This message was deleted.

So if you connect straight to each storefront it works?

This setup comes from a legacy NetScaler. The config is similar and the storefront servers at the backend also. In there the detection is working fine. But I cannot find any differences

Maybe something with this: https://support.citrix.com/article/CTX462375/client-detection-fails-through-adc-but-works-through-storefront

Storefront 2203.0.2000.5 and NetScaler 13.1.49.15, using the latest workspace app as well.

maybe it is client side you blocking protocol handlers in your browser? chrome://settings/handlers

No its not a client base issue. The old Gateway does his job and will detect the client.

Hi, is the netscaler able to resolve the name of storefront?(the base url) and also able to reach it?

Yes he is.

Couldn't you turn the client detection off in the web.config on the RFW web site

Hi John, The strange thing is, the same store is used by the old NetScaler as well. And within that config the detection works fine.

how is the dns resolution? were does the storefront base url points do and how is netscaler resolving it? did you maybe create a new lb vserver on the new netscaler and the dns still resolves to the old one. Cause client detection is done with a STA Ticket and the DNS Name of storefront, something like https://storefrontbaseurl/clientDetection/reportStatus (not sure if the url is 100% correct that way). So the Ip works fine in the session policies for everything else. It is just the clientdetection where this gets strange. i normally test is by using an a record on netscaler itself for the baseURL.

Hi Marion, You described exact the situation where I am into. The base URL DNS-name resolves a LB address on the old NetScaler pair. Yes, we use an ip-address for the session policy as well. In the new situation we've created two HA-pairs. One for the DMZ and one pair for the internal flow. The old environment was dedicated on one HA-pair. So we need to change the DNS name to the new LB VIP hosted on the same HA-pair as where the Gateway is hosted? Or can I tweak this in the NetSCaler? Is it only necessary for the NetScaler to resolve the Base URL? Is this only port 443 traffic? Many thanks!

only the base URL and if the url starts with port https port 443 should be sufficient. it does not matter if you change the dns (only on netscaler by adding the a record directly to the DNS Configuration) to the new IP address or simply allow the SNIP to connect to the old netscaler on port 443. The request should only go to the same storefront that were triggering the Client Detection. I have not had this for years and now it seems to happen every week to me 😄

sounds fair enough. I will give it a try. Keep you posted!

Cool, that's great 😄 I am happy that it worked!