Netscaler Gateway 10.5 Chrome logon problem

I noticed that my newly installed Netscaler Gateway 10.5 worked ok when using Internet Explorer but failed to work with Chrome

I was logging into netscaler gateway and then getting the following error message

“This page exists purely to allow AGEE to complete the AG logoff process”

It appears that application Firewall is enabled by default on netscaler 10.5 build. I disabled this and then chrome worked as expected. 

The option is found under system>Settings>Basic Features

MFCOM script to detect CAG/Netscaler Access

MFCOM Script to detect CAG Access

I wanted a script to detect if a users connection was made through CAG (Citrix Access Gateway)

I required this as i wanted to save users default printer only when the connection was made in the office. This is to prevent users saving their home printer information into their profiles.

We use a hybrid profile solution managed by Appsense Environment Manager. Using the following script as a custom rule in Appsense we could tell Appsense to NOT SAVE the default printer for any connections made through the CAG.


Script 
'Name of Filter scan expected to pass
ExpectedFilter = "xxx_CWI_Policy"

'Get Server Name
Set objNTInfo = CreateObject("WinNTSystemInfo")
ServerName = lcase(objNTInfo.ComputerName)

Result = 0

'Create MetaFrame Session Object
Set MFSession = Createobject("MetaFrameCOM.MetaFrameSession")

'Initialize the session object with our data
MFSession.Initialize 6, ServerName ,"",-1

'Iterate through the session filters for this session

For Each x in MFSession.SmartAccessFilters
msgbox x
' return true if our filter is found
If x = ExpectedFilter Then
Result = 1
End If
Next
'Return result of script
If Result = 0 Then
'Rule will pass
WScript.Quit 0
Else
'Rule will fail
WScript.Quit 1
End If

IPhone and Ipad reciever "The gateway setting is invalid"

My Iphone and IPad Citrix Receiver (5.7) was giving the message "The gateway setting is invalid" when trying to connect to my Storefront server behind my access gateway.

My Mac Receiver worked as expected.


The following setting on my access gateway was required to cure the problem.

Storefront Green Bubble Theme for Netscaler Access Gateway

The storefront gives us a nice green bubble front end making our Access Gateway black logon screen look very tired and also giving users a strange experience as they pass from a black screen into a green one.

To make the experience a little more continus you can add the green bubble default theme from storefront to your Access gateway with the following steps

1. Download the script file and theme to your PC, eg http://cdn.ws.citrix.com/wp-content/uploads/2012/04/GreenBubble.txt and http://cdn.ws.citrix.com/wp-content/uploads/2012/04/GreenBubble1.gz
2. SSH to your Netscaler (ie use Putty) and enter the ” shell” command
3. Run the following command:
mkdir /var/vpn/customizations
4. Use WinSCP to connect to your Netscaler. Copy the script file (GreenBubble.txt) to the /root folder and the GreenBubble1.gz file to /var/vpn/customizations
6. Run the following commands:
cd /var/vpn/customizations
gunzip GreenBubble1.gz
tar -xvf GreenBubble1
cd /root
mv GreenBubble.txt GreenBubble1.sh
chmod +x GreenBubble1.sh
./GreenBubble1.sh


thanks to a user who replied the details on how to do this on this blog article
http://blogs.citrix.com/2012/04/19/green-bubble-theme-for-citrix-netscaler/

I have seen a company that does fixed price customised interface should a customer ever require it
http://www.techstur.com/Solutions/Netscaler/Tech.aspx

Certificate with key size greater than RSA512 or DSA512

When trying to add a certificate to a netscaler i recieved the following error message.

This was basically because of a licence issue on the netscaler which hinders support for high encryption certificates.

Full details in this citrix article
http://support.citrix.com/article/CTX125548

Citrix Access Gateway : SSL Error 86 : The security Certificate could not be validated

Connecting through Access Gateway to XenApp delivered applications i recieved the following error message.

SSL Error 86 : The security certificate could not be validated. (SSL Provider code:unable to get local user certificate)

This error was resolved by Simply Installing the Access Gateways Certificate in the Trusted Root CA list on the client PC.

