NetScaler Gateway 10.5 Virtual Server

Last Modified: Nov 7, 2020 @ 6:21 am

68 Comments

Navigation

NetScaler Gateway Universal Licenses

For basic ICA Proxy connectivity to XenApp/XenDesktop, you don’t need to install any NetScaler Gateway Universal licenses on the NetScaler appliance. However, if you need SmartAccess features (e.g. EPA scans), or VPN, then you must install NetScaler Gateway Universal licenses. These licenses are included with the Platinum editions of XenApp/XenDesktop, Advanced or Enterprise Edition of XenMobile, and the Platinum version of NetScaler.

When you create a NetScaler Gateway Virtual Server, the ICA Only setting determines if you need NetScaler Gateway Universal licenses or not. If the Virtual Server is set to ICA Only then you don’t need licenses. But if ICA Only is set to false then you need a NetScaler Gateway Universal license for every user that connects to this NetScaler Gateway Virtual Server. Enabling ICA Only disables all non-ICA Proxy features, including: SmartAccess, SmartControl, and VPN.

If you don’t need any non-ICA Proxy features, then you don’t need any Gateway Universal licenses, and you can skip to the next section.

The Gateway Universal licenses are allocated to the case sensitive hostname of each appliance. If you have an HA pair, and if each node has a different hostname, allocate the Gateway Universal licenses to the first hostname, and then reallocate the same licenses to the other hostname.

To see the hostname, click the version info on the top right.

To change the hostname, click the gear icon on the top right.

To upload the allocated Gateway Universal licenses to the appliance, go to System > Licenses. A reboot is required.

After NetScaler Gateway Universal licenses are installed on the appliance, they won’t necessarily be available for usage until you make a configuration change as detailed below:

  1. On the left, expand System, and click Licenses.
  2. On the right, in the Maximum NetScaler Gateway Users Allowed field is the number of licensed users for NetScaler Gateway Virtual Servers that are not set to ICA Only.
  3. On the left, under NetScaler Gateway, click Global Settings.
  4. In the right column of the right pane, click Change authentication AAA settings.
  5. Change the Maximum Number of Users to your licensed limit. This field has a default value of 5, and administrators frequently forget to change it thus only allowing 5 users to connect.
  6. If desired, check the box for Enable Enhanced Authentication Feedback. Click OK.

    set aaa parameter -enableEnhancedAuthFeedback YES -maxAAAUsers 200
  7. Then edit the NetScaler Gateway Virtual Server. On the top-right is the Max Users. Change it to the number of licensed NetScaler Gateway users.
  8. In the Basic Settings section, click the pencil icon near the top right.
  9. Click More.
  10. In the Max Users field, either enter 0 (for unlimited/maximum) or enter a number that is equal or less than the number of licensed users. Click OK.

Create Gateway Virtual Server

  1. Create a certificate for the NetScaler Gateway Virtual Server. The certificate must match the name users will use to access the Gateway. For email discovery in Citrix Receiver, the certificate must have subject alternative names (SAN) for discoverReceiver.email.suffix (use your email suffix domain name). If you have multiple email domains then you’ll need a SAN for each one.

