KB44928 - Pulse Mobile : Intermittently, iOS Per-App VPN users are unable to access certain applications when the PCS version used is 9.1R10 and above.

This article describes the issue which iOS users face with certain IOS applications when the PCS version used is 9.1R10 and above.

Per-App VPN is a feature provided on iOS devices via Pulse Desktop Client for the application-specific VPN connection.

Per-App VPN allows the configuration of specific applications for VPN Access. When the configured application(s) is launched, VPN connects automatically, connects to the backend application server, and allows traffic between the end-point and the application.

In cases where applications request for a single page content across multiple TCP Channels, it is observed that the application doesn’t load the content.

However, upon several retries, it works most of the time. 

Note:

1.    This is not known to affect other Access types and Operating systems.
2.    This issue has been reported with very few backend applications.
 

PCS acts as a proxy between the iOS end-point and the backend application in Per-App VPN.

During the problem state, when the backend application server closes the TCP Socket, PCS acks it and requests the endpoint to close it as well. 

However, PCS also sets the flag that the TCP transaction is completed without waiting for the endpoint to acknowledge it.

When the Endpoint sends an acknowledgement, PCS is not in a position to confirm it as that ongoing TCP transaction is already removed.

This results in client sending the acknowledgement continuously while the application is left in the problem state.