https://worldofeuc.com logo
Join Slack
Powered by
This message was deleted.
# citrix-netscaler
s
This message was deleted.
j
the Citrix Delivery Services logs on the StoreFront server(s) should point you in the right direction on what exactly is failing when trying to get in from the Citrix Gateway
p
nothing there in the storefront logs
i just get the "cannot complete your request"
j
when you get a cannot complete your request you should see it there, single or multiple StoreFront servers?
p
pointed at a vip on the netscaler
2 behind that
one has iis turned off
nothing in the logs, its as if i'm not even hitting the netscaler
*storefront
netscaler kicks me right back to the login screen
d
There MUST be something in the eventlog. Are the SF servers able to access the NS vServer? Certificate, name resolution?
j
^
p
i'm not seeing a session policy be hit
d
p
hold up, there we go
storefront directly works fine
through the vip works fine
but not through nsg
d
p
and i'm getting kicked back to the NSG login page again
not the cannot complete your request loop that usually means that
j
p
no hits on those commands
i'm using plain jane ldaps auth
ICA proxy gateway vserver
m
What expressions do u have on the session policies?
p
add vpn sessionPolicy ReceiverWeb_sesspol "REQ.HTTP.HEADER User-Agent NOTCONTAINS CitrixReceiver" ReceiverWeb_sessprof add vpn sessionAction ReceiverWeb_sessprof -transparentInterception ON -defaultAuthorizationAction ALLOW -SSO ON -ssoCredential PRIMARY -icaProxy ON -wihome "https://STOREFRONTURLORIP/Citrix/StoreWeb/" -ntDomain DOMAIN -clientlessVpnMode ON
i copy/pasted from a functional vserver on a standalone gateway
deployed with the same AMI on amazon
netscaler can ping the storefront vip, it can ping the storefront servers itself
i'm not using smart access
i'm re-deploying the storefront servers because they didn't have an ability to talk to the gateway vserver elastic ip
this deployment method on amazon is screwy to say the least...
m
just because you say that there are no policy hits, try with True expression and check if you get a hit then.
p
i corrected after taqht
*that
it was just very delayed showing up in the log
ugh. of course the machine changed its password over the weekend so now i have to fix its trust...
m
already enabled debug log level on the NetScaler?
Maybe Advanced Policy makes a difference: HTTP.REQ.HEADER("User-Agent").CONTAINS("CitrixReceiver").NOT
p
i can't find how to bind advanced policies
the carlstalhood link i'm finding says to go to security->AAA, but i'm not licensed for AAA
Copy code
May 24 18:09:16 <local0.err> 10.0.1.152 05/24/2021:18:09:16 GMT  0-PPE-0 : default SSLVPN Message 13684 0 :  "wi_server is either down or is not vip/csw type {user: danielh, wihome URL: <https://SF_VIP/Citrix/STOREWeb/>, port: 443 wi_server_state: 1, wi_server si_cur_flags: 0x68000}" 
May 24 18:09:16 <local0.warn> 10.0.1.152 05/24/2021:18:09:16 GMT  0-PPE-0 : default SSLVPN Message 13685 0 :  "Ica mode status is not okay" 
May 24 18:09:16 <local0.info> 10.0.1.152 05/24/2021:18:09:16 GMT  0-PPE-0 : default SSLVPN Message 13686 0 :  "Cannot complete login for user: <danielh>sessionid <4b>, session state <15>, reason: <unknown>" 
May 24 18:09:16 <local0.debug> 10.0.1.152 05/24/2021:18:09:16 GMT  0-PPE-0 : default SSLVPN REMOVE_SESSION_DEBUG 13687 0 :  Sessionid 75 - User danielh - Client_ip 208.53.200.157 - Nat_ip "Mapped Ip" - Vserver_ip VSERVERIP - Errmsg "session removed due to internal error" 
May 24 18:09:16 <local0.debug> 10.0.1.152 05/24/2021:18:09:16 GMT  0-PPE-0 : default SSLVPN Message 13688 0 :  "sslvpn_delete SSID 4b, f, 0" 
May 24 18:09:16 <local0.debug> 10.0.1.152 05/24/2021:18:09:16 GMT  0-PPE-0 : default SSLVPN Message 13689 0 :  "SSID 4b remove session PE : 0, owner : 1, ref : 0, exp : 0" 
May 24 18:09:16 <local0.debug> 10.0.1.152 05/24/2021:18:09:16 GMT  0-PPE-0 : default SSLVPN Message 13690 0 :  "removing session 75" 
May 24 18:09:16 <local0.debug> 10.0.1.152 05/24/2021:18:09:16 GMT  0-PPE-0 : default SSLVPN Message 13691 0 :  "vpn log logout message for 75 10ms ticks 161de7" 
May 24 18:09:16 <local0.info> 10.0.1.152 05/24/2021:18:09:16 GMT  0-PPE-0 : default SSLVPN LOGOUT 13692 0 :  User danielh - Client_ip 208.53.200.157 - Nat_ip "Mapped Ip" - Vserver 10.0.2.11:443 - Start_time "05/24/2021:18:09:16 GMT" - End_time "05/24/2021:18:09:16 GMT" - Duration 00:00:00  - Http_resources_accessed 0 - NonHttp_services_accessed 0 - Total_TCP_connections 0 - Total_UDP_flows 0 - Total_policies_allowed 0 - Total_policies_denied 0 - Total_bytes_send 0 - Total_bytes_recv 0 - Total_compressedbytes_send 0 - Total_compressedbytes_recv 0 - Compression_ratio_send 0.00% - Compression_ratio_recv 0.00% - LogoutMethod "InternalError" - Group(s) "N/A"
3 Views
Open in Slack
PreviousNext
Powered by