  2. On the left, right-click NetScaler Gateway and click Enable Feature.
  3. On the left, expand NetScaler Gateway and click Virtual Servers.
  4. On the right, click Add.
  5. Name it gateway.corp.com or similar.
  6. Enter a new VIP that will be exposed to the Internet.
  7. Click More.
  8. In the Max Users field enter 0.
  9. In the Max Login Attempts field, enter your desired number. Then enter a timeout in the Failed Login Timeout field.
  10. Check the box next to ICA Only, and click Continue. This option disables SmartAccess and VPN features but does not require any additional licenses.
  11. In the Certificates section, click where it says No Server Certificate.
  12. Click the arrow next to Click to select.
  13. Select a previously created certificate that matches the NetScaler Gateway DNS name, and click OK.
  14. Click Bind.
  15. Click OK.
  16. In the Authentication section, click the plus icon in the top right.
  17. Select LDAP, select Primary and click Continue.
  18. Click the arrow next to Click to select.
  19. Select a previously created LDAP policy and click OK.
  20. Click Bind.
  21. Or for two-factor authentication, you will need to bind two policies to Primary and two polices to Secondary:
    • Primary = LDAP for Browsers (User-Agent does not contain CitrixReceiver)
    • Primary = RADIUS for Receiver Self-Service (User-Agent contains CitrixReceiver)
    • Secondary = RADIUS for Browsers (User-Agent does not contain CitrixReceiver)
    • Secondary = LDAP for Receiver Self-Service (User-Agent contains CitrixReceiver)
  22. Click Continue.
  23. In the Policies section, click the plus icon near the top right.
  24. Select Session, select Request and click Continue.
  25. Click the arrow next to Click to select.
  26. Select one of the Receiver session policies and click OK.
  27. There’s no need to change the priority number. Click Bind.
  28. Repeat these steps to bind the second policy. In the Policies section, click the plus icon near the top right.
  29. Select Session, select Request and click Continue.
  30. Click Add Binding.
  31. Click the arrow next to Click to select.
  32. Select the other Receiver session policy and click OK.
  33. There’s no need to change the priority number. Click Bind.
  34. The two policies are mutually exclusive so there’s no need to adjust priority. Click Close.
  35. On the right, in the Advanced section, click Profiles.
  36. In the TCP Profile drop-down, select nstcp_default_XA_XD_profile. This improves NetScaler Gateway performance. Click OK.
  37. On the right, in the Advanced section, click Published Applications.
  38. Click where it says No STA Server.
  39. Add a Controller in the https://<Controller_FQDN> or http://<Controller_FQDN> format, depending on if SSL is enabled on the XenApp Controller or not. This must be FQDN or IP address; short names don’t work.
  40. For the Address Type, select IPV4. Click Bind.
  41. To bind another Secure Ticket Authority server, on the left, in the Published Applications section, click where it says 1 STA Server.
  42. Click Add Binding. Enter the URL for the second controller.
  43. The State is probably down. Click Close.
  44. In the Published Applications section, click STA Server.
  45. Now they should be up and there should be an Auth ID. Click OK.

    add vpn vserver gateway.corp.com SSL 10.2.2.200 443 -icaOnly ON -tcpProfileName nstcp_default_XA_XD_profile

bind vpn vserver gateway.corp.com -policy "Receiver Self-Service" -priority 100

bind vpn vserver gateway.corp.com -policy "Receiver for Web" -priority 110

bind vpn vserver gateway.corp.com -policy Corp-Gateway -priority 100

bind vpn vserver gateway.corp.com -staServer "http://xdc01.corp.local"
bind vpn vserver gateway.corp.com -staServer "http://xdc02.corp.local"
  46. Perform other normal SSL configuration including: disable SSLv3, bind a Modern Cipher Group, and enable Strict Transport Security. 
    bind ssl vserver MyvServer -certkeyName MyCert

set ssl vserver MyvServer -ssl3 DISABLED -tls11 ENABLED -tls12 ENABLED

unbind ssl vserver MyvServer -cipherName ALL

bind ssl vserver MyvServer -cipherName Modern

bind ssl vserver MyvServer -eccCurveName ALL

bind vpn vserver MyvServer -policy insert_STS_header -priority 100 -gotoPriorityExpression END -type RESPONSE
  47. Scroll down and click Done.

Verify SSL Settings

After you’ve created the Gateway Virtual Server, run the following tests:

  1. Citrix CTX200890 – Error: “1110” When Launching Desktop and “SSL Error” While Launching an Application Through NetScaler Gateway: You can use OpenSSL to verify the certificate. Run the command: openssl s_client -connect gateway.corp.com:443. Replace the FQDN with your FQDN. OpenSSL is installed on the NetScaler or you can download and install it on any machine.
  2. Go to https://www.ssllabs.com/ssltest/ and check the security settings of the website. Citrix Blogs – Scoring an A+ at SSLlabs.com with Citrix NetScaler – 2016 update

Gateway UI Theme

  1. Ensure NetScaler is able to resolve the FQDN of the StoreFront server. You can add an Address record to the NetScaler or ensure that NetScaler can resolve DNS. http://support.citrix.com/article/CTX135023

  2. On the left, under NetScaler Gateway, click Global Settings.
  3. In the right pane, in the left column, click Change Global Settings.
  4. Change the selection for UI Theme to Green Bubble, and click OK.

    set vpn parameter -UITHEME GREENBUBBLE
  5. If you want the NetScaler Gateway Logon Page to look like StoreFront 3.0 then see StoreFront Tweaks > Theme for NetScaler 10.5.

SSL Redirect

Use one of the following procedures to configure a redirect from http to https. Responder method is preferred.

