Two-factor authentication for Citrix Receiver for Windows
I have deployed F5 APM with two-factor authentication. APM is currently replacing the Web Interface / Storefront servers. Two-factor authentication is confirmed working for the Webtop, Citrix Receiver for Mac, Citrix Receiver for iOS and Citrix Receiver for Android. My issue is that Citrix Receiver for Windows doesn't appear to have the necessary options to select the Logon type of "Security token only" or "Domain and security token" like the Receiver for other OS's do. I suspect that Citrix Receiver for Windows requires some kind of configuration push from the server (which in my case is APM). Has anyone else experienced this issue or have any ideas?
APM webtop to Citrix - what timeouts control session traffic stopping?
Environment - Big-IP 4200v running 11.5.2 plain, no hotfix. Context: APM webtop providing an SSL tunnel to XenApp servers via a Citrix remote desktop. Remote desktop is configured with XenApp XML Broker IP (actually, LTM pool of such brokers). Webtop replaces Storefront, provides launch icons. Doing tsharks to observe traffic, I notice that when we launch a XenApp hosted application, then close that application, the traffic between the F5 to the XenApp host server continues (and not just a little, consistent packet flow) for 350 - 400 seconds before ceasing. Not sure why - keeping it open in case of a subsequent launch? Not sure. I presume that's controlled by timeouts ... but I can't tell what timeouts, nor where (on the F5 or on the XenApp side). I would like to reduce how long the connection stays open and has traffic flow as much as reasonable. So where is this post-app-close traffic controlled? And what are the tradeoffs for reducing how long the connection is left open? thx!Citrix Desktop via APM - APM fails accessing XenApp on :2598, doesn't try :1494 ...?
Config: firmware 11.5.2, Big-IP 4200v, accessing XenApp server on Win2012, running Xenapp version... 7.1, i think We have an APM webtop configged to replace the Citrix Storefront, by virtue of a remote desktop resource. That's all working correctly, the broker is being accessed cleanly, and the apps permitted the user are being displayed. But we discovered we have one Citrix server that isn't listening on port 2598 (the CGPAddress from the ICA file). When we run a desktop allocated to that server via the Citrix Storefront, a capture shows that the Receiver app first tries server:2598, but gets a RST back - and moves on to use :1494, and everything works fine. When we access the same desktop over APM, a tcpdump shows that the F5 attempts server:2598 ... then stops, after receiving an RST back. Other Xenapp desktops and apps launched via APM run fine - because the XenApp server they're running on are all correctly listening on :2598 (I've verified numerous of them via tcpdump, and the APM is always using :2598). Of course we can get the one server fixed, so it IS listening on its CGPAddress:port ... but why isn't APM going on to try :1494 if unsuccessful on :2598? Is there any configuration option to make it do so? Thx!
Citrix Xenapp 6.5 Server with CSG - HTTP 400 Bad Request error
I have 1 Xenapp 6.5 server: On this server I have Web Interface, Secure Gateway and its my STA server as well. I have IIS set to SSL port 444 and my CSG is set to 443. I can telnet to my host https://cloud.rainiertitle.com on port 1494 and 2598 - I have disabled session reliability for this troubleshooting. My STA is generating no errors. IIS is giving no errors. This is driving me crazy. I can access everything internally, but I get the HTTP 400 Bad Request when I try to access my site externally. My DNS is working correctly. Everything resolves fine. I ran Fiddler to try to trace my https traffic and I received this error: HTTP/1.1 400 Bad request Date: Fri, 08 Aug 2014 15:35:44 GMT Server: Citrix Web PN Server Content-Length: 0 Connection: close Content-Type: text/plain Any ideas?