Comments on: Self Service Plugin / StoreFront / Merchandising Server / Citrix Access Gateway (Part3)

By: Nickolas

Nickolas — Sun, 04 May 2014 12:02:58 +0000

Hello! This iss kind of off topic but I need some help from an established blog.
Is it hard to set up your own blog? I’m not very techincal but I
can figure things out pretty quick. I’m thinking about creating my own but I’m not sure where
to start. Do youu have any points or suggestions? Thanks

By: Paul

Paul — Tue, 31 Jul 2012 12:03:12 +0000

In reply to Sjoerd.

Sjoerd,

A million thanks, if I ever have the chance to meet you I will buy you a drink. I worked through what appears a very similar set of steps you, but I stumbled on this final hurdle. I had my hostname configured incorrectly on the VPX device.

Thanks to Jeroen as well, your guide invaluable in getting this going, the Citrix docs tend to focus on the AGEE.

Cheers,
Paul

By: Sjoerd

Sjoerd — Thu, 12 Jul 2012 06:20:14 +0000

In reply to Jeroen.

Thanks, Jeroen!
I got stuck in part 3 😉

By: Jeroen

Jeroen — Wed, 11 Jul 2012 20:12:34 +0000

In reply to Sjoerd.

Sjoerd,

Read my part 4 ;). There is explained how to make ios and android working 😉

https://www.jeroentielen.nl/self-service-plugin-storefront-merchandising-server-citrix-access-gateway-part4/

Jeroen.

By: Sjoerd

Sjoerd — Wed, 11 Jul 2012 20:07:29 +0000

As promised, an updated document of my current working scenario.

http://dl.dropbox.com/u/11320544/CAG%20and%20Storefront%20Setup%202.pdf

Now the next part, getting it working on an iPad.
The old CSG and WI5 are iPad proof, but this, by default, does not work on an iPad.
You guys have this working yet?

By: Jeroen

Jeroen — Tue, 10 Jul 2012 20:20:55 +0000

In reply to Sjoerd.

To be honest. I did see that in your documentation. But thought you edited that name to mask your FQDN.

But great that it worked. Cool.

Nice to see that the community is helping each other. At synergy we will drink some beers 🙂

By: Sjoerd

Sjoerd — Tue, 10 Jul 2012 20:12:36 +0000

EUREKA!
Finally got every piece of the puzzle complete.
Latest changes:
After getting this event error on the StoreFront server:

An error: FailedInvalidGateway was reported for store ‘Store’ when finding the matching gateway from the list: [Cloud CAG] for this request:
Remote Address: 192.168.0.239
X-Citrix-Via: cag
X-Citrix-Gateway:
X-Forwarded-For: 192.168.255.240
I was thinking that there is something misconfigured. And yes….
On the Networking tab of the CAG the hostname was not correctly filled. It contained ‘cag’, not the FQDN.
Second since both nics are on the DMZ network, I needed to check them both correctly. So eth0, internal, check and eth1, external, check.
O yeah, also: on the STA config I put the FQDN of the internal XenApp server, BUT the CAG could not resolve this….

I will update my documentation for reference later. Been working on this from this morning 10 AM….

Cheers!

By: Jeroen

Jeroen — Tue, 10 Jul 2012 19:11:39 +0000

In reply to Sjoerd.

Sjoerd,

I can make a blog post about it. It’s not difficult 😉

By: Sjoerd

Sjoerd — Tue, 10 Jul 2012 18:52:13 +0000

I have an official certificate on the CAG and SF server. Both from a different vendor. The CAG has a wildcard certificate and because I though that this was one of the issues I just bought a new cheap normal certificate for the internal SF server.
I can see that when I try to logon three events occur in the Citrix Delivery Service event log on the SF server.
The first is the one pointing me in the direction you guys also do:
“The gateway cag is untrusted”.
Why does the SF server say it is untrusted? IE on this machine has no issues opening the CAG portal.
Should I now go ahead installing a CA internally? Is this a complicated job? Never done this before….

By: Jeroen

Jeroen — Tue, 10 Jul 2012 17:34:58 +0000

In reply to virtuEs. But if you use an official certificate on the CAG then the SF server will normally accept the CAG certificate. For the certificate on the SF server, just create your own by a local CA.

By: virtuEs

virtuEs — Tue, 10 Jul 2012 16:52:56 +0000

It’s not just the SSL certificates for theCAG, keep in mind that for using the CAG, your Receiver for Web will authenticate credentials as well with the CAG. This is set up through the silent authentication and uses HTTPS. The certificate of the CAG must therefore be installed on the StoreFront server as well (in the local computer physical store).

At least that solved my issues.

By: Jeroen

Jeroen — Tue, 10 Jul 2012 16:19:38 +0000

In reply to Sjoerd.

Sjoerd,

What I did:

1. Install a certificate authority server in the LAN;
2. Request a certificate for the SF server on the local certificate server;
3. Now the local LAN users can access the SF server by HTTPS;
4. Import the root certificate from the ca into the CAG;
5. Now the CAG trusts certificates from the local CA and can access the SF by HTTPS.

Hope this gives you a kick in the right direction.

If this is the solution, I will update/extend my post 😉