KB28589 - Network Connect and Pulse Secure Desktop client do not work correctly with IE11 when proxy server settings are configured

IE11 will not use the Proxy Auto Configuration file set by Network Connect (NC) or Pulse Secure Desktop Client. The NC and Pulse Secure Desktop Client set the proxy.pac file (instantproxy.pac) to the browser for managing traffic to the tunnel.

For example, in the scenario below, the server-side proxy is configured:

Internet Explorer 11 does not support a "file://" type URL schema for proxy.pac URL. This is a design change in IE11. This issue does not affect IE10/9/8, FireFox, or Chrome.

For more details about IE Internals, go to http://blogs.msdn.com/b/ieinternals/archive/2013/10/11/web-proxy-configuration-and-ie11-changes.aspx.

Update: 2014-06-27

This issue will be fixed in PCS 8.0R5 and 7.4R13 for Network Connect (NC).

As IE11 does not support "file://" for the proxy.pac location, the fix involves adding a lightweight web server functionality in NC to supply the pac file via HTTP.  This HTTP server module will install/activate only if the access client is IE11 (or above), and will work only for a localhost connection. The browser proxy URL will be something like http://127.0.0.1:49353/proxy.pac. Client firewalls will need to allow this address and port to be accessed by the browser.

Note: Work on a fix for Pulse is ongoing. This article will be updated after new information is available.

Update: 2014-04-24

This issue is fixed in  8.0R8/8.1R2 and later. 

The workaround is to add the registry key below to enable legacy auto proxy features in Internet Explorer 11.

Key: HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\
Value: EnableLegacyAutoProxyFeatures
Type: REG_DWORD
Data: 1

Internet Explorer must be restarted to apply the registry change.