Error after change to https access only 1

[zacca]

Hi there,

I would like to open citrix access via public internet, but got some problem, would like your help.
Info:
-w2k3 server + iis6 + citrix xp fr3
-iis6 only allow https traffic
-client will only use webclient to access citrix
-firewall opened 443 & 1394 for public access

After user hit url

https://xxx

& type the info of username/pwd/domain, at "metaframe xp message center" it said "ERROR: The Citrix MetaFrame servers cannot process your request at this time. The Citrix MetaFrame servers sent HTTP headers indicating that an error occured. 401 Unauthorized"

The same error also happened even hit the citrix server via internal lan.

If I enable http access to IIS & hit the citrix server via

https://xxx,

didn't have such problem.

Wondering if this is an IIS issue or Citrix issue? Any suggestion to fix it? What I want to achieve:
-only allow https access to IIS
-user can web-access citrix via public internet

Thanks so much for the help!

 

[CitrixEngineer]

Are you using Secure Gateway (free!)?

 

[zacca]

no, i'm not using secure gateway, just want to simply enable & default to ssl on the iis, so citrix web access also be ssl, many thx!

 

[scanjam]

i thought you needed port 1494 open in the first instance? However i tried a similar setup (without secure gateway) and it continually failed due to NATTing problems.

Essentially the client ICA file that is sent to the "client machine" contains the ip address of the internal server network (192.168.x.x) and not the external web address...

You might be able to try altaddr X.X.X.X (and enter the external

http://www adddress

of the citrix server??)

See it that helps?

 

[zacca]

hi scanjam,

already set the altaddr x.x.x.x & opened oprt 1494

that error msg only happened when i force iis to accept https request only, if i set iis to accept http/https request, i didn't have that error message

 

[CitrixEngineer]

To use https with Web Interface, you need an SSL proxy, like Secure Gateway.

At least, that's what I've been told ;-)

 

[gtstangman35]

I use the setup you described and it works great! The only thing you cannot do is FORCE SSL on the box. What I did to get around this was to just redirect through IIS, all clients from the NFUSE.htm page to go to the page

https://something.anything.com/Citrix/MetaFrameXP

and this works everytime. But you must only redirect Nfuse.htm and not the whole directory for it will not work. Been using this setup for a year and no problems. The NAT thing was a little tough at first but we use NAT no problem now. Hope that helps.

-Wes