Public DNS SRV Records

For email-based discovery, add a SRV record to each public email suffix DNS zone. Here are sample instructions for a Windows DNS server:

  1. On the Server Manager, click Tools > DNS Manager
  2. In the left pane of DNS Manager, select your DNS domain in the forward or reverse lookup zones. Right-click the domain and select Other New Records.
  3. In the Resource Record Type dialog box, select Service Location (SRV) and then click Create Record.
  4. In the New Resource Record dialog box, click in the Service box and enter the host value _citrixreceiver.
  5. Click in the Protocol box and enter the value _tcp.
  6. In the Port number box, enter 443.
  7. In the Host offering this service box, specify the fully qualified domain name (FQDN) for your NetScaler Gateway vServer in the form servername.domain (e.g. gateway.company.com)

Block Citrix VPN for iOS

Citrix CTX201129 Configuration for Controlled Access to Different VPN Plugin Through NetScaler Gateway for XenMobile Deployments: do one or both of the following:

  • Create an AppExpert > Responder > Policy with Action = DROP and Expression = HTTP.REQ.HEADER("User-Agent").CONTAINS("CitrixReceiver/NSGiOSplugin"). Either bind the Responder Policy Globally or bind it to the Gateway vServers.
  • In your Gateway Session Policies, on the Client Experience tab, do not set the Plugin type to Windows/Mac OS X. If any of them are set to Windows/MAC OS X, then VPN for iOS is allowed.

View ICA Sessions

To view active ICA sessions, click the NetScaler Gateway node on the left, and then click ICA Connections on the right.

show vpn icaconnection

Customize Logon Page

The logon page presented by NetScaler Gateway can be easily customized by modifying the .html, .css, .js, and .jpg files located under /netscaler/ns_gui/vpn.

After customizing the logon page, if you are licensed for Integrated Caching, then you’ll probably need to invalidate the loginstaticobjects Integrated Caching Content Group.

When you reboot the appliance, all customizations will be lost unless you automatically reapply the customizations after a reboot. There are two methods of doing this:

  • Place the modified files under /var and add cp commands to /nsconfig/rc.netscaler so the files are copied after a reboot.
  • Create a customtheme.tar.gz file and set the Gateway theme to Custom.

rc.netscaler Method

Let’s say you customized the en.xml and login.js files. To reapply those customizations after a reboot, copy the two modified files to /var. Then edit the file /nsconfig/rc.netscaler and add the following two commands:

cp /var/en.xml /netscaler/ns_gui/vpn/resources/en.xml
cp /var/login.js /netscaler/ns_gui/vpn/login.js

Custom Theme Method

From http://forums.citrix.com/thread.jspa?threadID=332888:

  1. Change setting to Green Bubble (if you want to use it), make customizations.
  2. SSH to the device, type shell.
  3. Create ns_gui_custom folder by typing: mkdir /var/ns_gui_custom
  4. Change directory to /netscaler by typing: cd /netscaler
  5. Archive the ns_gui folder: tar -cvzf /var/ns_gui_custom/customtheme.tar.gz ns_gui/*
  6. Change theme to ‘custom’. You can do this from NetScaler Gateway > Global Settings > Change Global Settings or from a Session Policy/profile. It’s located on the bottom of the Client Experience tab.
  7. Save the config.
  8. Reboot appliance to make sure the customizations are reapplied.
  9. Repeat this on the second appliance.

Note: if you enabled the Custom theme, since the customtheme.tar.gz file contains the admin GUI, you will have difficulty logging into the admin GUI whenever you upgrade the appliance firmware. You cannot use your customtheme.tar.gz file with newer firmware versions. When upgrading firmware, do the following:

  1. Change the theme to Default or Green Bubble and save the config.
  2. Upgrade the firmware.
  3. If the admin GUI is not working, change the theme to Default or Green Bubble again.
  4. Manually reapply your customizations.
  5. Re-create the customtheme.tar.gz file. Don’t use the file that was created on the previous firmware version.

Logon Page Labels

When two factor authentication is configured on NetScaler Gateway, the user is prompted for User name, Password 1, and Password 2.

The Password 1 and Password 2 field labels can be changed to something more descriptive, such as Active Directory or RSA:

To change the labels, edit a couple files:

  • Edit the file /netscaler/ns_gui/vpn/resources/en.xml. Search for “Password”. The Password2 field has a colon but the Password field does not.
  • Also edit the file /netscaler/ns_gui/vpn/login.js. Scroll down to the ns_showpwd_default() and ns_showpwd_greenbubble() functions. Find the line if ( pwc == 2 ) { document.write('&nbsp;1'); } and comment it out by adding two // to the beginning of the line. You will find this line in both functions. This prevents NetScaler Gateway from adding a “1” to “Password 1”.
  • Use one of the above procedures to reapply the customization after a reboot.

