

Symptom: dsAccessService daemon re-starts and FQDN resource gets routed through physical adapter instead of tunnel.

Condition: User accessing a FQDN resource that is configured in ICS as follows, Split tunnel policy is set FQDN resource to route through tunnel along with some IPv4 resources whereas FQDN's corresponding IP is set to route through physical adapter and precedence of FQDN over IP address is configured under System - > Configuration -> VPN tunneling.

Workaround: None

Symptom: Even after the successful Pulse client Installation/Upgrade, the "Installing Application Please Wait " or "launching application" pop-up stays on the screen for a few seconds.

Condition: Minimum client version enforcement and forceful upgrade are enabled on the ICS.

Workaround: None.

Note - This behavior is not applicable for normal/legacy PDC upgrades.

Symptom: On macOS the Pulse client download proceeds without the user consent.

Condition: When MCV forceful upgrade is enabled on the ICS by admin.

Workaround: None.

Symptom: Context switch from User to machine is taking more than 3 mins.

Condition: This happens during Credential provider and Machine authentication use case, where 2nd user logs into machine and logs off.

Workaround: None

Symptom: On-screen keyboard blocks the view of PDC window and hides the typing text from users view.

Condition: When using on-screen keyboard for typing on systems with Windows 10 or Windows 11 operating system having touch screen capabilities.

Workaround: Adjust the PDC window to have a better users view when using on-screen keyboard.

Symptom: The cefBrowser.exe.dmp files get generated in the background sometimes. No user/functionality impact.

Condition: This issue is observed on Windows 10 Enterprise N machines.

Workaround: None.

Release 9.1R13

Symptom: PDC on Mac system preserves client side proxy settings as available on establishing VPN connection instead of disable client side proxy settings.

Condition: When admin configured "disable client side proxy settings" under Users > Resource Policies > connection profiles (select respective profile) > Proxy server settings.

Workaround: None.

Symptom: The "This Site can’t be Reached" error message displays for few seconds during SAML Authentication

Condition: When untrusted certificate is configured on the PCS.

Workaround: Use the trusted certificate on PCS.

Symptom: A Warning Icon displays on the top left corner of the CEF browser.

Condition: When using CEF92 browser.

Workaround: None

Symptom: Launching or triggering installation of Pulse client from Internet Explorer fails.

Condition: When launching PDC from IE.

Workaround: None.

Symptom: CEF Browser download goes in a loop.

Condition: When Pulse client is downgraded from R13 to R12.

Workaround: Delete all files from "C:\Program Files (x86)\Common Files\Pulse Secure\JamUI\CEFBrowser\x86" except temp, CefBrowser.exe, and CefSubprocess.exe and download again.

Symptom: For SAML authentication using embedded browser, user is prompted for credentials every time even when SLO is not enabled.

Condition: When the FIDO2 CEF Browser is enabled for embedded browser

Workaround: None

Symptom: Pulse Client Firewall System Extension logs are written to the old debuglog.log filename

Condition: When Lockdown or Traffic Enforcement is enabled.

Workaround: None

Symptom: When user clicks Disconnect, the connection is stuck in Disconnecting state for 120 seconds.

Condition: This happens only when CEF Browser is enabled (U2F) for SAML authentications and SAML Single LOgout(SLO) is configured for the same connection. After the two minutes, the next time user connects, the connection goes through, and credentials prompts are correct.

Workaround: None

Symptom: DNS Alias Name are not added to proxy.pac file.

Condition: Access sites through browsers when connected to VPN

Workaround: None

Symptom: PulseClient.log file is not present in diagnostic bundle.

Condition: Collaboration Client installed with latest PCS build does not include PulseClient.log file in diagnostic bundle.

Workaround: End-user must manually collect and share PulseClient.log file.

Release 9.1R12 (Windows 11 updates)

Symptom: End users see disconnects and reconnects on the PDC UI.

Condition: When connected to PCS that resolves to IPv6.

Workaround: PCS resolves to IPv4 address.

Symptom: (Host Checker) OS check pass on Windows 11 systems.

Condition: Policy is configured for "Windows 10-64-Bit".

Workaround: None.

Symptom: Pulse Desktop Client continuously changes between connected and connecting states.

Condition: When connected to PCS that is configured in SSL Transport mode.

Workaround: Configure ESP Transport Mode.

Symptom: Not able to connect the resource from WSL on windows 11 through PSAM.

Condition: Install Ubuntu 20 with WSL 2 on Windows11 and try to connect to resource behind PCS server through PSAM.

Workaround: None.

Symptom: SAML, Custom Sign-in pages and Pulse Collaboration features do not work with External Browser on Windows 11.

Condition: When using external browser.

Workaround: Use Embedded browser.

Symptom: Pulse Client Agent Type on PCS “Active Users” Page shows as "Windows 10 Pulse Secure" for Windows 11 end points.

Condition: When using Windows 11 Operating System.

Workaround: None.

Symptom: Pulse client VPN tunnel connection fluctuates with Split-Tunnel.

Condition: When connected to PCS that is configured in ESP Transport mode along with (IP/FQDN) Split-Tunneling.

