{"id":3815,"date":"2017-10-08T16:06:55","date_gmt":"2017-10-08T12:06:55","guid":{"rendered":"https:\/\/rakhesh.com\/?p=3815"},"modified":"2017-10-13T14:38:13","modified_gmt":"2017-10-13T10:38:13","slug":"citrix-not-working-externally-via-gateway-ica-file-does-not-contain-gateway-address-or-sta","status":"publish","type":"post","link":"https:\/\/rakhesh.com\/citrix\/citrix-not-working-externally-via-gateway-ica-file-does-not-contain-gateway-address-or-sta\/","title":{"rendered":"Citrix not working externally via gateway; ICA file does not contain gateway address or STA"},"content":{"rendered":"<p>This is something that had me stumped since Thursday. I was this close to having my Citrix implementation accessible externally via a NetScaler gateway, but it wasn&#8217;t working. What was the issue? The ICA file did not have the gateway address, it only contained the internal address of the VDA and obviously that isn&#8217;t reachable over the Internet.<\/p>\n<p>The ICA file had this (an internal address) (FYI: you can enable <a href=\"https:\/\/support.citrix.com\/article\/CTX115304\">ICA logging<\/a> to get a copy of the ICA file):<\/p>\n<pre class=\"lang:ps decode:true\">Address=10.126.31.196:1494<\/pre>\n<p>While it should have had something like this (STA info along with the external address of my gateway):<\/p>\n<pre class=\"lang:ps decode:true\">Address=;42;STA343530117;D1B5869135ED230DBFA95E563F8B68;STA906839512;DBA68EAF468E90456AEDE31F1CFBD8\r\nSSLProxyHost=mygateway.fqdn\r\n<\/pre>\n<p>Everything was configured correctly as far as I could see, but obviously something was missing.<\/p>\n<p>First question: who generates the ICA file? As far as I know it is the StoreFront, but was I sure about that? Because whoever was generating the ICA file wasn&#8217;t doing a good job of it. Either they were wrongly detecting my external connection attempt as coming internally and hence skipping out the STA etc. information, or they knew I was connecting externally but choosing to not input the gateway information. Found this <a href=\"http:\/\/www.basvankaam.com\/2016\/12\/19\/demystifying-the-citrix-xenapp-logon-enumeration-and-launch-steps-new-details-included\/\">excellent blog post<\/a> (cached <a href=\"https:\/\/rakhesh.com\/citrix\/citrix-not-working-externally-via-gateway-ica-file-does-not-contain-gateway-address-or-sta\/attachment\/demystifying-the-citrix-xenapp-logon-enumeration-and-launch-steps-new-details-included\/\" rel=\"attachment wp-att-3816\">PDF version<\/a> just in case) on the flow of traffic and that confirmed that it is the StoreFront who generates the ICA file.<\/p>\n<ul>\n<li>Upon login via NetScaler (or directly) the StoreFront creates a page with all the available resources.<\/li>\n<li>User clicks on a resource. This request makes its way to the StoreFront server &#8211; either directly or via NetScaler.<\/li>\n<li>StoreFront contacts the XML\/ STA service on the Delivery Controller which will decide where to launch the resource on (which server\/ desktop etc).<\/li>\n<li>The XML\/ STA service will put all this information in an STA ticket (basically an XML file) and send back to the StoreFront server.<\/li>\n<li>The StoreFront will create an ICA file and send to the user. The ICA file is based on a template, per store, and can be found at <code>C:\\inetpub\\wwwroot\\Citrix\\&lt;store&gt;\\App_Data\\default.ica<\/code>.\n<ul>\n<li><em>Depending on whether the connection is internal or via gateway the StoreFront server will put in the correct address in the ICA file.<\/em> (We will come back to this in a bit)<\/li>\n<\/ul>\n<\/li>\n<li>The StoreFront passes this ICA file to the gateway if its an external connection, or to the receiver \/ browser directly if its an internal connection.<\/li>\n<\/ul>\n<p>Ok, so the StoreFront is the one who generates the ICA file. So far so good.<\/p>\n<p>How does the StoreFront know the connection is via a gateway? There&#8217;s this thing of &#8220;<a href=\"https:\/\/adamgamble.org\/2013\/12\/09\/citrix-storefront-beacons-explained\/\">beacons<\/a>&#8221; which is supposed to help detect if a connection is external or internal but that&#8217;s used by the receiver, not by the StoreFront. Basically a store has an internal URL and an external URL (via gateway) and once you add a store to Citrix Receiver the Receiver uses beacons to identify if its internal or external and use the correct URL. <span style=\"text-decoration: underline;\">Note<\/span>: this is for connecting to a store &#8211; i.e. logging in and getting a list of resources etc, nothing to do with ICA files or launching a resource (which is what I am interested in).