KB44281 - Web application using Java Applet fails to load through Pulse SAM

The article describes an issue where the web application using Java Applets fails to load through Pulse SAM and works fine when using legacy WSAM.

When users migrate from legacy WSAM to Pulse SAM and when they access the web application which requires Java Applet fails to load.

We identified that the issue is caused by the fact that all the Java related URL or URL which is being executed using Java services is defaulting to IPV6 Protocol. You would see the following entries in Client side debug log.

00146,09 2019/07/30 15:52:30.854 3 SYSTEM PulseSecureService.exe samAM p1856 t1CC8 WfpManager.cpp:1817 - 'CWfpManager' Connect Redirect IPv6 Filter No. 1
00175,09 2019/07/30 15:52:30.854 3 SYSTEM PulseSecureService.exe samAM p1856 t1CC8 WfpManager.cpp:1659 - 'CWfpManager' HandleProxyAtConnectRedirectQueryV6MT::Current ProcessID =1856
00138,09 2019/07/30 15:52:30.855 3 SYSTEM PulseSecureService.exe samAM p1856 t1CC8 WfpManager.cpp:3704 - 'CWfpManager' Protocol...............: 6
00160,09 2019/07/30 15:52:30.855 3 SYSTEM PulseSecureService.exe samAM p1856 t1CC8 WfpManager.cpp:3710 - 'CWfpManager' IPv6 Remote Endpoint...: [::ffff:10.9.222.71]:80
00147,09 2019/07/30 15:52:30.855 3 SYSTEM PulseSecureService.exe samAM p1856 t1CC8 WfpManager.cpp:3717 - 'CWfpManager' IPv6 Local Endpoint....: [::]:49787
00432,09 2019/07/30 15:52:30.855 3 SYSTEM PulseSecureService.exe samAM p1856 t1CC8 WfpManager.cpp:1458 - 'CWfpManager'  Redirecting ProcessPath = "\device\harddiskvolume2\users\admin\downloads\jdk-11.0.4_windows-x64_bin\jdk-11.0.4\bin\java.exe" Protocol = 6 LocalEndpoint IP Address:Port = IPv6 Address 0000:0000:0000:0000:0000:0000:0000:0000:49787 RemoteEndpoint IP ADDRESS:Port : IPv6 Address 0000:0000:0000:0000:0000:0000:0000:0000:80

This issue is fixed in Pulse Desktop Client versions 9.1R4.1 and above. The installers can be downloaded from https://my.pulsesecure.net/

The following workarounds can still be used if needed,

Workaround 1 : Disable IPV6 on the client machine.

Workaround 2 : If disabling IPV6 on client machines is not an option and when the PCS device is running in 9.1Rx version "Enable fail-over to TDI for Pulse SAM connection" under User Roles > Roles > SAM > options

Workaround 3 : Run the following command on the client PC which would force the PC to use IPv4 stack for all Java request

setx _JAVA_OPTIONS -Djava.net.preferIPv4Stack=true