Workaround: None.

Symptom: Telnet/SSH bookmarks are not working on Windows 11

Condition: When using Windows 11 as client machine.

Workaround: None.

Release 9.1R12

Symptom: PCS Active users page displays Non-FIPS build as FIPS build for Mac client.

Condition: Mac Client with Non-FIPS build (PDC build with OpenSSL 111).

Workaround: None.

Symptom: When accessing certain resources, Pulse Desktop Client gets disconnected and does not reconnect automatically.

Condition: When the DNS response for a particular resource exceeds 8192 bytes, then PDC is not able to process the response. The service crashes and is not able resume the prior session.

Workaround: None.

Symptom: On connecting to a PCS with R12, a Console Window flashes briefly, once - during the first connection.

Condition: If the installed Pulse SetupClient's version is lower than the PCS, Setup Client gets upgraded on first connection. During this upgrade, a Console Window flashes briefly.

Workaround: None.

Symptom: After successful SAML authentication VPN session is not migrating from the CEF browser to the Client shows the blank screen.

Condition: When SAML authentication is configured for Default sign-in URL with “Enable FIDO2 U2F for SAML authentication” is configured in the connection set.

Workaround: Use non Default sign-in URL for SAML authentication.

Symptom: Administrator deleted custom lockdown exception rules are still effective on pulse desktop client system.

Condition: This issue arises only when administrator deletes all manually added lockdown exceptions. Deleting one or many manually created lockdown exceptions works good.

Workaround: Administrator to set the Action as "Block" on all manually added rules when deleting all manually created lockdown exception rules.

Symptom: On Windows server 2019, upon client upgrade, the connection list keeps getting reloaded again and again.

Condition: Occurs only during upgrade and not with fresh install.

Workaround: Uninstall the existing client and install the new client.

Symptom: On task bar Wi-Fi symbol Yellow exclamation mark with no internet access appears, though PDC is connected and shown as up. Internet & Pulse Intranet sites are unreachable.

Condition: This is observed on Windows 10 1909 laptop. PDC is connected and suddenly after 30-40 mins of usage Internet / Pulse Intranet sites go unreachable. On Wi-Fi symbol Yellow exclamation mark with no internet access appears, but PDC still shows as up and connected.

Workaround: End used need to disconnect PDC connected profile and needs to reconnect to regain the internet and intranet sites.

Symptom: On rare occasions, observed PulseSetupClient crash on macOS.

Condition: None.

Workaround: None. The Client recovers automatically.

Symptom: On rare occasions, observed the dsAccess service crash.

Condition: None.

Workaround: None. The client recovers automatically.

Symptom: FIDO2 Yubikey Authentication is failing on Windows8.1.

Condition: When Azure AD is used as IDP.

Workaround: None.

Symptom: FIDO2 Yubikey Authentication is failing on macOS.

Condition: When Azure AD is used as IDP.

Workaround: None.

Symptom: FIDO2 Yubikey Authentication is failing to prompt the pin.

Condition: During the Credential Provide use case.

Workaround: None.

Symptom: With SLO enabled, during client Disconnect untrusted cert prompt will come twice for user to accept.

Condition: This happens only If the PCS is not having a valid certificate.

Workaround: None.

Symptom: Pulse Client occasionally prompts for the credentials during SAML authentication through browser even when SLO is disabled.

Condition: When the CEF browser is used for the SAML Authentication.

Workaround: None. Enter credentials to sign in.

Symptom: User is able to proceed with connection after clicking the decline on pre sign-in notification.

Condition: Pre sign-in notification along with SAML authentication.

Workaround: None.

Symptom: Traffic not routed as per the FQDN rules.

Condition: FQDN based split tunneling is configured.

Workaround: None.

Symptom: Connection stays in connect requested state.

Condition: After fresh installation.

Workaround: Need to restart the system.

Release 9.1R11.5

Symptom: ESAP download fails through Pulse Client when host header validation is enabled on PCS.

Condition: When Pulse client session is initiated through Browser and the PCS is configured with ESAP versions higher than 3.4.8.

Workaround: Initiate connection from Pulse client.

Symptom: End-user gets prompted to re-enter credentials after upgrading the Pulse client.

Condition: Upon the Pulse Client upgrade.

Workaround: None. Re-enter the credentials.

Symptom: On some machines, the pulse client upgrade prompt is not seen for the end-user when connecting to 9.1R11.5 PCS using the older client (like 9.1R11.3 or 9.1R11.4).

Condition: Only for non-admin users.

Workaround: Upgrade Client using Browser.

Release 9.1R11.4

Symptom: Pulse Desktop Client (PDC) always displays upgrade prompt even when client version on the endpoint and the server are same. Clicking on upgrade prompt performs no action (Cosmetic/UI issue).

Condition: Occurs when the Pulse Desktop Client has Symantec signed binaries and the PCS on which it is hosted (9.1R11.3/ 9.1R10.2/ 9.1R9.2/ 9.1R8.4) is signed by Digicert.

