https://worldofeuc.com logo
Join Slack
Powered by
This message was deleted.
# citrix-netscaler
s
This message was deleted.
c
Yes that’s correct. You double hop the Gateway but can’t double hop the STA connection, that needs to go from the external NetScaler directly to the STA Controllers
m
yeah, we’ve got everything working except the ica launch because it’s trying to talk to the VDA directly and can’t
so we need to set it up as double hop so that final connection knows to go through the other netscaler
c
Yip correct
m
ok cool, thanks. Been a while since I’ve set up internal/external, been doing so much gateway service lately
forgot how the traffic flow works
c
I have some notes on double hop if needed
m
it sort of seems intuitive to assume that if you can get storefront internally to send you an ICA file it should route through the internal netscaler, but the storefront vip is a not a gateway so it makes sense why it doesn’t
yeah, I’m all for notes
s
so not really a double hop, you just want the actual ica proxy to go through the dmz netscaler? Should be able to do that with optimal gateway routing i believe.
m
there’s no gateway on the nternal netscaler is the problem
the client was just assuming all the traffic came out of the internal snip
s
right, users goto storefront, get their icons, click an icon, and you want that to route through a DMZ netscaler?
oh gotcha
m
the issue is it’s set up to be double hop only without the double hop part of the config
so it only gets as far as storefront, and when the ICA file comes back the gateway tries direct because it hasn’t been told to do double hop
I’m migrating a config from sdx to vpx with the added bonus of the new network being firewalled off
where it looks like the old one wasn’t
so I’m hearing “well how is it working now?” frequently
s
oh ok, so you want the connection to go through the DMZ, then continue to talk to internal netscaler, then to VDA
life is tough 😉
m
yeah 😛
s
actually never done that before
c
m
double hop is the answer I think, just need to convince them. I don’t do a lot of it.
yeah, I found that article and it goes over exactly why it’s not working as is
it’s not trying to proxy the connection through the second netscaler because it never got told to
makes sense
c
Double hop enabled on the DMZ Gateway? Authentication off on the Internal Gateway?
m
there’s no internal gateway yet, that’s the entire problem
c
ok, need to get that created with no auth enabled, then on the DMZ one say the next hop is the internal Gateway (by IP)
m
yeah
the rest of it is there
this is the missing bit to get the ica file to go through the internal netscaler to hit the sta encoded ip
s
are there benefits to using double hop?
m
yeah, keeps everything on 443 until it hits the internal netscaler
👍 1
c
ICA will go back to the external GW, which then instructs it to go to the internal GW
m
external never talks direct to vdas in double hop, which is what they want
c
that may not work then
s
443....2598...meh Could enable SSL on the VDAs too
m
it should work if it can talk to everything but the vda though
which it can because it gets the ica file
c
might need to draw it up what you have in place and aiming to do
m
it’s a little convoluted but once we configure the internal gateway and the next hop it should proxy the final connection and get to the vda
s
is the double hop more for security concerns? or just the client wants it?
m
all the other holes in the firewall for STAs are there
it’s the latter right now, but it’s supposed to be more secure
s
i know there are some things that don't play nice with double hop, so i usually steer clients away from it. I've seen secure documents that suggest having dobule netscaler pairs, one for DMZ, one for internal, but i dont remember those saying to use double hop
m
I don’t see how to force the ICA traffic through the internal pair without it though
s
right, if thats what you want to do, your right.
c
have you currently got the internal GW setup?
m
no
there’s a totally seperate internal gateway but it has auth turned on so I’ll have to set up a new one
c
yip, get a new one setup just for double hop
m
right now it’s just the storefront vip on there that the external talks to
👍 1
j
I would create an internal gateway and do a split DNS if it's an option. Or just direct connection endpoint to VDA, no NS. I'm prob off your requirements but still a suggestion.
2 Views
Open in Slack
PreviousNext
Powered by