For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Kory_52080's avatar
Kory_52080
Icon for Nimbostratus rankNimbostratus
Feb 26, 2014

Kevin,

 

I'm working with Al on this issue. I set the APM logs to debug and compared the output with our working site and they appear the same. I see the authentication take place and the webpage icons being transferred. When I click on an applicaiton I see three GET requests for launch.ica. The user/pass authenticated site then opens the client and connects while the Kerberos SSO site only sits and spins in chrome and does nothing in IE. Below is the APM log starting after the Policy completes and I click on an application for each of the sites.

 

user/pass site: Feb 26 10:59:41 rca-fs-fscbip02 debug tmm[13024]: 01490000:7: Request (GET /f5vdi/citrix/ica/QUZGU0NfWEFfNjUjQUFBQUFBOkNpdHJpeCBBcHAgQ2VudGVy/launch.ica?0.05834986548870802 HTTP/1.1 Host: citrixgw2.domain.com Connection: keep-alive Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36 DNT: 1 Referer: https://citrixgw2.domain.com/vdesk/webtop.eui?webtop=/Common/Citrix-SG1.app/citrix_webtop&webtop_type=webtop_full Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Cookie: F5_VDI_e259a1b4=0; F5_VDI_30d5e773=0; F5_VDI_88a14d50=0; F5_VDI_bfe0adec=0; F5_VDI_bb12c60c=0; F5_VDI_41d27baf=0; F5_VDI_c82d89c2=0; F5_VDI_99a8f620=0; F5_VDI_34014abe=0; F5_VDI_e0b82482=0; F5_VDI_f6decc44=0; F5_VDI_64fd6f4d=0; F5_VDI_9d0c678c=0; F5_VDI_a4d30fa9=0; F5_VDI_52a171c2=0; F5_VDI_7e0490e9=0; TIN=900000; LastMRH_Session=f58fb010; MRHSession=ce85f46094 Feb 26 10:59:41 rca-fs-fscbip02 debug tmm[13024]: 01490000:7: Client-type (apm-webtop) Feb 26 10:59:41 rca-fs-fscbip02 debug tmm[13024]: 01490000:7: Request GET /f5vdi/citrix/ica/QUZGU0NfWEFfNjUjQUFBQUFBOkNpdHJpeCBBcHAgQ2VudGVy/launch.ica?0.05834986548870802 HTTP/1.1 Host: citrixgw2.domain.com Connection: keep-alive Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36 DNT: 1 Referer: https://citrixgw2.domain.com/vdesk/webtop.eui?webtop=/Common/Citrix-SG1.app/citrix_webtop&webtop_type=webtop_full Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Cookie: F5_VDI_e259a1b4=0; F5_VDI_30d5e773=0; F5_VDI_88a14d50=0; F5_VDI_bfe0adec=0; F5_VDI_bb12c60c=0; F5_VDI_41d27baf=0; F5_VDI_c82d89c2=0; F5_VDI_99a8f620=0; F5_VDI_34014abe=0; F5_VDI_e0b82482=0; F5_VDI_f6decc44=0; F5_VDI_64fd6f4d=0; F5_VDI_9d0c678c=0; F5_VDI_a4d30fa9=0; F5_VDI_52a171c2=0; F5_VDI_7e0490e9=0; TIN=900000; LastMRH_Session=f58fb010; MRHSession=ce85f460941 Feb 26 10:59:41 rca-fs-fscbip02 debug tmm[13024]: 01490000:7: Request GET /f5vdi/citrix/ica/QUZGU0NfWEFfNjUjQUFBQUFBOkNpdHJpeCBBcHAgQ2VudGVy/launch.ica?0.05834986548870802 HTTP/1.1 Host: citrixgw2.domain.com Connection: keep-alive Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36 DNT: 1 Referer: https://citrixgw2.domain.com/vdesk/webtop.eui?webtop=/Common/Citrix-SG1.app/citrix_webtop&webtop_type=webtop_full Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Cookie: F5_VDI_e259a1b4=0; F5_VDI_30d5e773=0; F5_VDI_88a14d50=0; F5_VDI_bfe0adec=0; F5_VDI_bb12c60c=0; F5_VDI_41d27baf=0; F5_VDI_c82d89c2=0; F5_VDI_99a8f620=0; F5_VDI_34014abe=0; F5_VDI_e0b82482=0; F5_VDI_f6decc44=0; F5_VDI_64fd6f4d=0; F5_VDI_9d0c678c=0; F5_VDI_a4d30fa9=0; F5_VDI_52a171c2=0; F5_VDI_7e0490e9=0; TIN=900000; LastMRH_Session=f58fb010; MRHSession=ce85f460941 Feb 26 10:59:59 rca-fs-fscbip02 notice tmm3[13025]: 01490521:5: 7e0490e9: Session statistics - bytes in: 18721, bytes out: 11914