Workaround: Disable End-point upgrade on Pulse Connect Secure (PCS). Enable again only when a higher version of PDC is activated on PCS and let the users trigger the client upgrade through the browser.

Symptom: Connection from standalone PDC prompts an upgrade, but proceeding with the upgrade fails.

Condition: The upgrade fails when directly connecting to a PCS server with PDC version higher than that is currently installed on the endpoint.

Workaround: For workaround, refer to KB44792.

Symptom: 'Failed to download application' error seen on Pulse client after connecting to PCS.

Condition: This is seen on some machines, when Pulse Client is deployed with SCCM.

Workaround: Reboot the endpoint or Kill Pulse Secure Setup Client from task manager.
Note: This is one time activity.

Release 9.1R11

Symptom: With Pulse client as 802.1x Wireless supplicant, the wireless connection fails to get an IP address even though authentication succeeds.

Condition: This happens only if TLS 1.2 is not used for the EAP and TLS communication and TLS 1.1 or lower version gets used.

Workaround: None.

Symptom: Certificate authentication in combination with Credential Provider log on fails, after user enters windows log on credentials at Credential provider tile.

Condition: This happens only when certificate authentication was configured with Credential Provider in both L2 and L3 access scenarios.

Workaround: None.

Symptom: PulseService crash is observed once user manually kills the PulseService.exe from TaskManager and PulseService tries to recover automatically.

Condition: When PulseService is running successfully and user manually kills the PulseService from TaskManager.

Workaround: None.

Symptom: PSAM Fails to intercept Web application traffic using Java Applet when IPv6 is enabled on PCS. Configured resource is not accessible using Java based APIs.

Condition: IPv6 is enabled on PCS and PSAM destination policy is configured for the application.

Workaround: None.

Symptom: When Enable Driver Logs option is enabled and try Save/Upload logs (within 5 secs), the driver logs are not generated.

Condition: The flush timer to disk for driver logging has been set as 5 secs and hence this behavior.

Workaround: None.

Symptom: Enable Driver Logs option is disabled if already enabled while exiting Pulse.exe.

Condition: This is done to avoid driver logging running in the background even though the user has exited the application.

Workaround: If the user exits the application, enable the “Enable Driver Logs” option from the menu to start the driver logging.

Symptom: On uninstalling the Pulse Client, the jnprva.sys and jnprvamgr.sys files are retained in C:\Windows\System32\drivers directory.

Condition: The files are expected to be removed from drivers directory when the uninstall process is complete.

Workaround: None.

Symptom: Failure message displays when VPN connection is established with HC remediation.

Condition: Connect to VPN with HC remediation.

Workaround: With remediation, Pulse application shows failures message on UI before connecting.

Release 9.1R10

Symptom: Linux Legacy client (NC client) will not be released from 9.1R10 Release

Condition: From 9.1R10 Release

Workaround: Use 9.1R9 or earlier Linux Legacy Client (NC Client).

Symptom: When connecting to PCS through browser, PSAL detection time runs out and manual download is offered, even though PSAL is installed.

Condition: Extra components need to be downloaded the first time the user connects to PCS version >= 9.1R10, to upgrade from version < 9.1R10 (the issue is not triggered for fresh installations, or for future upgrades after 9.1R10). If the internet connection is not fast enough the PSAL is not upgraded in time, and the PSAL detection time runs out.

Workaround: Users need to wait 3+ minutes (dependant on internet connection speed) and click “Try Again” on the website.

Symptom: Host Checker fails to launch with the latest PCS build on Safari browser.

Condition: When IPv6 address is used instead of FQDN.

Workaround: Recommended to use FQDN.

Symptom: Active user page “Agent Type” shows “Mac OS 10.15" and it should be “Mac OS 11.0.1".

Condition: Use Safari on macOS version BigSur 11.0.1.

Workaround: None.

Symptom: Pulse Client Download is failing when Host Header is enabled on the Server.

Condition: With Host Header option Enabled on PCS/PPS.

Workaround: Disable Host Header to upgrade the clients. For more information refer to KB44646.

Symptom: Pulse Client upgrade pop up is not prompting when Host Header is enabled on the Server.

Condition: With Host Header option Enabled on PCS/PPS.

Workaround: Disable Host Header to upgrade the clients. For more information refer to KB44646.

Symptom: Pulse Unified Linux Client requires dependency of libgtkmm-3.0-1v5. The dependency is not install-able by running the command apt-get install libgtkmm-3.0-1v5

Condition: The operating system is Ubuntu 18.04

Workaround: Append the following line to /etc/apt/sources.list:

deb http://cz.archive.ubuntu.com/ubuntu bionic main

Execute the following commands to install the dependency:

apt-get update

apt-get install libgtkmm-3.0-1v5

Install Pulse Client using the below command:

dpkg -i /path/to/pulsesecure-version.deb

Symptom: Pulse Unified Linux Client does not save logging level information across multiple launches.

Condition: Pulse Unified Linux Client is installed in Linux Operating System.

Workaround: None.

Symptom: Pulse Unified Linux Client fails to kill processes as part of host checker remediation.

