Deploying Pulse Secure 9.x to 5.x users (testing the waters)

[donmontalvo]

We got a request to deploy Pulse Secure 9.x over existing 5.x.

Thought I'd test the waters here to see if anyone can confirm if the new one can replace the old one without having to retool our policies.

Once we get this deployed we'll circle back to this thread, hoping to avoid hitting any brick walls others have hit already. :)

[sdagley]

@donmontalvo I look forward to your report on the upgrade process. With Pulse Secure 5.3.7 playing nicely with Mojave I'm not pushing our VPN team on the 9.x upgrade, so I can only offer moral support for now.

[donmontalvo]

The request came from the VPN team. Something about DNS resolution and compatibility with Crowdstrike.

[ericbenfer]

Does Pulse Secure 9.x support Apple Crypto Token Kit (CTK) in order to use SmartCard/CAC/PIV/Yubikey for authentication?

[donmontalvo]

Good question, dunno, we get requests to package and deploy. The requestor is the VPN team. #weJustMakeTheSausages

[gachowski]

@donmontalvo DO NOT!!!

Sounds like you need new VPN team that can read...

https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB44000/q=pulse+slow+down&l=en_US&c=Category%3APulse_Desktop&fs=Search&pn=1&atype=

We have seen at least 20% issues with our user base and stopped the 9.0.x rollout.. we see both slowdowns and kernel panics.

C

[dshepp33]

@gachowski I don't think we have seen that issue with v9. But now that I have read it, I will have to test it. At 7:30am, it is 250/203 home WiFi over VPN.

I think the worst we have seen with v9 is VPN taking some time to connect. Mine will sit here and spin for about 2 minutes before it finally kicks in. Just a guess as I have not timed it but it is long enough to be annoying.

IIRC, when we installed over v5, it did remove it beforehand. But don't take that as the gospel because I would have to find one to test to verify.