Unable to launch desktop from Netscaler Gateway if the vm is in different VLAN that Controllers, NSIP and Storefronts.

[Juan Luis Delgado Fernández]

Hi team!

I have a very stranger case. This is my platform:

 

XD 7.15 LTSR CU4

Netscaler Gateway 12.1

2 machine Catalogs:

- 1 machine Catalog with name "IT" has vms in the same network than Controllers, NSIP and Storefront -> VLAN 1

- 1 machine Catalog with name "Direccion GTO"  has vms in other network with different VLAN- > VLAN 41

- Both Catalogs are created from the same gold template.

 

From inside, all works fine.

 

From outside, I can launch a desktop from catalog "IT" but not from "Direccion GTO". When I try to launch it, this message appear:

 

 

Sorry for the spanish message, but it's very similiar to this CTX message:

 

https://support.citrix.com/article/CTX233143

 

 

 

I have check the ports 1494/2598 TCP/UDP and I have configure in the firewall ALL:ALL between VLAN 1 - VLAN 41

 

What can it be wrong?

 

Thanks in advanced.

 

 

[ArnaudP1]

Hello JuanLuis,

 

could you check within the ICA file that you have the STA for “Direccion  GTO” and not the private IP from outside connection?

 

Thanks

Arnaud

[Juan Luis Delgado Fernández]

Thanks for your reply Arnaud but the STA is ok, there isn't private IP:

 

Direccion GTO $S7-12]
Address=;10;STA318685325;1DA47802B39E322FE753C43404368D

 

I have compared with IT .ica file and it's ok:

 

[IT $S8-17]
Address=;10;STA318685325;1DAD56AE5C60C0C4BC84D3F356BF90

 

Both .ica files are similar

 

 

[ArnaudP1]

1 hour ago, Juan Luis Delgado Fernández said:

Thanks for your reply Arnaud but the STA is ok, there isn't private IP:

 

Direccion GTO $S7-12]
Address=;10;STA318685325;1DA47802B39E322FE753C43404368D

 

I have compared with IT .ica file and it's ok:

 

[IT $S8-17]
Address=;10;STA318685325;1DAD56AE5C60C0C4BC84D3F356BF90

 

Both .ica files are similar

 

 

JuanLuis,

 

Is the Windows Firewall (Defender) enabled?

If so could you try to "temporary" to disable it and test?

 

Thanks

Arnaud

[Diego Oliveira]

Hi

The Netscaler (SNIP) needs to communicate with the VMS in VLAN41.
You can create another NSIP in the vlan 41 and you try again.

Or,   you must check your firewall the following ports:

 

[Juan Luis Delgado Fernández]

At the end, I have created a new SIP in VLAN_41 and with that works fine. I think that the firewall o network routing was not working properly.

 

Thank you so much for your support.