Condition: If the processes are started through a wrapper script (like bash or python), then in such a case, Pulse Client fails to identify and kill such processes as part of remediation based on MD5 sum of the script.

Workaround: None.

Release 9.1R9

Symptom: Host Checker OS check failure on Big Sur.

Condition: Big Sur is configured as part of OS Check for MAC.

Workaround: None.

Symptom: Web process crashes observed on Pulse Connect Secure Appliance.

Condition: With new PSAM improvement changes, when PSAM is configured with client application functionality, ACL Deny results are always treated as UDP connection deny request which is causing the issue.

Workaround: Configure resources with WSAM destinations.

Symptom: Invalid server message appears during browser based PDC installation.

Condition: During fresh browser based PDC installation

Workaround: N/A

Symptom: Pulse client prompts for credentials when client is installed or invoked through browser.

Condition: When Pulse Client is installed or invoked from browser with FIPS option enabled in PCS.

With this combination if Pulse Client is invoked, session resumption fails and Pulse client prompts for credentials to connect.

Workaround: Need to provide credential to connect to Pulse client in this specific workflow.

Symptom: Installation of Pulse Linux Client on Ubuntu is failing.

Condition: Ubuntu 18.04.5 is installed. Required dependencies are not available in default repositories.

Workaround: Download and install dependencies manually.

Symptom: Initiating command line authentication results in crash of Pulse service.

Condition: This happens only in Pulse Client installed on HP Thin Pro.

Workaround: Kill any running instances of pulsesvc service and initiate command line authentication again.

Symptom: If a SAML classic connection and PZTA connection of Pulse client both use same IdP and same user accounts, SAML Single Logout (SLO) will not happen during ZTA disconnect and credentials are not prompted in some scenarios.

Condition: If a SAML classic connection with SAML SLO enabled and a PZTA connection are both part of the client connection list.

Workaround: None.

Symptom: If a SAML classic connection and PZTA connection of Pulse client both use same IdP but different user accounts, login fails during second connection.

Condition: When using same IdP but different user accounts to login.

Workaround: Clear all the cookies from the IE (Internet Explorer) and retry the connection.

Symptom: On Windows server(2019), SAML Login fails when using Embedded browser.

Condition: When using Embedded browser to login.

Workaround: None

Symptom: On windows, Pulse Client crashes when manually setting to future date and time and executing "Sync Now".

Condition: Pulse client does not support "Sync Now" with future date and time.

Workaround: None.

Symptom: On Windows CredentialProvider UI, the keyboard shortcuts - Tab and Enter do not work as expected.

Condition: SAML enabled along with Windows CredentialProvider.

Workaround: Shift focus to other fields using Mouse pointer.

Symptom: Default fallback time for ESP to SSL is 15 seconds in PCS, if this default time is changed to 1000 seconds ESP does not fallback to SSL mode.

Condition: Modifying default ESP to SSL fallback time.

Workaround: Retain the default values for ESP to SSL fallback.

Symptom: ESP mode falls back to SSL if custom port is configured in ESP mode in PCS.

Condition: Custom port is configured for ESP.

Workaround: Retain default port configuration while selecting the ESP mode.

Symptom: For a SAML connection with Single Logout (SLO) enabled, during a server initiated disconnect like session expiration or idle time out, the IdP session is not logged out.

Condition: NA

Workaround: None. Pulse client prompts for user credentials when the user tries to connect again.

Symptom: PCS is not responding to ping with payload size larger than the MTU size.

Condition: Issue occurs in 4in6 scenario , when we ping protected resource with large packet size.

Workaround: None.

Symptom: During SAML authentication using embedded browser, when user tries to login, the username field is not populated in the embedded browser by the IdP sometimes.

Condition: When a connection with SAML Single Logout (SLO) and embedded browser enabled.

Workaround: Re-enter the username.

Symptom: Unified Pulse Linux Client not installable on Ubuntu 20.04.1.

Condition: Ubuntu 20.04.1 latest build does not provide the dependency net-tools which is required to install Unified Pulse Linux Client

Workaround: Install net-tools dependency by manually downloading it from Ubuntu website. Then install Pulse Client.

Symptom: Unified Pulse Linux Client fails to install on Fedora 30 64 bit OS.

Condition: Right version of dependency webkit2gtk3, namely 2.24.1 is not available in default repositories of Fedora 30 64 bit OS

Workaround: Install dependencies along with webkit2gtk3, which installs version 2.24.1. Then update webkit2gtk3. This will upgrade to version 2.28.2. After this, install Pulse Client. This will result in successful installation

Symptom: Upgrade from old Pulse client to new Pulse client is not supported.

Condition: Upgrade to new Pulse client.

Workaround: None

Symptom: Host Checker remediation results in multiple connections to the PCS server, and multiple certificate prompts

Condition: Pulse Client repeatedly prompts for certificate validation.

Workaround: None

Symptom: Uninstalling the Pulse Client does not remove CEF browser and Connection store.dat file.

Condition: Pulse Client retains the CEF browser and Connection store.dat file on uninstall.