Iphone/Ipad Giving error message : The Address given did not provide a valid App List

Using my Iphone and Ipad to connect through Access Gateway (on Netsclaer VPX 9.2)
I was getting the following error message.

"The Address given did not provide a valid App List"

I followed the instructions in this document to disable "Client Choices" in the citrix experience policy.
CTX126776

The error continued so then i checked the event log on my Web Interface server

and found these entries

Site path: C:\inetpub\wwwroot\Citrix\XenApp1.
The request from the browser running on the user device 192.168.1.70 cannot be processed because the User-Agent HTTP header, which provides platform information, is missing. [Unique Log ID: e31c8ec8]


This problem is detailed in CTX124858
The resolution in this document did not work for me. I could not add the special header parameters as the netscaler reported there were to many characters.
To workaround the issue i disabled the CITIRX-WEB-INTERFACE monitor on the Netscaler.

My Iphone and Ipad connection then worked all OK.

I then went back and re-enabled my CITRIX-WEB-INTERFACE monitor on the netscaler and the everything still works ok. So i think the fix was to disable Client options and then maybe restart the citrix reciever.

Setting up Citrix Access Gateway on Netscaler for Mobile devices like Iphone, Ipad, Android

This Citrix Video gives a great demo of how to setup Access Gateway to allow the connection of Mobile devices using Citrix Receiver to connect.

CTX125652

If you dont like videos the basics are :

1. Ensure you create a Web Interface Services Site
    Ensure you have Explict prompt on the authentication method

2. Create a New Session policy Profile for "Mobile Devices"

Access Gateway/Polices/Session Profiles tab.
Select to override all global settings throughout the profile.
Goto the Published application tab and populate the web interface address as the PNAgent site. (eg. http://1.1.1.1/citrix/pnagent/config.xml)
On the same tab Ensure ICA Proxy = ON
On the Client Experience tab ,click advanced and ensure "Client Choices" is not ticked.

3. Create a new session policy within Access Gateway with the following expression
flow      Protocol   Qualifier     Operator          Value*                  Header Name*
REQ     HTTP      HEADER   CONTAINS    CitrixReciever       User-Agent
Link this to the profile created in the previous step for "Mobile Devices"

4. On the Access Gateway Virtual Server , Policies tab, add the newly created Session Policy and ensure it has the highest priority so it is processed first.

5. Now setup the Citrix Reciever on the end client device to connect up.
    This will require you getting the licence used on the Access Gateway to your end client.
    To accomplish this I exported the certificate file and emailed it to my IPhone and Ipad.
     Then clicked the .CER and installed the certificate.

Migrating Citrix Secure Gateway Certificates to Access Gateway

This Citrix article CTX113627 details a possible process to migrate your Certificates from Citrix Secure Gateway to Access Gateway. It Also details the process to create a new Certificate request and add this to the Access Gateway

Heres a basic run down on the process.

Option 1 - To Export your current Certificate as a PKCS#12
Basically get the certificate up in the MMC snap in and right click and Export. As long as you get the option
to export with the private Key you should be ok. As you need to put both the private and public keys onto the Access Gateway.

Option 2 - Make a nice new Certificate Key Pair
AG - SSL Settings - Make a RSA request which makes you a new Private key file (.KEY)
AG - SSL Settings - Make a Certificate Request to make a request file (.REQ)
Windows - Use Something like WINSCP to get the REQ file off the Access Gateway and onto your PC.
Windows - Connect to CA webpage and copy the contents of the REQ file into the CA request form.
Windows - Through the CA console Issue the the Certificate
Windows - Connect to Licence Webpage and download the Certificate making sure to select (BASE 64)
Windows  Use something like WINSCP to upload the .CER file to the Access Gateway
AG - SSL settings - Add new Certficate - Combine the .CER and the .KEY from earlier to create a Certificate Key Pair
AG - Access Gateway - Virtual Server - Attatch the Certifcate to the AG Vserver
Windows - Ensure Client devices have the CA as trusted root authority.

The Citrix Full Article
http://support.citrix.com/article/CTX113627

Citrix Access Gateway - There are no common encryption algorithms

I had problems after building a new Netscaler 9.2 VPX and setting up Access Gateway.