Domain Drop-down

Citrix CTX118657 How to Add Drop-down Menu with Domain Names on Logon Page for Access Gateway Enterprise Edition has instructions for creating a drop-down list with domain names. The Create the drop-down menu section has instructions for the Default Caxton theme, but not Green Bubbles. Here is a one way of making it work in the Green Bubbles theme:

<div class="field buttons"><div class="left"><label for="domain" class ="label plain"><span id="domain">Domain:<span></div>
<div class="right"><select name="domainvalue" size="1" style="width: 100px;"> <option value="DOMAIN1">DOMAIN1</option> <option value="DOMAIN2">DOMAIN2</option> </select></div></div>

Everything else in the article still pertains to the Green Bubbles theme.

Logon Security Message (Disclaimer)

/netscaler/ns_gui/vpn/resources/en.xml can be edited to display a logon message. Look for Please log on and replace it with your desired text. After changing the file, make sure you follow one of the above procedures to reapply the customization after a reboot.

http://euc.consulting/blog/customizing-citrix-access-gateway/ has additional instructions for creating a disclaimer. These instructions are for the default Caxton theme. Here is one method of adjusting them for the Green Bubble theme:

  1. Edit the file /netscaler/ns_gui/vpn/index.html.
  2. Find line 94 which has <input type="submit" id="Log_On"
  3. Inside the <input> element, add the attributes name="LogonButton" disabled="true"
  4. Immediately below that line, add the following lines. They go before the </form> tag. 
    <!– Disclaimer customization –>
<div class="field CredentialTypeusername">
<div class="left"><input type="checkbox" name="chk1_button" onClick="enableLogonButton(this);"/>
<span class="label plain">Check this box to accept the use policy </span></div>
<!– End of Disclaimer customization–>
  5. Save and close the index.html file.
  6. Edit the file /netscaler/ns_gui/vpn/login.js
  7. At the bottom of the file, add in the following function: 
    function enableLogonButton(obj)
{
    var loginForm = document.vpnForm;
    if(obj.checked){
        loginForm.elements["LogonButton"].disabled=false;
    }
    else{
        loginForm.elements["LogonButton"].disabled=true;
    }
}
  8. Save and close the login.js file.
  9. Use one of the above procedures to reapply these customizations after a reboot.
  10. When you connect to the logon page, you should see a checkbox. The Log On button will only be enabled if the checkbox is checked.

Other Customizations

If you want the NetScaler Gateway Logon Page to look like StoreFront 3.0 then see StoreFront Tweaks > Theme for NetScaler 10.5.

Jason Samuel – How to force users to use the Citrix Receiver app on mobile devices using NetScaler: You can tell your users to install Citrix Receiver on their mobile devices, yet they still continue to open Receiver for Web in a mobile browser to launch their apps and desktops because that’s what they do on their PCs at work. It’s tough to get them to understand there are 2 ways to access their apps while on a PC, using the Citrix Receiver OR Receiver for Web in their browser. But on a mobile device, they should use Citrix Receiver only for the best possible touch friendly experience.

First, we need to detect if a user is using a mobile device or not. Then we need to detect if they are hitting the NetScaler Gateway page using a mobile browser or the Citrix Receiver app. If they are using the app, let the traffic go through normal. But if using a mobile browser, redirect them to a notification page letting them know they need to use the Citrix Receiver app and make it easy for them to install and use it. Implementation instructions at the blog post.

Multiple Gateway Virtual Servers

Citrix Knowledgebase article – How to Create a Specific Customized Logon Page for Each VPN vServer Hosted on the Access Gateway Enterprise Edition and Redirect Users Based on Each Fully Qualified Domain Name

From Citrix Discussions: The KB article referenced above uses the NetScaler’s Responder feature.
If you are not licensed for the Responder (or just don’t want to bother with it), here is another option…

After creating a separate, customized login page for each vServer, I simply add a bit of JavaScript in index.html to call the correct login page, based on the URL of each vServer:

var currentURL = location.host.toLowerCase();
if (currentURL == “url1.domain.com”) top.location = “url1.html”;
else if (currentURL == “url2.domain.com”) top.location = “url2.html”;
…. etc…

Citrix Blog Post – Two factor authentication with specific customized NetScaler Gateway logon pages:

  • Cookie for second password field is not set properly for custom logon pages. Use rewrite policy to fix it.
  • Cache policy won’t allow two-factor cookie to work. Edit cache policy to not cache the custom logon pages.

