Known Issues



Symptom: Copy and paste do not work in VNC.

Condition: Occurs when using an Ubuntu VNC bookmark.

Workaround: NA

Symptom: Copy and paste do not work in the HTML5 SSH bookmark.

Condition: Occurs when attempting to use Ctrl+C and Ctrl+V.

Workaround: Pasting with right-click works.



Symptom: When two Windows Update Agent rules are configured, with the first rule having minimum version check disabled, second rule also works like minimum version check is disabled though it is enabled.

Condition: This is because the minimum version check attribute value is taken only from the first rule for both the rules.

Workaround: Enable the “Minimum version” checkbox for both rules or at least for the first rule. so the client returns patch details to the server. You can also move the rule that requires a minimum-version check to the top of the policy so the checkbox setting is passed to the client.

Symptom: 3-level hierarchy certificate authentication is not functioning.

Condition: This occurs when OCSP is enabled for certificate status checking.

Workaround: None available at this time.





Symptom : When admin tries to delete more than 600 users, WAF is blocking it.

Condition: Deletion of more than 600 users.

Workaround: Delete 600 users at one time.



Symptom: Upgrade of a lower version node fails during the "Verifying Package Integrity" step.

Condition: This issue occurs in the following scenario:

Workaround: Boot the device in standalone mode and then perform the upgrade.



Symptom: The TOTP fallback server fails to function when used in conjunction with an LDAP authentication server.

Condition: This issue occurs when configuring TOTP as a fallback for LDAP based authentication.

Workaround: N/A



Symptom: When using the Safari browser, PSAL is not detected and the end user is prompted to download and install PSAL.

Condition: This issue occurs when attempting to log in via the Safari browser.

Workaround: Use Chrome instead of Safari for successful detection and login with PSAL.

Symptom: Web VDI bookmark access occasionally does not work.

Condition: This issue occurs when two Web VDI bookmarks are configured.

Workaround: Configure only one VDI bookmark and use it for access.

Symptom: PSAL is unable to launch the Java applet (JSAM) on Mac machines.

Condition: This occurs when an end user accesses a JSAM bookmark on a Mac machine with "HTTP Only Device Cookie" enabled.

Workaround: NA

Symptom: SAM internal resources are not passed through the configured proxy server.

Condition: This issue occurs when a PSAM proxy is configured with SAM resource policies.

Workaround: NA





Symptom: Event logs display the message "administrator manual failover" when VIP failover occurs due to the active node rebooting.

Condition: This happens when the active node (holding the cluster VIP) undergoes a reboot.

Workaround: When this message appears, check the Admin logs to determine if the reboot was initiated by an administrator. Look for entries such as "Server Reboot requested by Admin/Administrators" to verify the source of the reboot.

Symptom: In an Active-Passive cluster configured with virtual ports on VLANs, backend resources within a VLAN become inaccessible following a cluster VIP failover.

Conditions: This issue is observed under the following circumstances:

Workaround: Reboot the entire cluster to restore access to backend resources.



Symptom: The browser bar in the End User Portal (EUP) displays "URL is invalid."

Condition: This occurs when the "Mask hostnames while browsing" option is enabled.

Workaround: Disable "Mask hostnames while browsing" and use the browser bar.

Symptom: A black screen is displayed when accessing a file share bookmark created by the end user.

Condition: This occurs when the bookmark is created through the file browse option.

Workaround:

Symptom: End user receives the error message: "Invalid username or password. Please re-enter your user information" when attempting to log in to ICS.

Conditions: This error occurs when:

Workaround: Close any existing sessions and log in again.



Symptom: End-users occasionally receive the error message "Unable to perform TOTP auth."

Conditions:

Workaround: Enable Adaptive Authentication, if possible. This will reduce the frequency of secondary authentication requests and help prevent the error.

Symptom: Active Directory authentication may offer or advertise vulnerable ciphers during SSL/TLS negotiation.

Condition: This occurs when an enduser authenticates with Active Directory.

Workaround: N/A



Symptom: HTML5 RDP connection is terminated unexpectedly.

Condition: This occurs when an end user attempts to send or receive files larger than 1 GB using the remote file transfer feature.

Workaround: N/A.



Symptom: The WAF package reverts to version 1.0.0.

Condition: This occurs when the admin performs an Entire Push Config or System.cfg import from 22.8R2 GA.

Workaround:

Symptom: XML import/push config fails with the error message: "Can't download crs package '1.0.0' from controller as gateway is not registered with controller."

Condition: This occurs when the admin performs a selective push config/XML import that includes WAF configuration.

Workaround: Admin can use system configuration (cfg) upload as an alternative.

Symptom: WAF issues are observed in the following configurations:

Condition: This issue occurs when an IP address is used in the CRL URL during CRL checking configuration.

