Implementing Citrix

Bradmin,

Our APM solution leverages Citrix ICA proxy technology, which is much more flexible and extensible than AppTunnels. The communication happens on port 443(SSL) - just like AppTunnels - except that you're not required to leverage any client-side components other than Citrix Receiver. If you are using the latest iApp, and APM is presenting the resources for you, clients should be attempting to establish an SSL connection to the same IP address as your APM webtop is on and tunnel ICA traffic. Is that not happening?

Last time we published it through the iApp, it looked like the web traffic was tunneled through but the ICA traffic was resolving to outside addresses.

I need to look into the Citrix ICA proxy. I'll keep everyone posted on what I find! =)

Make sure you use the latest iApp for Citrix from downloads.f5.com. You also must ensure that you set the iApp to proxy the traffic and replace the role of Citrix secure gateway. APM will properly patch the ICA file delivered to the client AND proxy the traffic without needing app tunnels or any other client side application other than Citrix Receiver. I believe the iApp shipped with TMOS is designed to work with secure gateways or other products.

We run several hundred clients this way for several different farms, and it has worked out great.

I looked at the iApp, and the whitepaper describing how the solution works, and then implemented it by hand myself. (I find it better to understand how it all hangs together because when it doesn't work, there's not a lot of logging happening to tell you WHY).

I also use direct to XMLBroker communications rather than utilising a web interface server. Although we have found a few funnies with the (Old & unsupported) version of Citrix in use at some sites

When you go direct to XMLBroker, the APM doesn't patch the .ica file. It actually generates one. Most of the smarts is actually done in javascript on the browser itself. The XML response that comes back from starting an app is passed BACK to APM from the browser, and the APM then generates and returns an ICA file. You can over-ride whatever you like in that generated ICA file.

One thing I have noticed is when a client is behind a proxy that the ProxyType=Auto seems to be ignored by the Citrix Reciever... Not sure why yet, but that's the only real issue I have at the moment.

Note that you really want to be at least 11.2.1HF6 as well. There's a few annoying bugs fixed around order of loading icons etc. I'm hoping for some optimisation in the realm of icon loading in the future too (Currently the javascript loads the icons one at a time rather than grabbing ALL the icons at once. That puts a lot of load on the XMLBrokers as being POST methods you can't really cache them).

Apart from that it's quite solid. I could wish for better logging, but at least you can raise your own events in the VPE and logs from there.

H

If the client is behind a proxy, then sometimes I've seen the need to add two lines to the Customer Parameters section of the Citrix resource definition on the APM so that these two parameters are sent as part of the ICA file:

ProxyUseFQDN=On

ProxyType=Auto

Also, good things come to those who wait - version 11.4 and above brings fantastic debugging capabilities to our VDI subsystem that includes Citrix. If you want to debug Citrix issues in version 11.4 or higher, just turn up debugging for VDI by running the following command from the BIG-IP CLI:

tmsh modify sys db log.vdi.level value debug

And you should seen plenty of relevant information in /var/log/apm log file. Don't forget to set it back to notice after the troubleshooting is done:

tmsh modify sys db log.vdi.level value notice

One option that makes the experience for Windows users much better (possibly Mac too, haven't tested) is adding the following to the custom parameters field of the remote desktop resource: ConnectionBar=1

This allows the Receiver client to go completely full screen, and provides the best experience for our users.

Hamish, I believe you are correct upon looking at things again.

Michael, thanks for those debug statements. I'm going to look into using those for our upgrade to 11.4.0 hf3.

Also, for anyone looking into setting this up or patching their systems, I strongly recommend checking with support before using 11.4.x series TMOS. We have run into some issues with VDI while trying to upgrade that has us stuck at 11.3.0 hf6. Maybe its just our configuration, but its better to be safe than sorry.

I looked at this again... And despite the .ica file having what looks to be the correct paramaters (All the docs I can find say it's correct), the Citrix PNA Agent (Version 10. Old I know, but some clients just like to run what they consider to be stable software) seems to blindly ignore the ProxyType=Auto parameter.

e.g.

  [WFClient]
  ProxyType=Auto
  ProxyUseFQDN=On
  RemoveICAFile=no

Setting a static proxy works fine BTW... It's only the proxyType=Auto we've seen issues with (But that requires a config specific to a site. Auto would be so much better).

It certainly looks like an agent issue though... Not an F5 one.

H