Next step

Configure StoreFront to use NetScaler Gateway

68 thoughts on “NetScaler Gateway 10.5 Virtual Server”

    1. What do you see in StoreFront Server > Event Viewer > Applications and Services > Citrix Delivery Services? This usually means that StoreFront can’t communicate with the Delivery Controllers.

      Reply

  2. First, Thank you. My Teammates and I followed your guide to a T and was quite perfect. Issue that i’m facing or more so an annoyance. Running NS 12.0.58.18.nc – VXP1000 – delivering VPN to Mac and Windows users. Mac users (i’m one of them) are getting very frequent notifications that the session has been disconnected, followed by reconnected almost on top of the first notification. It does not appear to actually cause any harm but i’m not a normal user and know to pay no attention. My users will not respond the same way. I’m on Mojave 10.14.2 and am not sure if it’s specific to Mojave or not. I’ve heard some rumblings from other users that they’re receiving these same notifications but can’t speak as to if all are Mojave or not. I’ve searched up and down for a month and you’re my top hit each time however i’ve not seen anything that speaks of this nuisance specifically. Any assistance would be greatly appreciated and thank you in advance…

    Reply

  3. Hi Carl, Very informative page.

    I have a scenario where I’m using only one server and install DDC, Storefront, VDA and Studio. I’m using a Netscaler to connect to the Storefront url where Gateway IP is natted with External IP at firewall. Can I use the same Gateway IP to configure Loadbalancing VIP for Storefront on Netscaler.

    Kind Regards
    Sandeep

    Reply

  4. I have a VS with a public IP which is load balanced by a GTM with an IP at another DC.
    Issue: Every time the https request hits this data center, the browser shows Http/1.1 Service Unavailable. Even when i disable the virtual server, i am getting the same response.
    Any ideas what might be causing this?

    Reply

  5. Hello Carl
    I have to configure a VPN with always on feature and full tunneling.
    But, i must configure an access to a special intranet site wher users can change theres password.
    Is it possible to have a exception with full-tunneling ? (i do’nt whant to configure split-tunnel with 300 routes inside)
    Have you got a solution ?
    I have a solution, but it is not very clean :
    Create a local user that can only browse the URL of the special intranet site… but it is not a very clean solution, and i will prefer to use an exception for full tunneling.
    Regards.

    Reply

  6. Hello Carl,
    Is there any way so that I configure Netscaler Gateway to connect to my backend Web Application( say http://abc.co.org/index.html) so that users are not prompted to the storefront screen but directly access the web application logon screen (if possible with SSO using Gateway SSO feature) based on the mapping of the Gateway with the web application server which is hosting only one application.

    Reply

    1. You want the web app instead of StoreFront? Or do you want both? You can put the URL in the WI Address field, or you can put it in the Home Page field if you’re using Clientless VPN. You might have to add a Traffic Policy to perform the SSON.

      Reply

      1. Thanks for the reply! Are you seeing more folks starting to transition LDAP auth be handled on the SF instead of the NetScaler? I read this can be done with SF3.11/NS12.x. It didn’t say, but I’m assuming you can still 2factor at the NetScaler, just have SF pass back LDAP success and then it would process NS to RSA for example.

        Reply

  9. Hi Carl,
    I am trying to use 2 domains on a single Netscaler pair pointing to a single storefront deployment. Each record pointing to a separate Gateway VIP. The Base URL for Storefront Is this possible? I have seen some info on the web but have had trouble getting it configured.

    Example:
    External DNS
    NSGW1 – 10.10.10.10 – domian.com -Base URL for Storefront (Single URL internal and external)
    NSGW2 – 10.10.10.11 – web.domain.com

    I have tried with multiple stores and multiple gateways in Storefront but been unable to get this to work.

    Using a SAN Cert that has both records. Any thoughts would be greatly appreciated.

    Reply

    1. Are you saying that you’re trying to use multiple FQDNs to access one StoreFront server? If both session policies point to the same Base URL, then no problem. If you’re trying to use a non-Base URL to access StoreFront, then you need to edit C:\Inetpub\wwwroot\Citrix\Roaming\web.config and add the allowedAudience.

