Citrix Netscaler console GUI Java Problems

Java updates usually prevent Netscaler Admin console from working as expected.
We typically get stuck on a 1% loading screen

The process below typically correct these issues

Java Control Panel settings
Open up the Windows Control Panel and start the Java Control panel.
General -> Temporary Internet Files -> Settings and Unselect Keep temporary files on my computer.
General -> Advanced and configure the following options
“Mixed code (sandboxed vs trusted) security verification” = “Disable verification”
“Perform certificate revocation checks on” = “Do not check”
General ->disable the next generation Java plugin

Also note that the console require either 80 or 443 for HTTP traffic and 3008 or 3010 for Java Traffic.

Citrix XenMobile 9 "server requires client certificate" error message

My new Xenmobile 9 installation alongside Netsclaer 10.5 using the SSL Offload configuration kept giving me an error on the WORXMAIL client of

"server requires client certificate"

I tried to access the XenMobile server direct and through the Netscaler but with the same error each time.

Eventually this turned out to be quite simple, a incorrect firewall policy was blocking port 8443 to the required IP addresses in the DMZ.

Ensuring the rule allowed communication to the SSL Offload VIP address allowed me to correct this error.

Another Gotcha i had on this was i changed the XenMobile Server to use External Certificates as per Citrix Article. I did not notice but the "externalSslCert" wording is case sensitive.

Netscaler Gateway 10.5 Chrome logon problem

I noticed that my newly installed Netscaler Gateway 10.5 worked ok when using Internet Explorer but failed to work with Chrome

I was logging into netscaler gateway and then getting the following error message

“This page exists purely to allow AGEE to complete the AG logoff process”

It appears that application Firewall is enabled by default on netscaler 10.5 build. I disabled this and then chrome worked as expected. 

The option is found under system>Settings>Basic Features

Web Template missing from Certificate request

I have had the problem a few times now where when i goto my Certificate authority (CA) to request a certificate , in the drop down list of certificate types I only see Personal and EFS. I dont see the web template one that i require for my access gateway requests.

I found that to resolve this i had to change the permissions on the template on my CA.
My domain Admin group was setup correctly via group permissions , so i added my personal account directly and it seems to resolve the issue.

MFCOM script to detect CAG/Netscaler Access

MFCOM Script to detect CAG Access

I wanted a script to detect if a users connection was made through CAG (Citrix Access Gateway)

I required this as i wanted to save users default printer only when the connection was made in the office. This is to prevent users saving their home printer information into their profiles.

We use a hybrid profile solution managed by Appsense Environment Manager. Using the following script as a custom rule in Appsense we could tell Appsense to NOT SAVE the default printer for any connections made through the CAG.


Script 
'Name of Filter scan expected to pass
ExpectedFilter = "xxx_CWI_Policy"

'Get Server Name
Set objNTInfo = CreateObject("WinNTSystemInfo")
ServerName = lcase(objNTInfo.ComputerName)

Result = 0

'Create MetaFrame Session Object
Set MFSession = Createobject("MetaFrameCOM.MetaFrameSession")

'Initialize the session object with our data
MFSession.Initialize 6, ServerName ,"",-1

'Iterate through the session filters for this session

For Each x in MFSession.SmartAccessFilters
msgbox x
' return true if our filter is found
If x = ExpectedFilter Then
Result = 1
End If
Next
'Return result of script
If Result = 0 Then
'Rule will pass
WScript.Quit 0
Else
'Rule will fail
WScript.Quit 1
End If

Netscaler view Syslog Messages

The netscaler syslog messages can be handy for troubleshooting problems.

Acess this log via
System\Auditing in the left pane, and then Syslog messages in the right pane

Use the Module drop down the filter on traffic type.

For a high level auditing a NSTRACE can be started through the console. The output from this can also be downloaded from the netscaler through the web GUI back to your workstation. This then can be loaded into wireshark to be analysed.

IPhone and Ipad reciever "The gateway setting is invalid"

My Iphone and IPad Citrix Receiver (5.7) was giving the message "The gateway setting is invalid" when trying to connect to my Storefront server behind my access gateway.

My Mac Receiver worked as expected.


The following setting on my access gateway was required to cure the problem.

Storefront Green Bubble Theme for Netscaler Access Gateway

The storefront gives us a nice green bubble front end making our Access Gateway black logon screen look very tired and also giving users a strange experience as they pass from a black screen into a green one.

To make the experience a little more continus you can add the green bubble default theme from storefront to your Access gateway with the following steps

1. Download the script file and theme to your PC, eg http://cdn.ws.citrix.com/wp-content/uploads/2012/04/GreenBubble.txt and http://cdn.ws.citrix.com/wp-content/uploads/2012/04/GreenBubble1.gz
2. SSH to your Netscaler (ie use Putty) and enter the ” shell” command
3. Run the following command:
mkdir /var/vpn/customizations
4. Use WinSCP to connect to your Netscaler. Copy the script file (GreenBubble.txt) to the /root folder and the GreenBubble1.gz file to /var/vpn/customizations
6. Run the following commands:
cd /var/vpn/customizations
gunzip GreenBubble1.gz
tar -xvf GreenBubble1
cd /root
mv GreenBubble.txt GreenBubble1.sh
chmod +x GreenBubble1.sh
./GreenBubble1.sh


thanks to a user who replied the details on how to do this on this blog article
http://blogs.citrix.com/2012/04/19/green-bubble-theme-for-citrix-netscaler/

I have seen a company that does fixed price customised interface should a customer ever require it
http://www.techstur.com/Solutions/Netscaler/Tech.aspx

Iphone/Ipad Giving error message : The Address given did not provide a valid App List

Using my Iphone and Ipad to connect through Access Gateway (on Netsclaer VPX 9.2)
I was getting the following error message.

