Citrix Extranet and ICA clients

I am glad that we have a Citrix expert attending the forum

I am using the Citrix Extranet 2.5 client (aka SmartPass v?.?) for accessing our corporate network with Jornada 720. We are using the same client version for our PC access; they say that the most reicent version was tested but there was no need for an upgrade. Everything here works just fine (at least I have no reason not to believe that) - I've described it in another thread:

http://www.hpcfactor.com/forums/forums/thread-view.asp?tid=252&start=1

I did not configure it by myself but received a token generated by the guy who is responible for citrix applications.

Next step is accessing my corporate applications - I am using ICA 6.30.1061 version. I have also tested version 7 or 8 but it is Web based and the settings were veeeeerrrrryyyy slowwwwww. I did not like it. If I remember correctly, I could have used some ICA files with most reicen client version but with version 6 I configured it manually. So far, so good.

When using my home Wi-Fi connection everything works just fine. But with GPRS the situation is different. VPN connection seems to set up correctly but ICA reports a problem: "Proxy connection failed: Improper or unexpected response from proxy server". All the settings are the same, of course!

Unfortunately I cannot trace the connection - see the thread below:

http://www.hpcfactor.com/forums/forums/thread-view.asp?tid=526&posts=1

On the other hand, the connection from my PC via GPRS (using the same GSM phone) works. Extranet client (v2.5) uses exactly the same token. I have no tool to find more information about what is going on with one or the other client.

Our Citrix guy has no experience with Win CE and PDAs. He was only helping me with some general advice, showing me different profiles so I was able to guess why Jornada needs to route everything through proxy at 127.0.0.1...

I still need to ask him some questions about how the token was generated. I suspect that somewhere an address of a Wins or whatever server is missing but have no tool to check it.

Any ideas?

OK, So you use a VPN connection to the company's network, and then you access the Citrix Server.

Using a VPN connection usualy you also have access to your network shares as if you were in the office. Is there any way you can get that to work. That way you can see if you actually have your VPN setup.
If you have your vpn connected, you should also be able to ping any other server on your office network.

As far as I know, the routing through 127.0.0.1 (the localhost, and in this case the pda, is used for the Citrix ProgramNeighbourhood Agent. It runs a webserver that when setup will provide the application shortcuts in your pda's startmenu/desktop.

From above information, I am guessing that your vpn isnt working over the GPRS connection.

-----------------------

What Citrix Server version is being used?
MetaFrame 1.8/ MetaframeXP (if so, what Feature Release)

What OS is below it?
Windows NT4 Terminal Server Edition, Windows 2000/2003?

-----------------------

(I am a Citrix Admin, but in no way an expert). Also, the word PDA usualy scares off a lot of admins, because they dont have a clue. However, using a PDA or anything else shouldnt be too much different then when running from a desktop.
As long as there is a network connection established that will provide access to the server, the client should be able to connect.

-----------------------

The ICA Client on your device, have you setup Program Neighbourhood?
It might be that you have to add the server in there again for the GPRS connection as well.
If MetaFrame 1.8 is used, the citrix server will broadcast information to running Pocgram Neighbourhood clients, (or if this is enabled, it will also work for MetaFrameXP). This will put shortcuts to published applications directly into your device, but again, the connection needs to be working for that to happen.


This should get you started I guess.

Well, I am quite sure that VPN connection is established (because the log is normal and the icons look as the should) but there might be another issue.

When connecting with a PC sometimes ICA session fails because Extranet client somehow decides to connect through a SSL or a Web proxy or both. You have to manually set the client not to connect through a proxy, refresh the permission and after that it works.

Windows CE client does not allow me to set or check the status of these proxy connections. If somehow the Extranet client decides to work through a SSL proxy everything (what on our PCs happens quite often) would look just fine but nothing would come through. Is this the matter of the token?

Strange thing is that with Wi-Fi connection everything is OK. And a PC with GPRS works also fine (except that random decisions to go through a SSL or Web proxy...)

I am not sure which MetaFrame version is used. I'll ask tomorrow. I am quite sure that I needed to enter all of the servers in my Citrix Neigbourhood settings - even some more than when I was setting up the PC access.

I cannot ping any servers, I assume that they are administered not to respond. We only have access to couple of published applications, not to the whole network.

Is there a way how to trace the behavior on the MetaFrame? What should be traced? Is there a particular question I should ask our Citrix administrator?

We are using MetaFrame v 1.0. I have also asked a question about the content of the token. It is just information about the access, nothing about environment. I cannot ping the servers because they don't respond to it - prohibited.

Is there a way how to find out if VPN is correctly established? Our guy indicated me a web page which was set for downloads and should be part of VPN but it is not. I can access it from internet. Is there a way to do a trace on the server (Extranet)? Our people are not aware of such way.

Any ideas?

on a PC where it works on try to connect to the servers. if that works, check your IP that your computer has received. ither using vpn or not, but it's important to get information from a working connection.

Then try the same on your handheld, and again, check and see what your IP is on the device.
These should be pretty close to eachother.

On the working machine, try and see if you can ping the citrix server.

Then we go from there.

I can probably ask our citrix administrator to temporary open me one of the servers for pinging. Well, there's one more thing that I have just checked. The page I have mentioned in my previous e-mail, which is accessed through port 443, has a "Register" button at the bottom. We are not using this way for access permissions - it is there for testing the connection. This is probably what our guy had in mind.

This page can only be accessed if VPN is established. Otherwise there is an error message. This is what I see in my IE URL window when I am on that page (regardless of Wi-Fi or GPRS):

http://127.0.0.1:4090/sgred

It goes through proxy so I am quite sure that VPN is OK. Well, I'll ask for opening one of the servers for pinging to confirm my assumption.

There is one more observation. The GPRS connection is verry slow and it takes much more time for the VPN icon becomes normal. It can be a matter of timeouts. OK, let us first check the basic connectivity.

127.0.0.1 is directlyu on your device. if it shows a page, that means the software is running, and you have some sort of TCPIP setup.

Yes, 127.0.0.1 is the localhost's IP address and, on the other hand, it is proxy address which is used by the VPN client. It just means that the page I was accessing is hidden behind the proxy. I can assure you that there is no such locally saved web page

I was very busy today, so I did not have time to ask our IT staf for some assistance.

Well, long time passed since my last post in this thread. Couple of minutes ago I solved the problem. The only problem was, that GPRS connection is slower than my Wi-Fi. If I used version 8 of the ICA client I probably could have solved it through the menus - setting BrowserTimeOut to e.g. higher value. Client version 6.30 stores all the user information in registry. Below is described the solution.

Add another String Value (type: REG_SZ) to the key:

\HKEY_CURRENT_USER\Software\Citrix\ICAShell\UISettings\Client\<the name of your connection>

String Value: BrowserTimeOut
setting: 10000 (I assume it stands for 10 seconds).

And it works fine with GPRS connection over IrDA or Bluetooth