Internet Explorer Simply refused to show any access gateway landing page
My Iphone and IPad showed the Access Gateway logon screen correctly
I was getting the following error message in firefox when browsing to my Access Gateway site.

"There are no common encryption algorithm"
 
 I found some stuff on the web about TLS v3 , SSL Ciphers etc.. but my solution was far more simple.

I had rebuilt the Netscaler and re-applied the same Licence file. This was a mistake as the licence file is connected to a Host ID (like a MAC) address of the device and not its device name.

I basically applied for a new licence file through MYCITRIX.COM and entered in the new Host ID address of the netscaler and applied the new licence and its now working as expected.

To view the Host ID address of the Netscaler go through the CLI and enter

Shell
lmutil lmhostid –ether

This will display the MAC ID of the device. This is what you need to put into the Licence file request on the MyCitrix.com website.

Full details on the licencing process are in CTX121062

Adding Licences to a Access Gateway pair

This is the process used to add additional licences onto our pair of netscaler 9 appliances.

Use "winscp" to add the license file to both CAG devices. They need to go in /nsconfig/license

Reboot the secondary node, log into the gui and check System/Licenses and make sure the Maximum Access Gateway Users Allowed number has increased.
Click Manage Licenses and make sure the added license number is visible. If not add it, choosing local appliance as the source.

Go into Access Gateway/Global Settings> change authentication settings
Change the Maximum Number of Users setting to the number of total license from above. If you do not do this adding the license will not achieve anything.

Edit the properties the Virtual Servers used for CAG and again increment the maximum number
of users.

Perform a fail over, then do the same on the new secondary.

Access Gateway Enterprise - Error Logs

To help diagnose a logon problem for a user we simply checked the log files on the device.

Using WINSCP or similar connect to /var/log directory.
right click and edit the current messages file, and search for the user ID of the user having problems.

Below is the an example error. In this case our user was failing the end point scan as they did not have the SAVSERVICE.EXE running.

example error:
Jun 28 17:11:04 10.2.60.21 06/28/2010:17:11:04 GMT ns PPE-0 : SSLVPN CLISEC_EXP_EVAL 41890 : User THINUSER: - Client IP 212.183.140.16 - Vserver 161.12.7.216:443 - Client security expression CLIENT.APPLICATION.PROCESS(SavService.exe) EXISTS -frequency 5 evaluated to FALSE(3)

Access Gateway Event log error : DOWN; Last response: Failure - ICMP port unreachable

Our Access Gateway Enterprise Edition stopped working all of a sudden. Users got the following message at the AG Logon screen.

User name or password Invalid

Our RSA servers had been failed over shortly before.
Checking the AG Events Log (System\diagnostics\View Events)
The following was contained in the log