Workaround: Use a domain name in the CRL URL instead of an IP address.



Symptom: Event logs display the following message: "Error encountered while upgrading cache (Key: vc0/federateClientSettings/serverURL, Value: Created: 1)"

Condition: This occurs during the upgrade process.

Workaround: N/A



Symptom: When switching from TLS 1.2 to TLS 1.3, end-users are not prompted to select a user certificate and instead see a "Missing certificate" error.

Condition: This issue occurs when the server is configured to use TLS 1.3.

Workaround: One of the following workarounds may resolve the issue:



Symptom: Backend resources are not accessible through the PSAM tunnel when non-standard TCP ports are used.

Condition: This occurs when applications are configured with non-standard TCP ports in PSAM.

Workaround: NA







Symptom: Enabling “Validate Server Certificate” for LDAP connections does not enforce or properly handle certificate validation.

Condition: Occurs when the “Validate Server Certificate” option is used in LDAP configuration.

Workaround: N/A

Symptoms: When configure an LDAP server, it fails with the error "Invalid server address"

Condition: when configuring an LDAP server.

Workaround: N/A



Symptom: Users are unable to change their AD passwords via the preference page.

Condition: This occurs during password change attempts from enduser page.

Workaround: N/A

Symptoms: On the AD troubleshooting page, DNS resolution checks fail if multiple AD servers are configure. DNS resolution is success for the AD which is configured as a DNS server.

Condition: Configuring multiple AD servers on the ICS, Some of the AD severs DNS resolution may fail in trouble shooting page.

Workaround: Configure the AD server IP as a primary DNS.

Symptom: After creating the AD server in an Active/Passive (A/P) cluster, the AD username and password fields are empty, even though the 'Save Credentials' setting is enabled.

Condition: The appliance is running with 22.8R2 version and the device is configured in an Active/Passive (A/P) cluster mode with 'Save Credentials' option enabled on the AD authentication server.

Workaround: On each login, manually enter the AD credentials (since autofill/save is not working).



Symptom: AAA traffic segregation is not working as expected at both the global and server levels. Authentication attempts to AD or OAuth servers do not use the configured segregated port, resulting in all AAA traffic being sent via the internal port.

Condition: Occurs when segregation policies are set globally or per-auth server, but the system continues to use default paths for all authentication traffic. The issue is observed on both AD and OAuth authentication flows in the current platform version.

Workaround: N/A



Symptoms: OAuth time skew is not working as per the configured values.

Workaround: N/A



Symptom: The certificate authentication end-user page becomes inaccessible after enabling the "Advanced Certificate Processing Settings" option under trusted client CA configuration.

Condition: This occurs when, The “Advanced Certificate Processing Settings” option is enabled for a trusted client CA in the admin UI.

Workaround: Disable "Advanced Certificate Processing Settings".

Symptoms: User login is successful even if we disable client Certificate Negotiation.

Condition: When we disable "Trusted for Client Authentication" and "Participate in Client" on the trusted client CA.

Workaround: Delete the client CA certificate which we want to disable the participate in client certificate negotiation from the ICS.



Symptom: Creation of delegated admin role fails.

Conditions: When trying to create a delegated admin role via Rest API.

Workaround: Add the rule IDs 920170, 930120 in WAF exclude rule ID list, and then execute the REST API.



Symptom: WAF package version is missing in the admin log.

Condition: When rollback is done for WAF package.

Workaround: N/A

Symptom: WAF package version is missing in the admin log.

Condition: When WAF package is uploaded.

Workaround: N/A

Symptom: Upload successful message is not populated

Condition: When WAF ruleset package is uploaded.

Workaround: Refer the admin logs.

Symptom: WAF functionality will not work.

Condition: When admin enables Next Gen Web Server from console options.

Workaround: From ICS admin UI disable and enable the WAF, then WAF functionality will work.

Symptom : When admin tries to delete more than 198 users, WAF is blocking it.

Condition: Deletion of more than 198 users.

Workaround: Delete 150 users at one time.

Symptom: When attempting to push either selected or entire configuration to multiple targets in a single push job, the operation fails if the targets are configured with different Shared Secret Keys.

Condition: This issue occurs when multiple targets have different Shared Secret Keys configured and a single push job is used to deploy configurations to these targets (either selected or entire configuration).

Workaround: To successfully push configurations to multiple targets in one push job, ensure that all selected targets are configured with the same Shared Secret Key.



Symptom: One of the node in the cluster is not accessible after doing restart services

Condition: After restarting services

Workaround: Restart the Services or reboot the node with the issue.



Symptom: Restore of binary config via /api/v1//system/binary-configuration REST API fails.

Condition: When the REST API is executed against ICS running 22.8R2 and later.

Workaround: Use Admin UI to backup and restore binary config.