 

Kerberos Site: Feb 26 10:58:19 rca-fs-fscbip02 debug tmm2[13025]: 01490000:7: Request (GET /f5vdi/citrix/ica/QUZGU0NfWEFfNjUjQUFBQUFBOkNhbGM2NQ/launch.ica?0.03865986783057451 HTTP/1.1 Host: citrixgw2.domain.com Connection: keep-alive Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36 DNT: 1 Referer: https://citrixgw2.domain.com/vdesk/webtop.eui?webtop=/Common/CitrixGW2_Webtop&webtop_type=webtop_full Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Cookie: F5_VDI_e259a1b4=0; F5_VDI_30d5e773=0; F5_VDI_88a14d50=0; F5_VDI_bfe0adec=0; F5_VDI_bb12c60c=0; F5_VDI_41d27baf=0; F5_VDI_c82d89c2=0; F5_VDI_99a8f620=0; F5_VDI_34014abe=0; F5_VDI_e0b82482=0; F5_VDI_f6decc44=0; F5_VDI_64fd6f4d=0; F5_VDI_9d0c678c=0; F5_VDI_a4d30fa9=0; F5_VDI_52a171c2=0; LastMRH_Session=7e0490e9; MRHSession=048facd0db6b902c8f0ed3c67e0490e9; F5_fullWT=1; F5_VDI_7e0490e9=0; Feb 26 10:58:19 rca-fs-fscbip02 debug tmm2[13025]: 01490000:7: Client-type (apm-webtop) Feb 26 10:58:19 rca-fs-fscbip02 debug tmm2[13025]: 01490000:7: Request GET /f5vdi/citrix/ica/QUZGU0NfWEFfNjUjQUFBQUFBOkNhbGM2NQ/launch.ica?0.03865986783057451 HTTP/1.1 Host: citrixgw2.domain.com Connection: keep-alive Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36 DNT: 1 Referer: https://citrixgw2.domain.com/vdesk/webtop.eui?webtop=/Common/CitrixGW2_Webtop&webtop_type=webtop_full Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Cookie: F5_VDI_e259a1b4=0; F5_VDI_30d5e773=0; F5_VDI_88a14d50=0; F5_VDI_bfe0adec=0; F5_VDI_bb12c60c=0; F5_VDI_41d27baf=0; F5_VDI_c82d89c2=0; F5_VDI_99a8f620=0; F5_VDI_34014abe=0; F5_VDI_e0b82482=0; F5_VDI_f6decc44=0; F5_VDI_64fd6f4d=0; F5_VDI_9d0c678c=0; F5_VDI_a4d30fa9=0; F5_VDI_52a171c2=0; LastMRH_Session=7e0490e9; MRHSession=048facd0db6b902c8f0ed3c67e0490e9; F5_fullWT=1; F5_VDI_7e0490e9=0; F Feb 26 10:58:19 rca-fs-fscbip02 debug tmm2[13025]: 01490000:7: Request GET /f5vdi/citrix/ica/QUZGU0NfWEFfNjUjQUFBQUFBOkNhbGM2NQ/launch.ica?0.03865986783057451 HTTP/1.1 Host: citrixgw2.domain.com Connection: keep-alive Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36 DNT: 1 Referer: https://citrixgw2.domain.com/vdesk/webtop.eui?webtop=/Common/CitrixGW2_Webtop&webtop_type=webtop_full Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Cookie: F5_VDI_e259a1b4=0; F5_VDI_30d5e773=0; F5_VDI_88a14d50=0; F5_VDI_bfe0adec=0; F5_VDI_bb12c60c=0; F5_VDI_41d27baf=0; F5_VDI_c82d89c2=0; F5_VDI_99a8f620=0; F5_VDI_34014abe=0; F5_VDI_e0b82482=0; F5_VDI_f6decc44=0; F5_VDI_64fd6f4d=0; F5_VDI_9d0c678c=0; F5_VDI_a4d30fa9=0; F5_VDI_52a171c2=0; LastMRH_Session=7e0490e9; MRHSession=048facd0db6b902c8f0ed3c67e0490e9; F5_fullWT=1; F5_VDI_7e0490e9=0; F

