For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Tony_Kroukamp_1's avatar
Tony_Kroukamp_1
Icon for Nimbostratus rankNimbostratus
Oct 02, 2013

Need to modify Citrix ICA file

I have Citrix deployed through F5 using an iApp, and all is working fine. I have one app that is published through Citrix that interrogates the connecting PC for that machine's computer name, this c...
application delivery
citrix
devops
iRules
Jason_40733's avatar
Jason_40733
Icon for Cirrocumulus rankCirrocumulus
Oct 02, 2013

We are currently using an iRule with a stream replacement to modify our Citrix ICA files. Our scenario differs in that we know the exact string. You'll have to do the regex to get yours to replace it. If I read this correctly, it's the ICA in the response file that has the ClientName in it. So the examples in this should help you.

 

https://devcentral.f5.com/wiki/irules.STREAM__expression.ashx

 

But the stream has worked extremely well for us in our implementation. Being that it is only on the ICA file transmission and login the iRule doesn't get called often.

 

One last thing, when doing our Citrix implementation we didn't use the iApp, but we also did not run into the problem you're seeing. Is it possible that sending the X-forwarded-for might alleviate this problem for you?

 

Jason

 

Jason_40733's avatar
Jason_40733
Icon for Cirrocumulus rankCirrocumulus
Oct 21, 2013
Sorry, went on vacation. Here is our code. Please note that we had to search for two occurrences and also be aware that case can change in the variable names. This bit us several times until we put in a larger rule that replaced all of the variants of case we saw in the hostname. when HTTP_REQUEST { Disable the stream filter for all requests STREAM::disable set find "stuff.mycompany.net" set findagain "STUFF.mycompany.net:1494" set replace "192.168.1.2" set replaceagain "192.168.1.2:1494" } when HTTP_RESPONSE { Replace IP addresses in response content with the string STREAM::expression "@$find@$replace@ @$findagain@$replaceagain@" Enable the stream filter for this response only STREAM::enable } Not a lot of magic in it, fairly straight forward rule. If anyone has improvements, I'd love to add something to my repertoire.