Forum Discussion

daboochmeister's avatar
daboochmeister
Icon for Cirrus rankCirrus
Jul 22, 2015

APM webtop to Citrix - what timeouts control session traffic stopping?

Environment - Big-IP 4200v running 11.5.2 plain, no hotfix.

 

Context: APM webtop providing an SSL tunnel to XenApp servers via a Citrix remote desktop. Remote desktop is configured with XenApp XML Broker IP (actually, LTM pool of such brokers). Webtop replaces Storefront, provides launch icons.

 

Doing tsharks to observe traffic, I notice that when we launch a XenApp hosted application, then close that application, the traffic between the F5 to the XenApp host server continues (and not just a little, consistent packet flow) for 350 - 400 seconds before ceasing. Not sure why - keeping it open in case of a subsequent launch? Not sure.

 

I presume that's controlled by timeouts ... but I can't tell what timeouts, nor where (on the F5 or on the XenApp side).

 

I would like to reduce how long the connection stays open and has traffic flow as much as reasonable. So where is this post-app-close traffic controlled? And what are the tradeoffs for reducing how long the connection is left open?

 

thx!

 

BIG-IP Access Policy Manager (APM)
citrix
deployment
security
xenapp
  • daboochmeister's avatar
    daboochmeister
    Icon for Cirrus rankCirrus
    Jul 23, 2015

    Oh - this isn't the F5's fault in any way - in Connection Manager, after you exit one of our launched app, the connection to the server remains open. As soon as you disconnect in Connection Manager, the traffic stops.

     

    So there must be some setting on the Citrix side (or maybe that I can configure into the ICA) that says "upon app exit, disconnect from the server" ... does anyone know of such a setting?

     

  • Michael_Koyfma1's avatar
    Michael_Koyfma1
    Icon for Cirrus rankCirrus
    Jul 22, 2015

    Hm.. something does not add up. I just tested in my environment, which is 11.6.0 HF5 based, and I see traffic stop as soon as the application is closed. It might be worthwhile to open a case and supply a full tcpdump with details as to when the user exited the application and from which point on the traffic between the BIG-IP and XenApp server is still flowing. In my scenario, traffic on port 2598 ceases as soon as the application was exited.

     

  • daboochmeister's avatar
    daboochmeister
    Icon for Cirrus rankCirrus
    Jul 22, 2015

    We just have the users exit the app in a normal way, e.g., if it's Word, they do File | Exit.