Workaround: None

Symptom: CEF returned PCS server Certificate validation failures are displayed to user

Condition: Lists the PCS server Certificate validation failures.

Workaround: User can decide to proceed the connection.

Symptom: Download of CEF runtime library takes place over HTTP instead of HTTPS

Condition: When CEF runtime library is installed

Workaround: None

Symptom: Pulse client fails to prompt any error message for SAML authentication.

Condition: When “Enable Embedded Browser for Authentication” is disabled in the connection set.

Workaround: Select “Enable Embedded Browser for Authentication” option in server then import the connect set.

Symptom: No shell script to install dependencies for Unified Pulse Linux client.

Condition: Shell scripts to install dependencies for Unified Pulse Linux client.

Workaround: Install dependencies manually

Symptom: Host Checker policy evaluation fails if multiple policies are configured to be only “evaluated” instead of “enforced”

Condition: Host checker policy evaluation

Workaround: None

Release 9.1R8.2

Symptom: Pulse system extension activation flow fails to kick-in until pulse client is relaunched if network is not available.

Condition: When end-user system is not connected to network (WiFi/LAN).

Workaround: Exit Pulse Client from Pulse tray and re-launch Pulse Client.

Symptom: Host Checker evaluation error is shown when connecting to PCS through browser after 9.1R8.2 Host Checker components get installed.

Condition: When end-user tries to connect to PCS servers with older versions over browser.

Workaround: Click “try again” to solve the HC evaluation error.

Symptom: Sometimes, on Chrome browser before re-directing to PSAL download page, a gibberish message is displayed in a popup.

Condition: When connecting to a PCS on Chrome browser.

Workaround: Refresh the Chrome Browser or use Safari.

Symptom: IT administrators can upload the package but cannot install successfully.

Condition: Latest PDC client version is distributed through PCS versions earlier than 9.1R8.2.

Workaround: Manually install PSsetupClient.dmg, PSAL.dmg to patch installed version of Setup Client and PSAL on the machine.

Symptom: Pulse System extension process is running upon reboot when Traffic Enforcement was previously activated for the user.

Condition: Traffic Enforcement was previously activated for the user.

Workaround: Unistall Pulse Client and reboot.

Symptom: Lockdown Exceptions may not work as expected due to Process Path missing in certain conditions.

Condition: Lockdown/Traffic Enforcement mode is active.

Workaround: None.

Symptom: Apple embedded browser pops up when pulse client uses captive portal environment.

Condition: Lockdown mode or Captive Portal detection is enabled.

Workaround: Manually close the Apple Embedded Browser.

Symptom: Post installation of Pulse Client, user notices that the connection is established without ESP.

Condition: If ESP mode is enabled with traffic enforcement.

Workaround: If reconnect fails, manually disconnect from the server and reconnect.

Symptom: Pulse System Extension is not fully uninstalled. “systemextensionsctl list” command shows state “uninstalling”.

Condition: Uninstall Pulse Client and reboot.

Workaround: State “uninstalling” is always shown initially after the reboot. After some time, run the command “systemextensionsctl list” again and the item disappears from the list.

Symptom: When a custom lockdown exception is configured on PCS, endpoint does not reflect the changes.

Condition: The exceptions configured as Custom are omitted by the client.

Workaround: None.

Release 9.1R8

Symptom: The in Sign-In Notification page shows the text underlined.

Condition: Upgrade to Pulse Desktop Client 9.1R8.

Workaround: None. For more information, refer to KB article KB44548.

Symptom: Pulse client installation and upgrade is failing on Windows 8, 32-bit machine.

Condition: Standalone as well as browser based Installation and upgrade is failing on Windows 8, 32-bit machine.

Workaround: None.

Symptom: On macOS, Pulse Client service crash observed while replacing the Connection-set through browser.

Condition: During the new connection set replacement through browse.

Workaround: None. Client recovers automatically.

Symptom: Loading of PSAL and getting the PSAL launch prompt takes more than 15 minutes with FireFox web browser on Window10.

Condition: This issue is observed with specific combination FireFox 68.10.0 ESR Version and Windows 10.

Workaround: Get the latest Version for FireFox Web Browser 78.0 ESR Version.

Symptom: Pulse client is not getting uninstalled completely.

Condition: When client is uninstalled through msi.

Workaround: Reboot the machine or end process (PulseSecureService.exe) from task manager.

Symptom: PDC client prompts to enter AD login credentials even though the login details are already saved.

Condition: Login details are already saved.

Workaround: User has to re-enter the login details.

Symptom: In Active Users Page does not display Windows version.

Condition: When End user establishes a VPN connection from Windows endpoint.

Workaround: None.

Symptom: Pulse Client prompts for reboot after the successful upgrade and connections are not getting imported.

Condition: When a client is upgraded through browser as non-admin user.

Workaround: Close the Reboot prompt window and launch Pulse Client from the browser.

Symptom: On macOS Pulse Client service crash is observed during log rotation.

Condition: Occasionally, during log file rotation.

Workaround: None. Client recovers automatically.

Symptom: Intermittently PDC fails to establish tunnel during Host Checker evaluation.

Condition: Host Checker evaluation fails at client side.