<\/p>\n<p>StoreFronts have a list of gateways corresponding to the various NetScaler gateways that can connect to its stores. Each gateway definition contains the URL of the gateway as well as a NetScaler SNIP address (<a href=\"https:\/\/www.citrix.com\/blogs\/2013\/07\/08\/storefront-remote-access-part-1-the-subnet-ip-demystified\/\">now optional<\/a>; the article I link to is a good read btw). When a connection comes to the StoreFront it can match it against the gateway URL or the SNIP (if that&#8217;s defined) and thus identify if the connection is external or internal. (When a user connects through, the StoreFront will attempt to authenticate it against the gateway URL so make sure your StoreFront can talk to the gateway. Also, if the gateway URL has a different IP and you can&#8217;t modify DNS with the internal IP, then put an entry in the hosts file).<\/p>\n<p>So how to find out whether my connections via gateway were being considered as internal or external? For this we need to <a href=\"https:\/\/support.citrix.com\/article\/CTX139592\">enable debug logging<\/a> on the StoreFront.This is pretty straight-forward actually. Log on to the StoreFront server, open\u00a0 PowerShell with admin rights, and run the following cmdlets:<\/p>\n<pre class=\"lang:ps decode:true\">Add-PSSnapin Citrix.DeliveryServices.Framework.Commands\r\nSet-DSTraceLevel -All -TraceLevel Verbose<\/pre>\n<p>Then we need to download <a href=\"http:\/\/technet.microsoft.com\/en-us\/sysinternals\/bb896647.aspx\">DebugView<\/a> from SysInternals and Click Capture and select <code>Capture Global Win32<\/code>. In my case I could see in the debug console straight away that the connection was being detected as external:<\/p>\n<pre class=\"lang:ps decode:true \">[8592] Request data:  \r\n[8592]  XCitrixGateway= \r\n[8592]  XCitrixVia=mygateway.fqdn\r\n[8592]  XCitrixViaVip=&lt;NS SNIP&gt;\r\n[8592]  XForwardedFor=&lt;external ip&gt;,&lt;internal ip&gt;\r\n...\r\n[8592] Token data:  \r\n[8592]  XCitrixGateway= \r\n[8592]  XCitrixVia=mygateway.fqdn \r\n[8592]  XCitrixViaVip=&lt;NS SNIP&gt; \r\n[8592]  XForwardedFor=&lt;external ip&gt;,&lt;internal ip&gt;\r\n[8592]  RemoteAddr=127.0.0.1 \r\n[8592]  CitrixTrustCertRef= \r\n[8592]  Identified Gateway=&lt;gw name&gt;Configuration data: \r\n...\r\n[8592] Detected gateway: '&lt;gw name&gt;' <\/pre>\n<p>Hmm, so all good there too. StoreFront was definitely detecting my connection as external and yet not putting in the gateway address.<\/p>\n<p>At this point I hadn&#8217;t enabled access from my NetScaler to the internal VDAs (because I hadn&#8217;t reached that stage yet). So I modified my <a href=\"http:\/\/www.carlstalhood.com\/netscaler-firewall-rules\/\">firewall rules to allow access<\/a> from the NetScaler SNIP to my XenApp subnet. Still no luck.<\/p>\n<p>On a side note (something which I wasn&#8217;t previously clear on and came about while reading on this issue): when defining a gateway on the StoreFront the Callback URL is optional and only required for SmartAccess. Basically a NetScaler gateway can work in Basic\/ ICA proxy mode or SmartAccess (full VPN?). I was using the gateway as an ICA proxy only so there was no need for the Callback URL (not that removing it made any difference in my case!).<\/p>\n<p>Also, if you are using two-factor authentication on the gateway then the logon type in the gateway definition should say &#8220;Domain and security token&#8221;.<\/p>\n<p><a href=\"http:\/\/www.carlstalhood.com\/storefront-config-for-netscaler-gateway\/\">This blog post by the amazing Carl Stalhood<\/a> on StoreFront configuration for NetScaler gateway is a must-read. If nothing else it is a handy checklist to make sure you haven&#8217;t missed anything in your configuration.<\/p>\n<p>Also a quick shout-out to this <a href=\"http:\/\/blog.norz.at\/trouble-shooting-netscaler-gateway-connectionissues\/\">great post on troubleshooting NetScaler gateway connection issues<\/a>. It is a great reference on the whole process of connection as well as the ICA file and what you can do at each step etc. (One of the things I learnt from that post is that apart from the STA ticket the ICA file also contains an NFuse ticket &#8211; this is the previous name of Citrix StoreFront\/ Web Interface and is found as a line <code>LogonTicket=<\/code> in the ICA file).<\/p>\n<p>And since I am anyways linking to two great posts at this point, I&#8217;d like to <a href=\"http:\/\/www.basvankaam.com\/2016\/12\/19\/demystifying-the-citrix-xenapp-logon-enumeration-and-launch-steps-new-details-included\/\">re-link to a post I linked to above (from Bas van Kaam) explaining the XenApp logon flow etc<\/a>.