https://worldofeuc.com logo
Join Slack
Powered by
we are troubleshooting a citrix DDC issue and remo...
# citrix-vad
a
we are troubleshooting a citrix DDC issue and removed it from the site successfully but now are trying to re-add Studio is showing this . if we try it says an unknown error occurred. any suggestions how to clean this up so i can try and re-add again?
c
There used to be an evict DDC power shell script that I used in past
a
Does it matter if I already used the remove option and it's gone from the DB and I'm just looking to try and readd? For example the remaining single controller in director only shows that one now
c
What's get-brokercontroller saying ? You def checked SQL and no references to old controller ? The evick methods I listed are if you tried to remove a DDC and it didn't remove correctly and there are left over entries in SQL. I typical used them methods if the remove controller option didn't work in studio . You def got the correct SQL perms to add the controller ( Give yourself temp sysadmin perms)?
a
our sql admin said he gave me dbowner permissions on the db so should be good there. all i've done so far is used remove controller and it looked to do its thing as far as i can tell w/out digging into sql (not my strong area). in studio on the other server i only show the one server and director the same. i had thoughts of doing a uninstall/reinstall of the controller software to see if it helps next
so my db admin tried and it fails too (tried automatic and manual w/ the scripts). we tried the evict script (thank you for that btw) and that fails immediately too with this: Failed to remove the Citrix Delegated Administration Service on controller [S-1-5-21-839522115-602162358-1801674531-36672] ** An error was encountered during execution of batch. Exiting. im thinking since we did a restore of the server it has the same name but different sid so its ticked off. at this point i'm wondering if we need to just spin up a new server to use for it
so we ended up just creating a new server and that added fine. now we're back to our original issue that we had where the STA server url for that server in the netscaler always shows as down for 443 (fine for http)
c
that could be a few things SNIP to DDC on port 443 not open , or you have not installed a cert on your DDC and bound it using netsh http add sslcert using the Appid of the broker service/ cert Hash
💯 1
a
so we did install a server cert and bound it to the default website in IIS for 443 i know
you dont happen to know if theres any documentation around for that ? also if we setup a service on the netscaler for ssl to that server it connects so that seems to work too, just not the STA server part w/ ctxsta.dll
we did do this too, is this what you were talking about? Enable TLS on Delivery Controllers | Citrix Virtual Apps and Desktops 7 2411
c
a
thanks for the article! so i mostly had that already and i think the binding we did via the article i just linked above because i get this error when following your guide
c
That looks like you already got one bound netsh http show ssl cert
a
yup so i compared and the certhash was not right so i cleard that and redid and it was successful. still showing down on the netscaler unfortunately though
if we bind http: (http://server:8080/scripts/ctxsta.dll ) it shows up but if we use https://servera/scripts/ctxsta.dll no go
c
create a LB Service called STA_Test on 443 pointing at the IP of your DDC with a tcp monitor and see if it stays up or is down
a
image.png
looks good
c
i dont normally append /scripts/ctxsta.dll try adding just the FQDN of your DDC eg https://DDC1.corp.com
you must use the FQDN with the SSL cert on the DDC
a
no dice
c
the SSL cert will be issued to ddc1.corp.com not ddc1 so fqdn is critical
a
thank you by the way!
c
try nstcpdump.sh host 10.0.0.x and port 443 or whatever port your using for your STA
make sure your DNS is working on the Netscaler as well and check you can resolve your DDC ddc1.corp.com
a
dns seems to be ok. i can telnet from the adc to the server using 443
c
Telnet uses the nsip rather than the snip
The nstcpdump or nstrace capture will show you if anything is being blocked
a
seems to be capturing traffic w/out any blocks from what i am seeing
well i'm not 100% as i'm not as familiar w/ that command....here is the output if it helps
citrix took a netscaler trace and i'm waiting to hear back but hoping i can figure it out , dont always have a ton of luck w/ support
c
I was just having a similar issue in my lab with a ssl cert on my DDC (cert renewal as lab not on for ages) basically I had to use netsh http show sslcert to list all the certs bound to ports. I then had to do netsh http delete ssl cert ipport=0.0.0.0:443 and 192.268.3.136:443 as ssl cert was bound on different ips. I then got the cert hash and appid and rebound it with netsh http add sslcert and it worked fine
Could maybe try deleting and re adding
a
thanks for the tip! so you deleted both the 0.0.0.0 and the 192 one and readded both? weird thing is our other DDC thats working only has 0.0.0.0 too
c
Yeah I had to bind it to 0.0.0.0:443 and IP of server on 443 for it to work
a
cool and you used the certhash and appid values for 0.0.0.0 and server IP i assume right? (and thats the citrix broker service app id)
c
Yeah 👍
a
thanks! i'll give it a whirl. odd thing still is the other server that does connect ok only has the 0.0.0.0 and the certhash is correct but the appid mapped there goes to system (not broker service) so that seemed weird
so we maybe stumbled on something here but not 100% yet.....one of our admins who manages a puppet server has been making changes to servers to disable older ciphers and i remember when he tried this on my DC servers in the past things broke. I dont have the specifics yet but it would appear that whatever newer ciphers that we approve dont pay nice w/ citrix
yup comparing whats enabled on the working server vs not (working left/broken right) i'm pretty sure this is our issue. now just to figure out how to make the cipher group on the netscaler work w/ those lesser cipher options
c
was gonna mention ssl hardening as when you look at your nstcpdump there is a Reset. You may have to play around with your backend SSL profile on the Netscaler and check which Protocols / Ciphers it is using
a
awesome thank you! this is the area right (where we can adjust which cipher groups to include ).....not sure why we call ours frontend
c
Front end SSL profiles are normally bound to SSL Vservers (Front end comms) and Backend SSL profiles bound to Service Groups (backend Comms)
Normally edited from here
a
so the front end one was tied to the virtual server and i found the backend in the profile area you mentioned but the ciphers show "default backend"
c
You can amend the Cipher group bound to the SSL profile but be careful as it would impact all backend traffic. Your better off duplicating the backend ssl profile and binding that to your service group and then adding custom ciphers to that ssl profile
a
thank you! i need to figure out which additional ciphers we need now
3 Views
Open in Slack
PreviousNext
Powered by