Workaround: Reboot the machine.

Symptom: Pulse Client UI temporarily becomes unresponsive or crash during freshly installation Or upgrade. End user may also observe this behavior during an active connection to Server.

Condition: When using configurations such as SSL/FIPS or L3/L4 VPN connection.

Workaround: None. When connected to Server, this issue is observed only with the Pulse Client UI and not with the Tunnel service. Pulse Client UI automatically restarts without disrupting existing connection or tunnel traffic.

Symptom: 'Advanced Connection Details' translation string of Pulse client on non-english OS is not correct.

Condition: During 'Advanced Connection Details' check.

Workaround: None.

Symptom: When accessing UDP traffic with Pulse SAM cause memory leak

Condition: UDP Applications access in Pulse SAM tunnel.

Workaround: Reboot the machine.

Symptom: Multicast traffic is not tunneled through Pulse client.

Condition: When Multicast is enabled for user role, the multicast applications cannot send multicast traffic to server.

Workaround: None

Symptom: macOS user may observe pulse client is connecting twice during dual authentication.

Condition: Pulse client is connecting twice during dual authentication.

Workaround: None

Symptom: Host Checker installation error found Intermittently while installing Host Checker or Pulse Client [HC enabled] through browser [Chromium Edge/Chrome/Firefox]

Condition: Fresh Installation of Host Checker or Pulse Client [Host Checker enabled] through browser [Chromium Edge/Chrome/Firefox] after uninstalling old Host Checker components.

Workaround: Perform one of the following:

Uninstall the Host Checker/Pulse Client components manually and reboot the system.

Manually kill Host Checker process before installing Pulse Client/Host Checker Component.

Release 9.1R7.1

Symptom: Pulse Client gets stuck at Host Checker when endpoint has Pulse Secure Installer Service (PSIS) older than 9.1R7.1 installed.

Condition: Issue occurs when Host Checker with SAML authentication is configured and external browser is used for SAML authentication.

Workaround: Perform the actions when Pulse Client is launched in following ways:

Through a browser: Disable HC

SAML based Authentication: Use embedded browser or disable HC

Directly: No issue

If above workarounds cannot be implemented, use the new PSIS that is available separately.

Symptom: Pulse Client UI reports “Pulse Secure service is not running”.

Condition: Issues occurs when Pulse9.1R7 Client is used with PSIS Older than 9.1R7.1 and HC configured on the Realm.

Workaround: Perform the actions when Pulse Client is launched in following ways:

Through a browser: Disable HC

SAML based Authentication: Use embedded browser or disable HC

Directly: No issue

If above workarounds cannot be implemented, use the new PSIS that is available separately.

Release 9.1R7

No new known issues for this release.

Release 9.1R6

No new known issues for this release.

Release 9.1R5

Symptom: Slight increase in time may be observed in establishing tunnel.

Condition: Users might observe slightly increased time to establish connection over VPN.

Workaround: None.

Symptom: PULSE Help on macOSX 10.15.3 Catalina does not open

Condition: Impact on Help pages

Workaround: PDC help pages are available online under Technical Publications.

Symptom: When embedded browser is used, Pulse is not caching the IDP session cookie.

Condition: The session on the IDP was still active and the user gets the prompt.

Workaround: None.

Symptom: Failing in DSID resumption after SAML auth from external browser.

Condition: Client fails to establish connection with PCS.

Workaround: Use embedded Browser.

Symptom: After disconnecting SDP 2.5 connection. Classic connection prompts for multiple authentication.

Condition: On connecting a SDP connection and then re-initiating classic connection.

Workaround: None.

Symptom: Pulse Collaboration (When launched from pulse client) functionality is broken with enabling of 'HTTP Only Cookie' for user role.

Condition: When the user provides the credentials, Pulse connection disconnects and Pulse Collaboration launches.

Workaround: Disable the ’HTTP Only Cookie’ option.

Release 9.1R4.2

No new known issues for this release.

Release 9.1R4.1

No new known issues for this release.

Release 9.1R4

Symptom: Application type strings are not displaying properly in localized languages.

Condition: For a few languages.

Workaround: None

Symptom: Pulse Desktop Client throws Authentication rejected by server error for SAML authentication.

Condition: When attempts to connect to a Global URL.

Workaround: None

Symptom: PSAM WFP mode blocks local socket bind operations.

Condition: When performing pass packet for the local IPs, the packet was blocked by the current framework.

Workaround: None

Symptom: Host checker error is found while installing Pulse Client via Chromium-based Edge browser.

Condition: When Host Checker is configured.

Workaround: Click Ignore button.

Symptom: Pulse Desktop Client is unable to establish the tunnel.

Condition: With non-PIV smart cards on Catalina.

Workaround: None

Symptom: FQDN split tunneling resource access is going through physical adapter instead of virtual adapter.

Condition: CNAME support is not there for FQDN split tunneling.

Workaround: None

Symptom: User is unable to access the internet.

Condition: When CAV feature is disabled.

Workaround: User can change registry settings as advised below and remove proxy settings from Proxy setting dialogue of Windows.

