I try to launch a session via NS GW (Web Browser) internally. Sessions can be launched from Storefront. Session starts for a second and closes immediately with the following errors: ns.log gives the following error: Aug 14 110949 <local0.info> 10.101.103.56 08/14/20240909:49 GMT lb01 0-PPE-1 : default ICA Message 20213 0 : "[Remote ip = 172.28.249.52:61473] [TCP] [CGP] [ICAUUID=000e46e4-745d-16bc-9678-0050568b080e] ns_vpn_handle_cgp, STA ticket received = 43443A680EEFCCE3788FE4E4DFF557, from client pcb_fip = 172.28.249.52, pcb_fport = 61473 " Aug 14 110949 <local0.info> 10.101.103.56 08/14/20240909:49 GMT lb01 0-PPE-1 : default ICA Message 20214 0 : "[Remote ip = 172.28.249.52:61473] [TCP] [CGP] [ICAUUID=000e46e4-745d-16bc-9678-0050568b080e] Sending request to STA server for validating incoming ticket {sta-server=10.101.103.3:443}" Aug 14 110949 <local0.info> 10.101.103.56 08/14/20240909:49 GMT lb01 0-PPE-1 : default ICA Message 20215 0 : "[Remote ip = 172.28.249.52:61473] [TCP] [CGP] [ICAUUID=000e46e4-745d-16bc-9678-0050568b080e] Received response from STA server {sta-server=10.101.103.3:443,type=ResponseData}" Aug 14 110949 local0.err 10.101.103.56 08/14/20240909:49 GMT lb01 0-PPE-1 : default ICA Message 20216 0 : "[Remote ip = 172.28.249.52:61473][Username = anonymous] [TCP] [CGP] [ICAUUID=000e46e4-745d-16bc-9678-0050568b080e] STA ticket validation failed" STAs on NS are configured via IP and not via FQDN, Intermediate Certificate can't be linked as it has a key size of 8192. Can those two circumstances influence? We have only windows clients and the certificate chain is trusted on the client.

if the STAs show up green, you should be good, i would think. If you don't have your whole cert chain linked appropriately (root, int, server cert), i'd expect it to not work quite right. Wouldn't expect a a STA error message though for the intermediate not working though.

Are you using http or https for the STA configuration? You probably have matching STAs on GW and Storefront? Request ticket from two STAs option enabled in SF or not?

We're using https for the STA's, they turn on green only via IP and not via FQDN. The nameservers are not turning green as ICMP has been blocked by the firewall. I suspect it doesn't work RN as EnableVDASSL has been executed and the DNS Resolution is not working correctly yet.

(not likely relevant for your issue) I'd recommend configuring a non-addressable DNS LB vServer on the NetScaler, then using proper monitoring for it: https://docs.netscaler.com/en-us/citrix-adc/current-release/load-balancing/load-balancing-common-protocols/lb-dns-servers.html#to-config[…]g-the-gui

It was DNS. ICMP and DNS Resolve had to be allowed by the firewall. When allowing those two services, the status for the STA went up and I could connect to the VDA.