For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

BigDaddyJay_148's avatar
BigDaddyJay_148
Icon for Nimbostratus rankNimbostratus
Aug 14, 2014

F5 citrix xml broker-fronted Webtop

Hi; I hope you are well.

 

We are trying to implement an F5-fronted XML brokered Citrix solution. The solution is as bear-bones as possible to keep it simple: only HTTP is used.

 

The chain/path is as follows:

 

We have a VIRTUAL SERVER LINKING TO A POOL CONTAINING 2 CITRIX XML BROKERS AND A SINGLE CITRIX SERVER WHICH HOSTS A SINGLE NOTEPAD APP ICON ==

 

The above uses a profile that includes an Access policy that successfully authenticates to corresponding AD (this works as we can log in using domain credentials) and links to a webtop and a remote desktop.

 

The problem is that there are no Icons displayed once logged in to the webtop?

 

I may have breezed over a few of the finer points but any suggestions are welcome as to why there are no icons/apps displayed.

 

The XML brokers and the lone citrix server are all up and available and the F5 is aware of them.

 

Thanks All

 

BIG-IP Access Policy Manager (APM)
citrix
deployment
security

4 Replies

  • Hamish's avatar
    Hamish
    Icon for Cirrocumulus rankCirrocumulus
    Aug 14, 2014
    1. I haven't tried this with just HTTP...
    2. When you tcpdump the XMLbroker traffic between the BigIP and the XMLBrokers, do you see a response with the apps in it going back to the BigIP?
    3. When you tcpdump the traffic between BigIP and the client, do you see the same response with App(s) in it as you do for 2?

    Do you get absolutely no icons? Including no icon for a broken desktop config? Have you assigned the remote desktop using the full resource object in the VPE?

     

    As you're using APM, you don't actually need to put a default pool on the VS... That's all handled by the APM itself intercepting the requests to the VS and directing to the appropriate pool member/IP address associated with the remote desktop config itself.

     

    H

     

  • BigDaddyJay_148's avatar
    BigDaddyJay_148
    Icon for Nimbostratus rankNimbostratus
    Aug 14, 2014

    Hi H;

     

    The only XML broker traffic seen so far is the heatlh check ping (icmp_gateway ping) The TCP dump shows the applications being assigned to user as the login (we configured 1 Webtop and 1 RDP ) I have assigned the FULL RESOURCE object in the VPE We get get absolutely no icons.

     

    Thank you

     

  • Hamish's avatar
    Hamish
    Icon for Cirrocumulus rankCirrocumulus
    Aug 14, 2014

    OK. The icons are displayed by the javascript code in the browser. The sequence is

     

    1. User connects & authenticates
    2. APM delivers a small javascript program to the browser
    3. javascript runs and requests list of apps from APM (Ajax call)
    4. javascript interprets and displays icons for the resulting list of apps in 3
    5. javascript queries VS for each app icon (one-by-one - exact sequence is dependent on version)

    .... Umm... If you don't see XML broker traffic querying the apps, how do you state that you see the applications being assigned to user as login?

     

    Any javascript errors on the browser console? If you run firefox with firebug (Or similar) can you see what the javascript is doing?

     

    What's the client?

     

  • BigDaddyJay_148's avatar
    BigDaddyJay_148
    Icon for Nimbostratus rankNimbostratus
    Aug 14, 2014

    Hi H;

     

    I will re analyse the current configuration focusing on the XML Broker APM transactions. As for the application assignment what you say is logical; I,ve mis-interpreted the tcpdump output. I’ll repost when the issue I think I have is more tangible.

     

    Thank you for the insight 

     

    J