 

  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Feb 26, 2014
    Can you set APM SSO logging to debug, test again, and then paste the APM logs?
  • Kory_52080's avatar
    Kory_52080
    Icon for Nimbostratus rankNimbostratus
    Feb 27, 2014
    Sorry for the delay and thank you for your help on this one. After receiving the Session DB 18 error we decided to upgrade to 11.5. That's done but we're still getting the same issue as before (minus the Session DB error). I set the sso logging to debug and here is the output from a failed attempt in IE. Feb 27 09:25:29 rca-fs-fscbip02 notice tmm[18083]: 01490506:5: 681844e2: Received User-Agent header: Mozilla%2f4.0%20(compatible%3b%20MSIE%207.0%3b%20Windows%20NT%206.1%3b%20WOW64%3b%20Trident%2f6.0%3b%20SLCC2%3b%20.NET%20CLR%202.0.50727%3b%20.NET%20CLR%203.5.30729%3b%20.NET%20CLR%203.0.30729%3b%20.NET4.0C%3b%20.NET4.0E%3b%20.NET%20CLR%201.1.4322%3b%20InfoPath.3). Feb 27 09:25:29 rca-fs-fscbip02 notice tmm[18083]: 01490544:5: 681844e2: Received client info - Type: IE Version: 7 Platform: Win7 CPU: WOW64 UI Mode: Full Javascript Support: 1 ActiveX Support: 1 Plugin Support: 0 Feb 27 09:25:29 rca-fs-fscbip02 notice tmm[18083]: 01490500:5: 681844e2: New session from client IP xxx.yyy.100.251 (ST=South Dakota/CC=US/C=NA) at VIP 132.9.100.232 Listener /Common/CitrixGW2_vs (Reputation=Unknown) Feb 27 09:25:30 rca-fs-fscbip02 notice apd[12952]: 01490010:5: 681844e2: Username 'username1' Feb 27 09:25:30 rca-fs-fscbip02 notice apd[12952]: 01490008:5: 681844e2: Connectivity resource '/Common/CitrixGW2_remotedesktop' assigned Feb 27 09:25:30 rca-fs-fscbip02 notice apd[12952]: 01490128:5: 681844e2: Webtop '/Common/CitrixGW2_Webtop' assigned Feb 27 09:25:30 rca-fs-fscbip02 notice apd[12952]: 01490005:5: 681844e2: Following rule 'fallback' from item 'Advanced Resource Assign' to ending 'Allow' Feb 27 09:25:30 rca-fs-fscbip02 notice apd[12952]: 01490102:5: 681844e2: Access policy result: Full Feb 27 09:25:42 rca-fs-fscbip02 debug websso.0[18568]: 014d0001:7: Expire thread: TGTlist:0 TGTMap:0 UCClist:0 UCCmap:0 Feb 27 09:25:43 rca-fs-fscbip02 debug websso.1[18669]: 014d0001:7: Expire thread: TGTlist:0 TGTMap:0 UCClist:0 UCCmap:0 Feb 27 09:25:44 rca-fs-fscbip02 debug websso.2[18761]: 014d0001:7: Expire thread: TGTlist:0 TGTMap:0 UCClist:0 UCCmap:0 Feb 27 09:25:45 rca-fs-fscbip02 debug websso.3[18866]: 014d0001:7: Expire thread: TGTlist:0 TGTMap:0 UCClist:0 UCCmap:0