      Reply

      1. Yes, Multiple FQDNs pointing to the same storefront.

        The second (Non-Base URL) and pointing to the base URL (domain.com/Citrix/StoreWeb) in the session policies I get a a Storefront login screen. if I log in it give an error “Your session has expired”. Also the browser does not change to the base URL, it stays as web.domain.com.

        Reply

        1. Add the allowedAudience and it should work.

          Note: Receiver will show the Base URL configured in the StoreFront console and will ignore the URL used by Gateway.

          Reply

          1. I added it to the AallowedAudience but still get the same thing. Should the Session Policy still point to the Base URL or the second FQDN?

            Do I need another Netscaler gateway configured in Storefront pointing to the second FQDN? Any other configurations you can think of on the Second Gateway VIP or Storefront server?

            With the session profile pointing to domain.com I get logon has expired, with it configured to point to web.domain.com i get Http/1.1 Service Unavailable.

            Ill open a case and see if they can get me where I need to be without upgrading to 3.8 creating a separate base URL.

      2. Turns out I was running into an unknown bug. I really just needed a new Netscaler Gateway pointing to the new URL/NetScaler Gateway. Using the same session policies pointing to the Base URL. For some reason I couldn’t save the configuration in SF 3.7, once I upgraded to 3.8 I am able to authenticate and see my applications. For some reason I am getting “Application cannot start” but not sure thats related.. The other gateway works fine with the same NetScaler policies/STA’s so Im troubleshooting this now.

        Thanks for your support, amazing as always!

        Reply

  10. Carl, Your site i amazing, and has helped me get to the final step, pointing my thin clients to the netscaler correctly. I am using Dell T10, version 8.0_505. I have to use a wnos.ini correct?
    right now my wonos.ini is configued as

    signon=yes
    PnLiteServer=https:// CAGmethod=LDAP StoreFront=yes
    ConnectionBroker=default

    Any suggestions on where i messed this up? I continue to get a citrix logon failed message

    Reply

  12. Hi Carl,
    I have netscaler mpx 7500 pair, bridging pub and private VIPs.
    I have external VIP for web interface working fine.
    I’m trying to add a second vip and web interface, the problem is the WI always reverts back to the first virtual server, which is external so it doesn’t route.
    I have an internal only vpx, and this does the same thing. Is there something else I need to do on the 2nd web interface?
    thanks
    Zach
    and btw I use your site frequently and appreciate the good work!

    Reply

    1. Do you mean Web Interface is running on NetScaler instead of on Windows? I always avoid WIonNS if I can.

      Reply

      1. So if I setup WI load balancing, does it proxy the connection (like the WI on NS) or not? This is my problem, I need it to proxy this particular VIP for a customer VPN connection.

        Reply

        1. NetScaler proxies connections when load balancing, including Web Interface.

          I don’t quite understand what you’re trying to accomplish. What does “reverts back” mean? Are you talking about the Authentication Callback URL so Web Interface can verify the user was authenticated by NetScaler Gateway? If so, editing the HOSTS file on the WI server should help.

          Reply

          1. I have a web interface on NS, with a session profile on the first gateway VIP (test.domain.com) that points to published app > http://127.0.0.1:8080/Citrix/XenApp/.
            Then I setup another VIP that points to a 2nd WI on NS http://127.0.0.1:8080/Citrix/XenApp1/ and (test2.domain.com). After I save, the defined netscaler gateway virtual server on WI always reverts back to the first VIP.
            The VPN in question is only allowing one IP (NS gateway, or WI LB VIP). The WI LB VIP did not work, it allows login, but once app is launched, the communication with the Xenapp server fails.

          2. I have no recent experience with WIonNS. Whenever somebody calls me with an issue, I help them move it to a Windows server and there’s no more problems. StoreFront should be your goal, but StoreFront only runs on Windows, thus you’ll eventually need to move to Windows anyways.

            If you post to discussions.citrix.com, the one person that still uses WIonNS might be able to help you.

            I know WIonNS will create the session policies for you. I wonder if that’s interfering. But usually if you don’t mess with the WI Sites then the Gateway config shouldn’t change.

  13. Hi Carl, My netscaler appliance has some serious issues like Netscaler gateway VS goes down whenever we restart the load balancing virtual services on actual server. Have you ever faced this issue?