"The Address given did not provide a valid App List"

I followed the instructions in this document to disable "Client Choices" in the citrix experience policy.
CTX126776

The error continued so then i checked the event log on my Web Interface server

and found these entries

Site path: C:\inetpub\wwwroot\Citrix\XenApp1.
The request from the browser running on the user device 192.168.1.70 cannot be processed because the User-Agent HTTP header, which provides platform information, is missing. [Unique Log ID: e31c8ec8]


This problem is detailed in CTX124858
The resolution in this document did not work for me. I could not add the special header parameters as the netscaler reported there were to many characters.
To workaround the issue i disabled the CITIRX-WEB-INTERFACE monitor on the Netscaler.

My Iphone and Ipad connection then worked all OK.

I then went back and re-enabled my CITRIX-WEB-INTERFACE monitor on the netscaler and the everything still works ok. So i think the fix was to disable Client options and then maybe restart the citrix reciever.

Netscaler Load Balanced Web Interface - Error Set Cookie Header not found in responce

I used the Netscaler 9.2 Wizard to create load balancing for Citrix Xenapp.

However after completing the wizard the Web interface monitors showed down for all my web interface servers.
Looking at the monitor i could see an error message
"Failure - Set-Cookie header not found in the response"

Checking back through the configuration i could see i had set the path to the Web interface site incorrectly.
I had missed off /auth/login.aspx from the end of the site path.

Adding the correct path and clicking REFRESH ALL then showed my web interface sites as up.

Setting up Citrix Access Gateway on Netscaler for Mobile devices like Iphone, Ipad, Android

This Citrix Video gives a great demo of how to setup Access Gateway to allow the connection of Mobile devices using Citrix Receiver to connect.

CTX125652

If you dont like videos the basics are :

1. Ensure you create a Web Interface Services Site
    Ensure you have Explict prompt on the authentication method

2. Create a New Session policy Profile for "Mobile Devices"

Access Gateway/Polices/Session Profiles tab.
Select to override all global settings throughout the profile.
Goto the Published application tab and populate the web interface address as the PNAgent site. (eg. http://1.1.1.1/citrix/pnagent/config.xml)
On the same tab Ensure ICA Proxy = ON
On the Client Experience tab ,click advanced and ensure "Client Choices" is not ticked.

3. Create a new session policy within Access Gateway with the following expression
flow      Protocol   Qualifier     Operator          Value*                  Header Name*
REQ     HTTP      HEADER   CONTAINS    CitrixReciever       User-Agent
Link this to the profile created in the previous step for "Mobile Devices"

4. On the Access Gateway Virtual Server , Policies tab, add the newly created Session Policy and ensure it has the highest priority so it is processed first.

5. Now setup the Citrix Reciever on the end client device to connect up.
    This will require you getting the licence used on the Access Gateway to your end client.
    To accomplish this I exported the certificate file and emailed it to my IPhone and Ipad.
     Then clicked the .CER and installed the certificate.

Migrating Citrix Secure Gateway Certificates to Access Gateway

This Citrix article CTX113627 details a possible process to migrate your Certificates from Citrix Secure Gateway to Access Gateway. It Also details the process to create a new Certificate request and add this to the Access Gateway

Heres a basic run down on the process.

Option 1 - To Export your current Certificate as a PKCS#12
Basically get the certificate up in the MMC snap in and right click and Export. As long as you get the option
to export with the private Key you should be ok. As you need to put both the private and public keys onto the Access Gateway.

Option 2 - Make a nice new Certificate Key Pair
AG - SSL Settings - Make a RSA request which makes you a new Private key file (.KEY)
AG - SSL Settings - Make a Certificate Request to make a request file (.REQ)
Windows - Use Something like WINSCP to get the REQ file off the Access Gateway and onto your PC.
Windows - Connect to CA webpage and copy the contents of the REQ file into the CA request form.
Windows - Through the CA console Issue the the Certificate
Windows - Connect to Licence Webpage and download the Certificate making sure to select (BASE 64)
Windows  Use something like WINSCP to upload the .CER file to the Access Gateway
AG - SSL settings - Add new Certficate - Combine the .CER and the .KEY from earlier to create a Certificate Key Pair
AG - Access Gateway - Virtual Server - Attatch the Certifcate to the AG Vserver
Windows - Ensure Client devices have the CA as trusted root authority.

The Citrix Full Article
http://support.citrix.com/article/CTX113627

Citrix Access Gateway - There are no common encryption algorithms

I had problems after building a new Netscaler 9.2 VPX and setting up Access Gateway.

Internet Explorer Simply refused to show any access gateway landing page
My Iphone and IPad showed the Access Gateway logon screen correctly
I was getting the following error message in firefox when browsing to my Access Gateway site.

"There are no common encryption algorithm"
 
 I found some stuff on the web about TLS v3 , SSL Ciphers etc.. but my solution was far more simple.

I had rebuilt the Netscaler and re-applied the same Licence file. This was a mistake as the licence file is connected to a Host ID (like a MAC) address of the device and not its device name.

I basically applied for a new licence file through MYCITRIX.COM and entered in the new Host ID address of the netscaler and applied the new licence and its now working as expected.

To view the Host ID address of the Netscaler go through the CLI and enter

Shell
lmutil lmhostid –ether

This will display the MAC ID of the device. This is what you need to put into the Licence file request on the MyCitrix.com website.

Full details on the licencing process are in CTX121062