Netscaler OTP problem with Windows Gateway App

[Patrik Holmberg]

I try to setup a OTP for Netscaler like Carl Stalhood

https://www.carlstalhood.com/netscaler-gateway-12-native-one-time-passwords-otp/

I use Netscaler 13 now. But i try the Carl site for the 13 version with nfactor but i get the same issue problem.

 

 

Everything is function but i not get the Gateway App to work.

If i try login from website then i can login and the Gateway app connect perfectly.

 

But when i try login direct in the Gateway app and type in the username and password and the second password

and click Connect. The app don't connect the VPN the app only show me my internal C:\ drive on my computer.

Like the attached picture.

 

So can i not use the app for the OTP and connect to the VPN or did i something wrong with the config?

 

Clould somebody help me with this issue.

 

 

[Daniel_axilaris]

Hi patricc, unfortunately I have the same problem and have been searching for days without success. I hope someone can help us here.

[Patrik Holmberg]

Hi.

Thanks for your info.

I thought it was just me who had the problem.

And hope someone can help us.

[Martin Meier]

If you follow the guide you will have two session profiles and policies. One to handle the WorkspaceApp and one to handle Browsers. I think you need an additional one for the VPN plugin.

 

 See: https://www.carlstalhood.com/citrix-gateway-ssl-vpn/

and: https://docs.citrix.com/en-us/citrix-gateway/current-release/vpn-user-config/configure-full-vpn-setup.html

[Daniel_axilaris]

 

Hello mmeier440 and thank you for your answer. However, I very much doubt this solution. I've already tried everything imaginable for several days.

 

This is not a problem with the session profile, but with the authentication. As soon as you use "normal" authentication (e.g. LDAP) on the client, everything works as it should. The error only occurs with the 2nd factor (OTP token).

 

I think it will be a bug in the Windows client. It is very unusual that this suddenly shows the C: partition of the computer instead of logging in. With this display, the entire interface is also shifted and you can actually only close the client completely. According to Netscaler Log, the auth is also successful, only the client reacts very strangely. The client logs aren't really helpful either, as they don't show any errors (at least none that I can see).

 

But the normal client should also work with nFactor Auth, as this is also listed in the support matrix -> https://docs.citrix.com/en-us/citrix-gateway/citrix-gateway-clients/gateway-clients-feature-parity.html

[Daniel_axilaris]

 

Yesterday I carried out tests again and found that everything works smoothly with the mac SSO app. So my guess remains a buggy Windows plugin that doesn't work at all with the current VPX version 71.44.

 

 

This is really very bad!

[Patrik Holmberg]

I think i find the problem. Some problem with the firmware 13.0.71.44 and i think 13.0.71.40.

I have also try the VPN AlwaysOn Service and have the same problem.

Then i saw this link

https://discussions.citrix.com/topic/412178-netscaler-plugin-vpn-issue/

 

Exactly the same problem. And same Firmware.

And no i have downgrade to version 13.0.67.43 and now i don't get the problem like explorer view in the Gateway App.

 

In the link

*edit - downgraded to 13.0 build 67.43 and everything is working fine

 

I think this was the problem. i wait for Citrix to fix

 

[Daniel_axilaris]

Last Friday I had support from a Citrix engineer, and he said it must be a bug in the client.
He asked me to configure the portal theme of the gateway vserver to the old X1 theme and now the client works.

So no downgrade necessary, just use the old theme for the time and wait for a quick hotfix from Citrix.
 

[Daniel_axilaris]

Or as I just saw, upgrade to the current version.

"The Citrix Gateway plug-in fails to establish full tunnel and displays content of the local drive after entering the credentials.

[ NSHELP-25899 ]"

 

https://docs.citrix.com/en-us/citrix-adc/downloads/release-notes-13-0-76-29.html

[Patrik Holmberg]

Thanks for your information.

I try to set X1 to one of my problems Netscaler with 13.0.71.44 and now it fuction perfect.

I can use this fix until the new firmware is out.

Thanks