    Reply

  14. STA is pointing to XenApp 6.5 and Web Interface, extrernal connections works fine, when STAs changed to XenDesktop DDCs external connections not working but internal connections work fine. STAs verified as the same on Web Interface and Access Gatway but users getting error “Failed with status (1110)”.
    Any ideas

    Reply

      1. Thanks Carl, http for the STAs.
        STAs are configured identically on WI and AG
        SSL certs fully chained and verified
        access mode gateway direct
        appropriate SSL Cipher

        I’ll keep digging, appreciate your help.

        Reply

  15. Hi,
    What is the best way to change a Virtual server “name” to a different URL? I am assuming simply renaming is not enough.

    Reply

    1. You certainly rename a vServer. Or are you asking about DNS? DNS is usually external to NetScaler unless you’re using GSLB. If it’s SSL then you’ll need to change the certificate too.

      Reply

      1. Thanks Jim,
        bit more background:
        we have 1 (one) ssl wildcard cert for both old and new domain names
        external DNS has alias pointing to new URL
        users can use new URL despite vserver still using old domain name, it works
        users can still type old name and this is what we do not want: our options are (1) will renaming the current vserver just work or (2) we setup a redirect from old SSL URL to new SSL URL.
        Thanks

        Reply

        1. Renaming the vServer won’t change anything for the user.

          To redirect, create a Responder policy that redirects to the new DNS name. The policy expression would be HTTP.REQ.HOST.EQ(“olddns”) or something like that.

          Reply

  16. Hi Carl,

    I already have Netscaler configured and working with web interface and now I want to swap wi for Storefront 3,
    I’ll appreciate a brief setup note on how to go about this with less downtime.
    Thanks in advance.
    J

    Reply

    1. Same DNS name? Or Different DNS name? I almost always recommend a separate DNS name. Then you can setup in parallel and tell users (or reconfigure users) to use the new DNS name.

      If you cutover, you have to consider PNAgent clients and Receivers that have already activated with paths that are no longer valid in StoreFront.

      Reply

        1. If you have any PNAgent or Mobile Receivers then cutting over the existing DNS name will require much work to be performed all at once. All PNAgent clients have to be reconfigured to point to the new PNAgent URL on StoreFront. All Mobile Receivers need to remove Accounts and re-add.

          To change NetScaler Gateway, create new session policies based on my instructions. During the cutover, edit your Gateway vServer and swap out the session policies. Also make sure Account Services address is configured.

          For internal, just change your load balancer to point to the StoreFront servers instead of Web Interface servers.

          For users that have Favorites to WI paths, on NetScaler, create Responders to redirect users. For example, if the user is trying to go to https://FQDN/Citrix/XenApp, use a Responder to redirect the user to https://FQDN/Citrix/StoreWeb.

          Reply

  17. Thanks Carl,
    Great guide.
    We are changing our domain name and the external and internal access URLs to reflect new company name.

    Any ideas on the best way to accomplish this on the Access gateway and Storefront with minimal downtime and less distruption?
    I will be getting a new wildcard certificate for the new domain name.

    Regards,
    Jim

    Reply

    1. Minimum downtime means setup everything in parallel (new IPs) and then tell users to use the new name. Receivers already activated will probably need accounts removed and re-added.

      Reply

  18. Hello Carl!
    very useful blog!
    i have strange bug, or i made configuration mistake and cant find it =)
    i have xd 7.6 (2 xdc, 1 sf + netscaler ent), all work fine(tnx for blog), but…
    only new (users created some days ago) can connect thru netscaler.
    old users (on this time i cant understend why) can’t connect, in event log on storefront server i see (CitrixAGBasic single sign-on failed because the credentials failed verification with reason: Failed.

    The credentials supplied were;
    user: )
    i cant udnerstand why ? =)

    ssl cert for virtual server and storefront fine… for netwscaler CB i have special FDQN over hosts.

    Reply

    1. Are you doing userPrincipalName? If so, did you specify the correct UPN suffix for the new users?

      AD replication problems?

      Reply

    2. Are you only having problems with NetScaler Gateway auth? If so, do “cat /tmp/aaad.debug” to see what’s not working.

      Reply

    3. Do you have a Search Filter configured on your LDAP Policy/Server?

      Does your Bind account have Read access to the entire LDAP tree so it can find the users?

      Reply

      2. Tanks !! i fine my mistake !!!
        tnx for – debug auth metod over CLI!
        my mistake in – SSO name atribut – by default it

        in new users cn = sAMAccountName
        in old users cn != sAMAccountName =)))
        tnx!
        it’s more powerfull and usebl blog about citrix =)

        Reply

      3. hello carl =)
        on this time i add, cert authend on virtual server as mandatory.
        link internal root CA cert, link it to virtual server. add cert policy.
        when i log to web, ie see certs from my CA, and give from it UPN in user field, later i enter password … auth compleated. but wher NS connect to SF … i see cant compleate request. in event logs on SF i see errors like….

