For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

apm_user_138559's avatar
apm_user_138559
Icon for Nimbostratus rankNimbostratus
Nov 26, 2013

Cannot get APM to replace my Citrix Web Interface servers (5.4)

Hello, I am trying to get my WI servers replaced by my APM 11.4, using the iApp for Citrix version 2012_06_27. BigIP/APM fails to contact my XML broker servers for some reason. I have tested the connectivity which works in both direction (BigIp<->Citrix server). I have tested against both a Citrix version 5 (W2K3) and Citrix 6.5 (W2K8R2).

 

I can successfully configure the iApp to use my existing WI servers. Also, I am a bit confused about the configuration - it seems the broker server is configured as a "Remote Desktop" - why is that?

 

I am just reaching out for some help, if anybody has seen this kind of problem? Of course I will provide more information if required.

 

Thanks in advance.

 

BIG-IP Access Policy Manager (APM)
citrix
deployment
devops
iApps
security

4 Replies

  • Michael_Koyfma1's avatar
    Michael_Koyfma1
    Icon for Cirrus rankCirrus
    Nov 26, 2013

    There could be a couple issues that affect you. I would suggest you use the latest iApp and deployment guide published here:

     

    https://devcentral.f5.com/wiki/iapp.Citrix-VDI-v1-1-0.ashx

     

    Couple of things to pay attention to - make sure you are using the right ports for XML brokers - some environments have them on port 8080, some on 80 - check the configuration that is being created make sure the objects use the right ports.

     

    Check the XML broker pool and the monitor - if the monitor fails, then you certainly would not be able to reach the XML brokers(even if they are up). You can choose to use a simple monitor such as gateway_icmp or tcp to make sure that connectivity works properly, and then choose to troubleshoot the XML broker app-specific monitor later.

     

  • apm_user_138559's avatar
    apm_user_138559
    Icon for Nimbostratus rankNimbostratus
    Nov 27, 2013

    Hello Michael and thanks for your answer.

     

    I have checked and doublechecked all settings but can't get it to work for the moment. The XML brokers are running on port 80 (my Web Interfaces are configured the same). Also I did find the new iApp (VDI-v1-1-0) and I have also tested that with the same result (not working). Also my pool is working - I did reconfigure it early on with icmp check only...

     

    I am wondering if there is some debug logging I could use to try to find the problem? Right now I don't see where and why it fails..

     

    Thanks in advance.

     

  • Michael_Koyfma1's avatar
    Michael_Koyfma1
    Icon for Cirrus rankCirrus
    Nov 27, 2013

    Hm...at this point you should probably be doing tcpdump to see what is happening with the communication between the BIG-IP and your XML brokers. You can also enable VDI debugging on the BIG-IP using this command:

     

    tmsh modify sys db log.accesscontrol.level value debug

     

    After you run it, a lot more Citrix-related stuff will be logged to /var/log/apm - so that might give you a clue. Don't forget to set that value back to "notice" after you are done debugging.

     

    You can also open a case with F5 support to troubleshoot the issue.

     

  • apm_user_138559's avatar
    apm_user_138559
    Icon for Nimbostratus rankNimbostratus
    Nov 28, 2013

    Okay, when turning up the logging it turns out it is a known error:

     

    "failed to handle '/f5vdi/citrix/resource'"

     

    http://support.f5.com/kb/en-us/solutions/public/14000/800/sol14836.html

     

    So it seems I must wait for a fix...

     

    Regarding the traffic groups, we are running a standalone Bigip and we can't use the standard "traffic-group-1", if we do it will not work (not available on the network). In order to get it to work is to set it to the "Local" traffic group.

     

    Do you have any idea why is that? If I could get that to work the hotfix will not be needed I suppose..