179421 0 Monitor_udp-ecv_of_Radius2(10.1.163.201:1812): DOWN; Last response: Failure - ICMP port unreachable. Wed Sep 16 19:00:01 2009
179422 0 'server_NSSVC_UDP_10.1.163.201:1812(Radius2)' DOWN Wed Sep 16 19:00:01 2009
179423 0 'server_NSSVC_UDP_192.168.123.126:1812(Radius_Loadbalanced)' DOWN Wed Sep 16 19:00:01 2009
179426 32001 Monitor_udp-ecv_of_Radius2(10.1.163.201:1812): UP; Last response: Failure - ICMP port unreachable. Wed Sep 16 19:00:33 2009
179427 0 'server_NSSVC_UDP_10.1.163.201:1812(Radius2)' UP Wed Sep 16 19:00:33 2009
179428 0 'server_NSSVC_UDP_192.168.123.126:1812(Radius_Loadbalanced)' UP Wed Sep 16 19:00:33 2009
179421 0 Monitor_udp-ecv_of_Radius2(10.1.163.201:1812): DOWN; Last response: Failure - ICMP port unreachable. Wed Sep 16 19:00:01 2009
179422 0 'server_NSSVC_UDP_10.1.163.201:1812(Radius2)' DOWN Wed Sep 16 19:00:01 2009
179423 0 'server_NSSVC_UDP_192.168.123.126:1812(Radius_Loadbalanced)' DOWN Wed Sep 16 19:00:01 2009
179426 32001 Monitor_udp-ecv_of_Radius2(10.1.163.201:1812): UP; Last response: Failure - ICMP port unreachable. Wed Sep 16 19:00:33 2009
179427 0 'server_NSSVC_UDP_10.1.163.201:1812(Radius2)' UP Wed Sep 16 19:00:33 2009
179428 0 'server_NSSVC_UDP_192.168.123.126:1812(Radius_Loadbalanced)' UP Wed Sep 16 19:00:33 2009
181432 0 Monitor_STAMON-0_of_internal(10.70.133.1:80): UP; Last response: Probe to STA server succeeded. Thu Sep 17 12:54:04 2009
181934 0 Monitor_udp-ecv_of_Radius3(10.8.195.201:1812): DOWN; Last response: Failure - ICMP port unreachable. Thu Sep 17 15:37:33 2009
181935 0 'server_NSSVC_UDP_10.8.195.201:1812(Radius3)' DOWN Thu Sep 17 15:37:33 2009
181938 32000 Monitor_udp-ecv_of_Radius3(10.8.195.201:1812): UP; Last response: Failure - ICMP port unreachable. Thu Sep 17 15:38:05 2009
181939 0 'server_NSSVC_UDP_10.8.195.201:1812(Radius3)' UP Thu Sep 17 15:38:05 2009
181942 58002 Monitor_udp-ecv_of_Radius3(10.8.195.201:1812): DOWN; Last response: Failure - ICMP port unreachable. Thu Sep 17 15:39:03 2009
181943 0 'server_NSSVC_UDP_10.8.195.201:1812(Radius3)' DOWN Thu Sep 17 15:39:03 2009
181956 0 Monitor_udp-ecv_of_Radius3(10.8.195.201:1812): UP; Last response: Failure - ICMP port unreachable. Thu Sep 17 15:40:35 2009
181957 0 'server_NSSVC_UDP_10.8.195.201:1812(Radius3)' UP Thu Sep 17 15:40:35 2009
182083 0 Monitor_udp-ecv_of_Radius2(10.1.163.201:1812): DOWN; Last response: Failure - ICMP port unreachable. Thu Sep 17 16:20:13 2009
182084 0 'server_NSSVC_UDP_10.1.163.201:1812(Radius2)' DOWN Thu Sep 17 16:20:13 2009
182085 1 'server_NSSVC_UDP_192.168.123.126:1812(Radius_Loadbalanced)' DOWN Thu Sep 17 16:20:13 2009
182088 62001 Monitor_udp-ecv_of_Radius2(10.1.163.201:1812): UP; Last response: Failure - ICMP port unreachable. Thu Sep 17 16:21:15 2009
182089 0 'server_NSSVC_UDP_10.1.163.201:1812(Radius2)' UP Thu Sep 17 16:21:15 2009
182090 1 'server_NSSVC_UDP_192.168.123.126:1812(Radius_Loadbalanced)' UP Thu Sep 17 16:21:15 2009

This log appears to show the Radius servers failing over and then coming back up.
However users were still unable to logon.

We failed over the AG device (System\High Availability)
and then logons started to work. We failed the server back to the original and it still continued to work. (Note : 2nd failover back to original server was slow server disappeared for 10 mins)

Our Radius Service was set to Load Balance which we know is not the best setting in the event of a Radius server going down as this will still send requests to it, but in our scenario here the CAG did not seem to send any requests to the Radius servers after those Servers had been restarted.

Access Gateway NSTrace files growing large

I had an issue where the Access Gateway Enterprise (netscaler) NSTrace logs seemed to be very large with many of them over 1GB in size. They seemed to be constantly growing despite the fact no trace was being run.

To Resolve this i had to do the following
Used putty to connect to CAG,

Type Shell at command line

ps auxw |grep nstrace

to display nstrace processes.

Then used kill pid to kill the rogue NSTrace processes
Some of the processes did not die, so I had to use kill -9 pid