Symptom: "IP Pool cannot be empty" error observed when switching from DHCP-based

IP assignment to Pool-based for VPN Connection Profiles via REST API.

Condition: This occurs when the "ip-address-pool" attribute is provided before the "ip-address-assignment" attribute in the request body.

Workaround: Provide "ip-address-assignment" before the "ip-address-pool" attribute in the request body.

Symptom: Configuring FQDN based lockdown exception rule for a connection set failing through Rest API.

Condition: While configuring FQDN based lockdown exception rule for a connection set through Rest API.

Workaround: Configuring the FQDN based lockdown exception manually in ICS.

Symptom: When trying to create or update an Admin Realm through REST API, ICS returns “Unknown Element” error.

Conditions: When the json input in the post body contains “allow-admin-signin-external-port”.

Workaround: Remove “allow-admin-signin-external-port” attribute. It is no longer supported in ICS 22.8R2 and later releases.



Symptom: Admin UI is not accessible.

Condition: When configured V6 address is wrong.

Workaround: Disable Next Gen Web Server from console, access the admin page and correct the IP address. Then enable Next Gen Web Server again from console.

Symptom: Debug log download is not working.

Condition: When Next Gen Web Server is disabled.

Workaround: Turn off the 'debug logging on' and 'include logs' fields, 'save' and then download the logs.



Symptoms: Cloud secure configuration fails with the error message: "Failed, no metadata".

Condition: This occurs when configuring the Office 365 application in Cloud Secure.

Workaround:



Symptom: L3 Tunnel fails to connect using NCP for mobile clients (Android and iOS).

Condition: When NCP is chosen as Communication Protocol.

Workaround: Select IFT/TLS as the Communication Protocol instead of NCP.

Symptom: ISAC Connection using IPv6 is disconnecting when custom UDP port

Condition: When custom IPv6 UDP port is configured

Workaround: None

Symptom: ISAC client Disconnection is taking more time.

Condition: When SLO is enabled.

Workaround: Disable SLO.

Symptom: ISAC connection not disconnecting immediately after SESSION_TIMEOUT

Condition: Configure SESSION_TIMEOUT from session options as 6 min which is minimum value

Workaround: None

Symptom: Android ISAC client connection to ICS gateway fails with 'Server's security certificate is not trusted'.

Conditions: ICS is running 22.8R2.

Workaround: Disable Server certificate trust enforcement option under System > Configuration > Mobile.



Symptom: SharePoint bookmark access throws"The page you requested could not be found." message.

Workaround: N/A

Symptom: Sometimes 502 bad gateway message is seen.

Condition: When File browsing bookmark is accessed.

Workaround: Trying accessing second time, it will work.

Symptom: JSAM bookmark access will not work when JRE 1.8 is installed.

Condition: When enduser accesses JSAM profiles with JRE 1.8.

Workaround: Install JDK instead of JRE1.8 .



Symptom: Unable to lease licenses from license server.

Conditions: 22.8R2 license client is configured to lease license from license server running 22.8R2

Workaround: Use a license server running 22.7R2.x latest version.

Symptom: System/User Binary import/XML import is failing with 22.8R2 gateway registered to the latest NSA controller.

Workaround: System/User binary/XML import to be done from Gateway UI.

Symptom: Importing xml file with archival config settings is returning with password related error message.

Workaround: If the exported XML is of 22.8R2.x or higher version, then the Proper strength password (as defined in default Authentication Server) for the following archival configs should be provided before import:



Symptom: Unable to attach vTPM if vTPM is detached manually.

Condition: If vTPM is detached and want to re-attach then VMware VCD does not provide option to re-attach vTPM.

Workaround: None. Removing vTPM makes vICS non recoverable. vTPM is mandatory component.

Symptom: Switch to serial console on VM doesn't bring up Admin/End user UI.

Condition: If serial port is not attached to VM and convert Virtual Terminal to serial console.

Workaround: Attach serial port to VM to access UI.

Symptom: 22.8R2 can be staged on a VMware appliance running on 22.7Rx but upgrade fails.

Condition: On VMware, 22.8R2 may be staged from 22.7Rx but upgrade cannot process as upgrade from 22.7Rx to 22.8R2 is not allowed.

Workaround: None. Upgrade from 22.7Rx to 22.8R2 is not allowed.



Symptom: System boots up slow compared to previous version.

Condition: Reboot.

Workaround: None available.

Symptom: `/bin/cp cannot create regular file` message is seen on console.

Condition: Reboot.

Workaround: None. Error message is harmless. It can be ignored.

Symptom: Upgrade aborts with error “ADM23397: This appliance cannot be upgraded to 22.8R2.”

Workaround: No workaround. This indicates that the upgrade cannot proceed because there is insufficient disk space in the boot partition because the factory reset version is very old. Contact Ivanti Support for error.