<\/p>\n<p>Anyhow. After a whole lot of Googling I came across <a href=\"https:\/\/discussions.citrix.com\/topic\/383251-netscaler-works-internally-but-not-for-external-users\/\">this forum post <\/a>(in all fairness, I came across it as soon as I had started Googling, but I mis-read the suggestion the first few times). It&#8217;s a cool thing, so I&#8217;d like to take a moment to explain first before going on into what I had mis-configured.<\/p>\n<p>At the firm where I work we have multiple sites. Each site has its own infrastructure, complete with Delivery Controllers, StoreFronts, and NetScaler gateway. Users of each site visit their respective gateway and access their resources. There&#8217;s nothing wrong with this approach just that it is kind of unnecessary for users to keep track of the correct URL to visit. We actually have a landing page with the gateway URLs of each of our sites and users can click on that to go to the correct gateway.<\/p>\n<p>It makes sense to each site to have its own resources &#8211; the XenApp\/ XenDesktop servers. It also makes sense to have separate Delivery Controllers per site &#8211; so they are close to the resources. And it makes super sense to have a NetScaler gateway per site so that user connections go from their remote location (e.g. home) to the site gateway to the XenApp\/ XenDesktop resource. But we don&#8217;t really need separate StoreFront servers do we? What if we could have the StoreFront servers in a single location &#8211; serving all the locations &#8211; yet each user&#8217;s connecting to the resources in their location go via the NetScaler gateway in that location? Turns out this is possible. And this feature is called Optimal HDX Routing.<\/p>\n<ol>\n<li>We would have a NetScaler gateway in a central site. This site would also have a bunch of StoreFront servers.<\/li>\n<li>Each non-central site would have its own Delivery Controllers with VDA infrastructure etc.<\/li>\n<li>On the StoreFront servers in the central site we define one or more stores. To the stores we associate <span style=\"text-decoration: underline;\">the Delivery Controllers in all the other sites<\/span>.<\/li>\n<li>At this point a user could login to the gateway\/ StoreFront in the central site and potentially connect to a resource in any of the sites. This is because the StoreFront is aware of the Delivery Controllers in all the sites.\u00a0\n<ol>\n<li>I am not entirely clear which Delivery Controller the StoreFront would query though to get a list of resources (coz I am still figuring out this stuff). My feeling is this is where the concept of zones come in. I think once I create a zone I&#8217;d be associating users and Delivery Controllers to it so that&#8217;s how the StoreFront knows whom to contact.<\/li>\n<\/ol>\n<\/li>\n<li>The StoreFront server in the central location passes on this info to its gateway (i.e the one in the central location).<\/li>\n<li>(fast-forwarding a bit) Say its a user in a remote site and they select a resource to use (in the remote site because they are mapped to it via zones). The request is sent to the StoreFront in the central location.<\/li>\n<li>At this point the StoreFront can launch the resource via the Delivery Controller of the remote site. But how should the user connect to this resource though? <em>Should it connect via the NetScaler gateway in the central site &#8211; inefficient &#8211; or is there a way we can have a NetScaler gateway in each remote site and have the user connect via that?<\/em><\/li>\n<\/ol>\n<p>The answer to that last question is where optimal HDX routing comes in. StoreFront doesn&#8217;t know of zones (though you can mention zones for info I think) but what it does know is Delivery Controllers. So what a StoreFront can do &#8211; when it creates an ICA file for the user &#8211; is to look at the Delivery Controller that is serving the request and choose a NetScaler gateway which can service the request. The StoreFront can then put this NetScaler gateway address in the ICA file, forcing the user to connect to the resource in the remote site via that remote NetScaler gateway. Neat huh!<\/p>\n<p>I don&#8217;t think I have explained this as best as can be done so I&#8217;d like to <a href=\"http:\/\/www.jgspiers.com\/storefront-high-availability-optimal-routing\/\">point to this blog post by JG Spiers<\/a>. He does a way better job than me.