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel]

"Proxy"=dword:00000000

"Autoconfig"=dword:00000000

Symptom: Connection set is not adding in the installed Pulse Desktop Client.

Condition: When Pulse Desktop Client is launched through the browser.

Workaround: None

Symptom: Pulse Desktop Client hangs while adding connection.

Condition: When the user attempts to add the Pulse Desktop Client connection.

Workaround: Restart the machine.

Symptom: Manual extend session is failing for the first time and prompts with error "Too many concurrent users".

Condition: When the user selects the Extend session option.

Workaround: Pulse Desktop Client automatically prompts for re-authentication, which will extend the session successfully.

Symptom: Windows Hello for Business session is failing with (Missing Certificate) error.

Condition: When the user attempts to establish Pulse Desktop Client connection Windows Hello for Business session for the first time.

Workaround: Connection is established successfully after a few minutes.

Release 9.1R3.1

There are no new known issues for this release.

Release 9.1R3

Symptom: Intermittently PDC is prompting end-user to select the certificate when both Smart card plugged-in and user certificate presents.

Condition: When PDC is upgraded from 9.XRY where X<= 1 and Y < 3 to 9.1R3.

Workaround: Export/ import current config using Jamcommand to update connstore.

Symptom: 9.1R3 PDC latest strings are not localized.

Condition: If end-user has 9.1R3 PDC.

Workaround: N/A

Symptom: Pulse Desktop Client UI is fluctuating on one of the HP models.

Condition: End user uses HP EliteBook 840 G5.

Workaround: NA

Symptom: Credential Provider feature does not work when there is no Tile present during user login.

Condition: L3 and L2 CP feature will not work.

Workaround: NA

Symptom: Admin should allow to enable any one option either "Windows secure Application manager" or "VPN Tunneling".

Condition: When WSAM is enabled, PSAM also gets enabled as WSAM is now deprecated. Along with this VPN Tunneling option is not to be chosen as Pulse Secure Client will be enabled.

Workaround: Choose either WSAM or VPN Tunneling option.

Symptom: Still Downloads of NC and WSAM were allowed.

Condition: Only admin users can download using URL

Workaround: NA

Symptom: Network Connect client will be able to upgrade and connect.

Condition: Since we need to support existing Network Connect client users, the binary is a part of package.

Workaround: Since upgrade is done as part of initial connect, no action is needed.

Symptom: Home button does not appear after upgrade.

Condition: On upgrading the pulse client.

Workaround: Disconnect and connect back to the controller.

Symptom:5.2RX PDC clients are able to establish a successful tunnel in the absence of Client Auth EKU.

Condition: When "Enable Automatic Client Certificate Selection" is enabled.

Workaround: N/A

Symptom: Unable to establish tunnel with smart card reader.

Condition: When end-user has latest 10.15 Mac OS i.e. Catalina.

Workaround: N/A

Symptom: Un-installing of Pulse Desktop Client is asking for a reboot.

Condition: Observed on Windows 10 OS RS6 i.e. 1903.

Workaround: N/A

Symptom: With the latest SRX OS UAC L3 connection is failing to establish.

Condition: If SRX OS version is 15.X and above.

Workaround: N/A

Release 9.1R2

Symptom: Older PSIS is not upgrading to 9.1R2 PSIS version.

Condition: When Pulse Client is deployed from 9.1R2 on Windows endpoints, PSIS is not upgraded to the latest version.

Workaround: Old PSIS will continue to work and no impact seen.

Symptom: Pulse Client is getting disconnected frequently after connecting to PCS on macOS.

Condition: The endpoint should be dual stack. PCS should be configured for FQDN based split tunneling with Route Monitor enabled.

Workaround: Disable the option Route Monitor.

Release 9.1R1

Symptom: For launching from a URL, the following are the prescribed parameters: connect, name, server, userrealm, username. Launching using a URL might throw an error, if: The same parameter is included multiple times while crafting the URL. Any other non-prescribed parameter, other than above-mentioned five prescribed parameters are used.

Condition: Entering multiple values for the five parameters (name, server, userrealm, username and store) or any additional parameter,

For example, multiple values (USER1 and USER2) for the parameter username and multiple values (TRUE and FALSE) for the parameter store are entered.
pulsesecureclient://connect?name=NAME&server=SERVERURL
&userrealm=REALM&username= USER&store=TRUE&extra=TRUE&other=SOMETHING

In this example, a non-prescribed parameter (other) is used.

Workaround: None.

Symptom: When launching using a URL, some characters in the username parameter might not get displayed in the UI as expected

Condition: Entering the username parameter in the following URL: pulsesecureclient://connect?name=NAME&server=SERVERURL
&userrealm=REALM&username=test&=user&store=TRUE

In this example, username will be considered as "test" instead of "test&=user".

Workaround: Use ASCII encoding values for special characters.In the above-mentioned example, for the username to be considered as "test&=user", use %26 for & and %3D for = in the URL.

Symptom: Launching using a URL is not working as expected for differently worded values for the "server" parameter.

