https://worldofeuc.com logo
Join Slack
Powered by
This message was deleted.
# citrix-netscaler
s
This message was deleted.
c
yeah when i have seen that error its mainly FW SNIP to VDA 1494/2598. if you got access to the netscaler run nstcpdump.sh host 1.2.3.4 and port 2598 when launching the desktop
1.2.3.4 being the ip of your vda and port 1494 or 2598 depending if your using session reliability or not
try disabling edt as well as a test
j
Thanks, John. Will give that a try this afternoon 🙂
l
If it is EDT chap I've seen scenarios where the MSS needs to be amended in the default.ica file. Its pretty easy to work out though.
c
yeh ive started to use the mtudiscovery reg key on the vda's with latest workspace apps works well and the connection/launch issues i seen previously with mtu sizes and fragmentation went away
j
Cool... I will check this too... firewall looks ok, there is a blanket rule covering 1494/2598 to all VDA's from the SNIP... I should add, there is a production vserver gateway thats working fine.. this is a new one using SAML... cheers
nstcpdump.sh confirmed a heap of connections on 2598 from the snip to VDA's
Working connections that is..
c
could well be EDT then i norm disable it via policy and filter to the DG and retry the launch
j
New error with EDT switched off... maybe my cert links are jacked..
m
client error 0 is certs a lot of the time
👍 1
c
u could check the site via sslshopper if its public facing as it will check the cert chaining. just make sure intermediate/root of ca who issues your gw cert is installed and you have linked your gw cert to intermediate and your intermediate to root on netscaler
👍 1
cli commands
j
Certs look ok... its using a wildcard, same one thats bound the the prod gateway vserver... I can see port 8008 in the ica file... I dont have html5 web access set.. time for wireshark I think...
Also 1912 with latest WPA so I dont think it would be affected by the MTU issue, 1912 has autodiscovery built in, cheers
c
can you try a direct connection to the vda using citrix quick launch or connect directly to storefront bypassing the netscaler? any ACL's on citrix FAS for the VDA's/storefront servers you got the FAS gpo applied ?
j
Yeah, FAS GPO applied across the board... the servers are hosting sessions now, the only thing different here is the new gateway vserver, cheers
c
did u see the traffic in both directions with the nstcpdump u see the syn syn ack ack and fin ?
j
Nothing for my attempt... but lots of traffic for other users...
c
mmm strange you should see something for your launch i would do a nstrace/ and filter by your source ip CONNECTION.SRCIP.EQ(1.2.3.4)
if its just a new NS GW VIP on an existing netscaler with a old NS GW vip and they can connect fine to the vda using the old GW vip its doubtful it would be firewall as you would be using the existing network config
j
Yeah... existing prod GW VIP working fine..
c
u got the STA's bound to your new NS GW vip they show as up ?
❤️ 1
j
I had 1 of 4 in for testing that was up... I guess I fat fingered it in a frenzy of testing on the previous hurdle! Now cooking with gas! Thanks John, Mike and Leee! Community POWER 🙂
👍 2
2 Views
Open in Slack
PreviousNext
Powered by