Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I’m trying to log in to a Juniper VPN with Network Connect from a headless Linux client. I followed the instructions and used the script from When running the script with --nogui switch the command that gets finally executed is $HOME/.juniper_networks/network_connect/ncsvc -h HOST -u USER -r REALM -f $HOME/.vpn.default.crt. I get asked for the password, a line “Connecting to…” is printed but then the programm silently stops. When adding -L 5 (most verbose logging) to the command line, these are the last messages printed to the log: state: kStateCacheCleaner (dsclient.cpp:280) --> POST /dana-na/cc/ccupdate.cgi (authenticate.cpp:162)
http_connection.para Entering state_start_connection (http_connection.cpp:282)
http_connection.para Entering state_continue_connection (http_connection.cpp:299)
http_connection.para Entering state_ssl_connect (http_connection.cpp:468)
dsssl.para SSL connect ssl=0x833e568/sd=4 connection using cipher RC4-MD5 (DSSSLSock.cpp:656)
http_connection.para Returning DSHTTP_COMPLETE from state_ssl_connect (http_connection.cpp:476)
DSHttp.debug state_reading_response_body - copying 0 buffered bytes (http_requester.cpp:800)
DSHttp.debug state_reading_response_body - recv'd 0 bytes data (http_requester.cpp:833) <-- 200  (authenticate.cpp:194)
dsclient.error state host checker failed, error 10 (dsclient.cpp:282)
ncapp.error Failed to authenticate with IVE. Error 10 (ncsvc.cpp:197)
dsncuiapi.para DsNcUiApi::~DsNcUiApi (dsncuiapi.cpp:72)

What does host checker failed mean? How can I find out what it tried to check and what failed? The HostChecker Configuration Guide mentions that a $HOME/.juniper_networks/tncc.jar gets installed on Linux, but my installation contains no such file. From that I concluded that HostChecker is disabled for my VPN on Linux? Are the POST to /dana-na/cc/ccupdate.cgi and “host checker failed” connected or independent? By running the connection over a SSL proxy I found out that the POST data is status=NOTOK (Funny side note: the client of the oh-so-secure VPN does not validate the server’s SSL certificate, so is wide open to MITM attacks…). So it seems that it’s the client that closes the connection and not the server.

share|improve this question

3 Answers 3

up vote 6 down vote accepted

From this really confusing Juniper web page:

Host Checker is still not supported for Linux nclauncher (ncsvc) in any version at this time.

the instructions there seem to indicate an admin on the Juniper device needs to set up a separate authentication realm with Host Checker turned off.

That's just my completely naive reading of that page, I know nothing about Juniper VPNs.

share|improve this answer
Ok, while unsatisfying I now believe this is the correct answer. – hfs Jul 9 '11 at 14:34

Yes I confirm, I created another sign up page (https://my.vpn.url/linux/) pointing on another REALM which not uses the host checker and it worked fine for me.

share|improve this answer

I spend a lot of time to try to create connect with the Juniper junos pulse VPN using JNC, MSJNC tools It works in my home's network env, but failed in company and 3g env, I think its caused by certificate issue.

Finally, I found a way to do it, using "openconnect --juniper --no-cert-check"

You can check the following link.

share|improve this answer
This opens you up to a MITM attack, doesn't it? – Deer Hunter Nov 1 at 20:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.