Condition: Entering differently worded values for the "server" parameter. The following three URLs refer to the same connection, but server values are worded differently. Though the connections with the following three server URLs (https://pcsserver.com/sign-in/, https://pcsserver.com/sign-in, pcsserver.com/sign-in) would ideally be the same connection, these three connections are treated as different connections while launching from a URL.

Workaround: None

Symptom: L3 based FQDN Split Tunneling feature with PSAM coexistence is not supported.

Condition: Dual Stack is enabled on a Pulse Client machine.

Workaround: None

Symptom: A user is not able to download the Pulse Client from any package.

Condition: The Pulse Client package is uploaded before the PCS upgrade.

Workaround: Upload the junosepulse.pkg and download the installers.

Symptom: Unable to connect to a PCS Server from Pulse Client for Linux.

Condition: Primary network card of a machine has multiple aliased IP addresses set.

Workaround: Ensure that the primary network card does not have multiple aliased IP addresses.

Symptom: Wireless LAN L2 connection disconnects immediately when the LAN L2 connection is established.

Condition: When FIPS is enabled for L2 wireless connection.

Workaround: Disable the FIPS in wireless connection.

Symptom: Pre-9.0R3 Pulse Client fails to establish the Pulse SAM connection with PCS 9.1R1.

Condition: A Pulse SAM connection fails when a pre-9.0R3 Pulse Client tries to establish the Pulse SAM connection with PCS 9.1R1.

Workaround: To upgrade Pulse Client to 9.1R1, launch Pulse Client through a browser.

Pulse SAM connection fails to connect due to the following error:
"Failed to set dns name query event, err:87" or "Failed to set netbios query event " or "Failed to set tcp/udp samize event" or "Failed to set tcpConnect event" or "Failed to set dns srv query event".

Symptom: Shutting down the client PC will trigger the machine tunnel.

Condition: Credential Provider option is enabled, and the user shuts down the client PC.

Workaround: None

Symptom: Pulse Client will take few seconds to show as connected when the client PC goes from sleep mode to awake mode.

Condition: Credential Provider option is enabled, and the client PC goes to sleep mode.

Workaround: None

Symptom: Pulse Client fails to trigger the Credential Provider.

Condition: When the Windows machine gets restarted.

Workaround: None

Symptom: While launching Pulse Client from a URL, it prompts for the realm name information, even if the realm name is mentioned in the URL.

Condition: When Allow saving logon information option is not enabled in connection profile.

Workaround: Enable Allow saving logon information option in connection profile.

Symptom: In case of an upgrade triggered from Pulse Client from version 9.0R3 to 9.1R1 and after the upgrade process is completed, the user is unable to connect, and a network error is displayed in the connection status of the Pulse Client UI.

Condition: Upgrade using Pulse Client on Windows 10 (x64) Redstone 5.

Workaround: Reboot the machine after the upgrade or restart the Ivanti service.

Symptom: User attempts to log in to a browser-based session fail with the error message "Detected an Internal Error” sometimes.

Condition: When accessing Mac via Safari.

Workaround: Restart the machine.

Symptom: Pulse Client fails to add the route in case of FQDN based split tunneling.

Condition: While adding the route in the local system.

Workaround: None

Symptom: Upgrading Pulse Client for Linux displays the following warnings:

ln: failed to create symbolic link '/usr/local/pulse/libjavascriptcoregtk-1.0.so': File exists

ln: failed to create symbolic link '/usr/local/pulse/libjavascriptcoregtk-1.0.so.0': File exists

ln: failed to create symbolic link '/usr/local/pulse/libwebkitgtk-1.0.so': File exists

ln: failed to create symbolic link '/usr/local/pulse/libwebkitgtk-1.0.so.0': File exists

Condition: While adding the route in the local system.

Workaround: None

Symptom: Advanced connection details are not displaying as expected for SAML embedded browser-based authentication.

Condition: When Enable Session Extended option is enabled.

Workaround: None

Symptom: FQDN resource is going through the tunnel, even though it is configured in split tunneling excluded policy.

Condition: When FQDN based split tunneling is enabled.

Workaround: None

Symptom: L2 Wireless suppression fails to re-enable the wireless NIC.

Condition: Unplugging the wired USB network adapter from Surface Pro.

Workaround: None

Symptom: For stealth mode connection Use Desktop Credentials option should not be enabled while creating the connection.

Condition: When stealth tunnel is configured for “Machine only” mode.

Workaround: None

Symptom: Pulse Client will be in connect state after replacing the connection set with the manually added connection.

Condition: When added Sign-In URL is configured with VPN Only Access/Always-on VPN and Lock-down option is enabled.

Workaround: Click on cancel instead of retry and try to establish the connection after one minute.

Symptom: Unable to establish Pulse SAM connection on Windows 7 machine using Pulse Client 9.1R1 connecting to pre-9.1R1 PCS.

Condition: 9.1R1 will not able to establish Pulse SAM connection with pre-9.1R1.

Workaround: Use 9.1R1 PCS build.

Symptom: TFTP connection is getting a timeout error.

Condition: When Pulse SAM connection is established.

Workaround: None