        —

        None of the AG callback services responded

        —–

        A CitrixAGBasic Login request has failed.
        Citrix.DeliveryServicesClients.Authentication.AG.AGAuthenticatorException, Citrix.DeliveryServicesClients.Authentication, Version=3.0.0.0, Culture=neutral, PublicKeyToken=null
        Authenticate encountered an exception.
        at Citrix.DeliveryServicesClients.Authentication.AG.AGAuthenticator.Authenticate(HttpRequestBase clientRequest, Boolean& passwordSupplied)
        at Citrix.Web.AuthControllers.Controllers.GatewayAuthController.Login()

        System.Net.WebException, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
        The remote server returned an error: (403) Forbidden.
        Url: https://127.0.0.1/Citrix/Authentication/CitrixAGBasic/Authenticate
        ExceptionStatus: ProtocolError
        ResponseStatus: Forbidden
        at System.Net.HttpWebRequest.GetResponse()
        at Citrix.DeliveryServicesClients.Utilities.HttpHelpers.ReceiveResponse(HttpWebRequest req)
        at Citrix.DeliveryServicesClients.Authentication.TokenIssuingClient.RequestToken(String url, RequestToken requestToken, String primaryToken, String languages, CookieContainer cookieContainer, IEnumerable`1 acceptedResponseTypes, IDictionary`2 additionalHeaders)
        at Citrix.DeliveryServicesClients.Authentication.AG.AGAuthenticator.Authenticate(HttpRequestBase clientRequest, Boolean& passwordSupplied)
        —-

        maybe you can help me, how i can separatly check cert authentication process?

        when i disable Cert Auth in Virtual server = mandatory, all work fine, no errors.

        tnx!

        Reply

        1. You’ll need a separate Gateway vServer that has cert auth disabled. Point your callback URL to the 2nd Gateway vServer.

          Reply

          2. feature or … my unknowledge
            when i connect to netscalert VS thru Web brouser, brouser request cert from windows certificate store, i select certificate and enter password.
            when i connect to whis VS over Receiver, receiver tells me – insert smart-card. how i can tell him use system certificate store ?.

          3. That’s a limitation of Receiver. If you need this feature, you’ll have to call Citrix Support and submit an enhancement request.

  19. Hi Carl. Thanks for this guide. But I have an issue. I tried http://support.citrix.com/article/CTX123736 and the “bit of JavaScript in index.html” solution for multiple gateway vservers. The redirect seems to work but the modified index_mod1.html just brings a blank white landing page. I just copied the original, changed name and set rights like the orignal to r-xr-xr-x. Do you know what I’m missing?

    Reply

    1. I missed to modify the /js/gateway_login_view.js as well. Inside is a switch-case assignment which point to index.html. I modified this to index_mod1.html and now it works.

      Reply

  20. Hi Carl,
    Your site help me already a lot, I’ve limited knowledge on Netscaler.
    I’ve configured our netscalers to forward their logs to our log server.
    I found the log from the internal one, but not from the external.

    And the same happens for the data that we find on the HDX insight.
    Internal log-on info is available, but not from the external one.
    Do we configure a dedicated IP on the external one, to collect this data?

    Thanks!

    Reply

    1. Both of those should be coming from the NSIP (Management IP). Is that allowed through the firewall? Do you have a route to Insight Center and Syslog through a router on the NSIP network? If I have a mgmt interface without a SNIP then I usually have to create routes for those destinations. Another option is to create a load balancer for SysLog and Insight Center and then loopback the traffic through the load balancers.

      Reply

  21. hi Carl,

    do you know if there is a way to change the Port assigned to a Vserver Accessgateway if you had typed for example the wrong one at the beginning ?

    thanks

    Reply

    1. You have to delete/recreate. Or you can directly edit ns.conf and reboot without again saving the config.

      Reply

  22. Carl,

    Great article as always. I am new to Netscaler and your articles have helped enormously. I have quick (dumb!) question regards section/point:

    Create Gateway Virtual Server

    6.Enter a new VIP that will be exposed to the Internet.

    Is this the internal network IP address or the IP address that user access via the internet which is then NAT’d over firewall to the internal network IP address

    Cheers
    Richard

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *