Junos Pulse native VPN client on Win 8.1 (Advance configuration)

I just discovered another new thing about connecting to juniper networks SSL-VPN.

So the company I work for has multiple "sign on policy path" for our vpn, as the official documentation from juniper puts it. Normally, everyone is expected to go to the full official URL in the browser to connect to the VPN. Connection will require ActiveX, Java, and the right browser to start working.

Windows 8.1 came with a native VPN client, which was a good thing. But unlike the client in iOS, the server field does not take in a url. Hence, I can only connect to the default VPN path, but not to https://vpn.contoso.com/admin

Turns out, the way to do this is only through PowerShell. So let's get straight to the code:

$xml = '<pulse-schema><uri>/admin</uri></pulse-schema>'

$sourceXml = New-Object System.Xml.XmlDocument

$sourceXml.LoadXml($xml)

Add-VpnConnection -Name 'AdminVPN' -ServerAddress 'vpn.contoso.com' `

    -PluginApplicationID "JuniperNetworks.JunosPulseVpn_cw5n1h2txyewy" `

    -CustomConfiguration $sourceXml -SplitTunneling

The "SplitTunneling" is useful is you only want to route VPN network traffic through the adapter. For my case, the admin VPN of my organization doesn't have a gateway to the internet, hence split tunneling is necessary.

Turns out there are more configuration options for the XML. Here are those that are supported:

PowerShell, Task Scheduler, and Start in options

I just realised after lots of twist and turns that when scheduling a powershell job, the Start in value will not work if I just put the Program as "powershell.exe". If "Run with highest privileges" is checked, the working directory of your script will just be "C:\Windows\System32" regardless of what value you put in Start in. Just like it would if you launch powershell as administrator from the start menu. I haven't tried this, but I guess if it's not checked, the working directory should be %HOMEDRIVE%%HOMEPATH%

To solve the problem, just change the Program value to the full path. In my case, this is "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe". Quite a handful to type, but it's the only way I managed to get it to work so far. If there are any better suggestion, I'd be glad to hear.

Of PowerShell, dotNET, and unblocking DLLs

I've been trying like crazy to get my System.data.SQLite to load into Powershell. I tried all the versions, checked and double checked versions and dependencies...

At the end, the solution was super simple. Right-click, properties on the downloaded zip package, and click UNBLOCK. Damn you security feature, wasted half a day just figuring this out!

Changing the Primary and other emails for DirSync Office 365 users (with no exchange on premise)

OK, the idea is that if you are using DirSync for user objects on office 365, there is no way to change the SMTP address on office 365 portal. You can't even do it on the exchange management console, and you'll get almost the same luck if you try using Remote Powershell to O365 or even Exchange Management shell.

After hunting all around the community forums, I finally found a few good way we can do this via powershell (after all, you don't want to go mess with ADSIEdit if you're in an enterprise environment, having hundreds of accounts to provision or modify each day).

Simple method 1 (only set Primary Email - SMTP):
Using Remote PS, run the following command

Set-Mailbox user -WindowsEmailAddress user@domain.com

This is pretty good, as it just sets the primary email to what you want it to be, and forget about everything else. But if you are one who have exchange on premises, the "ProxyAddressess" field in your on premise, federating AD will overwrite that. So this is the only way to modify it:

Get-ADUser $sAMAccountName -properties ProxyAddresses | %{$_.ProxyAddresses += @('SMTP:primary@domain.com', 'smtp:secondary@domain.com'); Set-Aduser -Instance $_ }

For more complicated requirements, you may have to parse through the ProxyAddresses array to remove SMTP fields you don't want, add in smtp fields you want, etc. Maybe if I have some extra time in the future, I shall write a little helper script to do just that. I may even have a need to write such a script in the future, who knows ;-)

Hyper-V virtual disk on external USB hard disk

I was having so much problem with creating a Hyper-V VM on my windows 8 maching, the error I kept getting was

failed to add device 'Synthetic Disk Drive'

This was so irritating, until a colleague told me to turn off my antivirus, and tada! It worked like a charm. He says I can turn it on again after the VM is created and running...

Mailbox enable a user in Office 365 using PowerShell

I was searching high and low for this all around the internet. Enable-mailbox doesn't seem to work, New-Mailbox also doesn't do it... It turns out that the solution is one that doesn't make sense at all.

Apparently all you need to do in Office 365 is to assign a license (an MsolAccountSku) to the user, and the mailbox will be automatically provisioned based on the UPN. That easy!

Here are the commands...

First, get your Account SkuID:
$sku = Get-MsolAccountSku

Then set a location for the user (else you can add a license):
Set-MsolUser -UserPrincipalName user@domain.onmicrosoft.com \
-UsageLocation "SG"

Then, add the account SkuID to the user:
Set-MsolUserLicense -UserPrincipalName \
user@domain.onmicrosoft.com -AddLicenses $sku.AccountSkuId

Then you wait as the mailbox is provisioned in the background.

FreeBSD 9 Authenticate to 802.1X Wired Ethernet (LAN)

I've been searching high and low for a single solution to this problem, but there seem to be no good blog/guide that answers this.

The scenario is that my workplace, NUS is slowly rolling up 802.1X authentication for wired ethernet, that's the LAN socket on the wall you connect your computer to. Yes, we now have to use our AD username and password to authenticate before we can get any sort of network connectivity after connecting to the LAN socket. Now, of course, there are guides for staff/students to get connectivity, but the guides are only for windows, mac, and (surprise!) Ubuntu. And even the Ubuntu guide is only configuring through the GUI, nothing on the actual command-line and configuration files stuff.

After spending more than half a day (spread out in a 2-3 days period) hunting high and low, plus a little bit of reading and digging through the rc.d scripts, I finally managed to get my FreeBSD box to automatically authenticate, and obtain a DHCP lease from the wall socket. Phew!

It's actually only a 2 step process. First, create a /etc/wpa_supplicant.conf

ctrl_interface=/var/run/wpa_supplicant
ctrl_interface_group=wheel
ap_scan=0
network={
 key_mgmt=IEEE8021X
 eap=PEAP
 identity="Username"
 password="secretpassword"
 eapol_flags=0
}

UPDATE: keymgmt should be key_mgmt with an underscore (ref). Thanks, Ryan Stark

Basically, the important thing you need is ap_scan=0. Also, I believe keymgmt=IEEE8021X will ensure you're not using WPA or WEP or something of those sorts. The following lines are pretty well documented. My organisation uses PEAP, as for eapol_flags, I have no idea what it does. You can try taking it out, I believe it worked for me either way. The first two lines are just to create an admin listening socket so that wpa_cli can poll it for changes, or just to query the status of the wpa_supplicant daemon. For my case, I am limiting the admin interface to members of group 'wheel' only.

Then, configure /etc/rc.conf like so:

ifconfig_bge0="WPA DHCP"

UPDATE: should be WPA instead of WAP (ref), thanks Thor Erik!

Where bge0 is your network interface. At first, I was wondering how to include the -Dwired in the rc.conf, but apparently, the rc.d/wpa_supplicant script has already catered that for wired interfaces. How neat!

Oh, by the way, if you want to test whether your configuration is right, you can run wpa_supplicant with verbose debugging as below:

wpa_supplicant -dd -Dwired -c /etc/wpa_supplicant.conf \
-i bge0

Bear in mind that if it succeeds, the daemon will be in the foreground and will not return you to shell, you will need to Ctrl-Z it, and bg it to the background if you wish to continue working.

Next up, I'd wanna get it to join AD, register its IP address in AD's built-in DDNS, disallow AD user to login, but allow AD user to access Samba file share.