Forum Discussion

Thijs_van_Ham's avatar
Thijs_van_Ham
Icon for Nimbostratus rankNimbostratus
Nov 15, 2016

iApp Citrix XenDesktop without APM (but with ICA proxy)

We have the following situation in our environment:

 

We are using XenDesktop which is currently being tested in a deployment via F5 including the APM configuration. However, for several reasons we decided that we prefer the 'normal' StoreFront pages above the F5 APM serves to end users. This includes localization, maintenance, customization/branding and most of all the APM licenses.

 

  • 2 virtual servers hosting both the broker service and StoreFront
  • XenDesktop 7.6
  • StoreFront 3.0
  • BigIP 11.5.3
  • iApp

So basically we want to configure the setup so we can take advantage of the ICA proxy but not use the APM module for authentication. Is that possible?

 

I found this thread: https://devcentral.f5.com/questions/f5-iapp-citrix-xenapp-and-xendesktop-with-apm-ica-proxy-no-direct-nat-38984, but when I configure the iApp including APM authentication and remove the 'access policy' afterwards it ends in nothing. The policy is now 'Start > Allow' but in the end no pool is configured for the virtual server. I also fail to see where and how the BigIP would be able to proxy the ICA traffic.

 

If I configure the iApp so we 'do not proxy ICA traffic and APM authentication' I have a new option at the bottom of the iApp where I can select the 'BigIP system to act as a gateway for ICA traffic'. If configured with these options I do receive the correct StoreFront login page but logging in fails. Citrix logs the following event: "A request was sent to service '[removed]' that was detected as passing through a gateway. However no gateways are configured for this service." So when I configure the XML virtual server as the delivery controller (set in the iApp) it presents the page with the error "Cannot Complete Your Request" without any further details. The logging is empty.

 

I hope anyone can help me out here because using the iApp including APM is not really our preferred method.

 

application delivery
BIG-IP
iApps

8 Replies

Sort By
  • Greg_Crosby_319's avatar
    Greg_Crosby_319
    Historic F5 Account
    Nov 15, 2016

    ICA proxy requires APM with AD authentication or certificate based authentication (smartcard).

     

    The option you mention, 'BigIP system to act as a gateway for ICA traffic', requires your application servers use client accessible addresses. Works fine for private internal routable addresses, not so great for public clients as you most likely would not want to use public addresses on your application servers but would rather mask the application servers using a proxy (requires ica proxy / APM).

     

  • Vladimir_Akhmarov's avatar
    Vladimir_Akhmarov
    Icon for Cirrus rankCirrus
    Feb 14, 2017

    Hi Thijs van Ham!

    I have faced the same issue after upgrading iApp from 2.3.0 to 2.4.0. On our StoreFront servers we have the same errors "A request was sent to service '[removed]' that was detected as passing through a gateway. However no gateways are configured for this service." After some research I have found that newer template contains additional HTTP header X-Citrix-Via that BIG-IP was sending to StoreFront servers with each client request with FQDN of the configured Virtual Server.

    To my opinion this header must be used for NetScaler and XenApp integration only, not for F5's. Because after you insert this header to StoreFront requests they are trying to find appropriate gateway settings inside XenApp configuration. And of course this configuration could contain Citrix devices only 🙂

    Cut from iApp template that need to be commented out:

    text`header-insert [expr { $replace_webtop ? "none" : "\"X-Citrix-Via:$::webui_pool__webui_dns_name\"" }] \

    PS. Editing template and reapplying it does not resolved my issue. I have to delete and recreate the whole XenApp application on BIG-IP

  • Thijs_van_Ham's avatar
    Thijs_van_Ham
    Icon for Nimbostratus rankNimbostratus
    Feb 15, 2017

    Hi Validimir, thank you for your research and sharing it. Although we did give up in the end and use the full APM functionality for Citrix XenApp access, I was wondering if you are actually doing what we were trying to accomplish. With the modified iApp you can use the native Storefront interface while proxying the ICA traffic through APM?

     

  • Vladimir_Akhmarov's avatar
    Vladimir_Akhmarov
    Icon for Cirrus rankCirrus
    Feb 15, 2017

    Hi Thijs van Ham

     

    Nope, we did not do the same We are using pure LTM config with SNAT (no APM and no ICA proxy)

     

  • Sajedf_147212's avatar
    Sajedf_147212
    Icon for Nimbostratus rankNimbostratus
    Mar 20, 2017

    This helped me out. I was able to update the http profile that the iapp created to remove Request Header Insert and Response Headers Allowed which inserted headers meant for a Netscaler which we don't use. Finally got Xendesktop working through the F5.

     

    thanks for the info Vladimir.

     

  • Snl's avatar
    Snl
    Icon for Cirrostratus rankCirrostratus
    May 14, 2018

    hi can you please share some steps , my problem is i am able to see the xenapp portal but none of the application is launching.

     

    any idea were is the issue

     

    cheers snl

     

  • boneyard's avatar
    boneyard
    Icon for MVP rankMVP
    May 20, 2018

    you probably want to start a new question with your full details snl, this question started on pretty specific scenario you are probably not applying.