XenApp iApp ICA Proxy not working (I think)

You need the APM module licensed and provisioned to perform ICA proxying functionality. If you don't have it licensed/provisioned, you won't see this question:

Use APM to securely proxy application (ICA) traffic and authenticate users into your Citrix environment?

That answer controls whether setup implements ICA proxy or not.

Thanks Michael,

I'm still not certain I understand. I thought the APM module was there to provide an access method that bypasses storefront, and tells the LTM to contact the XA xml broker directly.

I do see the option to "Use APM to securely proxy application traffic and authenticate users into your Citrix environment", so looks like we're licensed. But I'm not sure that's what I want. I wanted to configure the LTM to provide proxy access to Storefront for authentication and app presentation, then to proxy ICA traffic back through that same interface. Does that need the APM?

In fact, when I select "Use APM to securely..." then the "ICA Traffic" subsection of the form disappears. That is where I select "BIG-IP system acts as a gateway (router) to the ICA server network", configure to use port 2598 and select my ICA server subnet, which appeared to be where I was setting up the ICA gateway.

Did you by chance read the accompanying deployment guide? https://www.f5.com/pdf/deployment-guides/citrix-vdi-iapp-dg.pdf

It talks extensively about all the questions and options of the iApp. Look at page 27 where it talks about the context of the question regarding using BIG-IP as the gateway. Or are you saying that you want to have your XenApp servers use BIG-IP as default gateway AND act as ICA proxy?

Thanks Michael,

I've configured the iApp so that it's successfully proxying storefront to a different VLAN, applying a certificate, and authenticating logons. However, the ICA client is attempting to contact the ICA server directly, not via the F5 storefront Virtual Server. Can you explain what I need to change so that the clients can all use that same Virtual Server IP?

Did you answer Yes to the question about Using APM for Secure ICA Proxy? It's documented on page 8 of the guide. If you answered Yes to that question, then you should be working.