<\/p>\n<p>Here&#8217;s what the issue was in my case. Take a look at this screenshot from the Optimal HDX Routing section &#8211;<\/p>\n<p><a href=\"https:\/\/rakhesh.com\/citrix\/citrix-not-working-externally-via-gateway-ica-file-does-not-contain-gateway-address-or-sta\/attachment\/directhdx\/\" rel=\"attachment wp-att-3819\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-3819 size-full\" src=\"https:\/\/i0.wp.com\/rakhesh.com\/wp-content\/uploads\/2017\/10\/DirectHDX.png?resize=530%2C51&#038;ssl=1\" alt=\"\" width=\"530\" height=\"51\" srcset=\"https:\/\/i0.wp.com\/rakhesh.com\/wp-content\/uploads\/2017\/10\/DirectHDX.png?w=530&amp;ssl=1 530w, https:\/\/i0.wp.com\/rakhesh.com\/wp-content\/uploads\/2017\/10\/DirectHDX.png?resize=300%2C29&amp;ssl=1 300w, https:\/\/i0.wp.com\/rakhesh.com\/wp-content\/uploads\/2017\/10\/DirectHDX.png?resize=150%2C14&amp;ssl=1 150w, https:\/\/i0.wp.com\/rakhesh.com\/wp-content\/uploads\/2017\/10\/DirectHDX.png?resize=400%2C38&amp;ssl=1 400w\" sizes=\"(max-width: 530px) 100vw, 530px\" data-recalc-dims=\"1\" \/><\/a><\/p>\n<p>Notice the default entry called &#8220;Direct HDX connection&#8221; and how it is currently empty under the Delivery Controllers column? Well this entry basically means &#8220;don&#8217;t use a gateway for any connections brokered by the listed Delivery Controllers&#8221; &#8211; it&#8217;s a way of keeping a bunch of Delivery Controllers for non-gateway use only. For whatever reason &#8211; I must have been fiddling around while setting up &#8211; I had put in both my Delivery Controllers in this &#8220;Direct HDX connection&#8221; section. Because of this even though my StoreFront knew that the connection was external, since the entry for my gateway (not shown in the screenshot) had no Delivery Controllers associated with it the StoreFront wasn&#8217;t returning any gateway address. The fix thus was to remove the Delivery Controllers from the &#8220;Direct HDX connection&#8221; section. Either don&#8217;t assign the Delivery Controllers to any section, or assign it to the entry for my gateway.<\/p>\n<p>Here&#8217;s similar <a href=\"https:\/\/docs.citrix.com\/en-us\/storefront\/2-6\/dws-manage\/dws-configure-ha\/dws-configure-ha-optimal.html\">info from the Citrix docs<\/a>. I still prefer the blog post by JG Spiers.<\/p>\n<p>Took me a while to track down the cause of this issue but it was well worth it in the end! :)<\/p>\n<p><strong>Update<\/strong>: From a <a href=\"http:\/\/www.carlstalhood.com\/storefront-config-for-netscaler-gateway\/\">blog post of Carl Stalhood<\/a>:<\/p>\n<blockquote>\n<p>If you have StoreFront (and NetScaler Gateway) in multiple datacenters, GSLB is typically used for the initial user connection but <em>GSLB doesn\u2019t provide much control over which datacenter a user initially reaches. So the ultimate datacenter routing logic must be performed by StoreFront<\/em>. Once the user is connected to StoreFront in any datacenter, <em>StoreFront looks up the user\u2019s Active Directory group membership and gives the user icons from multiple farms in multiple datacenters and can aggregate<\/em> identical icons based on farm priority order. When the <em>user clicks on one of the icons, Optimal Gateway directs the ICA connection through the NetScaler Gateway that is closest to the destination VDA. Optimal Gateway requires datacenter-specific DNS names for NetScaler Gateway<\/em>.<\/p>\n<\/blockquote>\n<p>That clarifies some of the stuff I wasn&#8217;t clear on above.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>This is something that had me stumped since Thursday. I was this close to having my Citrix implementation accessible externally via a NetScaler gateway, but it wasn&#8217;t working. What was the issue? The ICA file did not have the gateway address, it only contained the internal address of the VDA and obviously that isn&#8217;t reachable &hellip; <a href=\"https:\/\/rakhesh.com\/citrix\/citrix-not-working-externally-via-gateway-ica-file-does-not-contain-gateway-address-or-sta\/\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">Citrix not working externally via gateway; ICA file does not contain gateway address or STA<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[657],"tags":[783,768,647,765,317],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/3815"}],"collection":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/comments?post=3815"}],"version-history":[{"count":0,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/3815\/revisions"}],"wp:attachment":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/media?parent=3815"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/categories?post=3815"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/tags?post=3815"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}