ISA 2006 Std & Citrix Secure Access Client Dropouts (Full Version)

All Forums >> [ISA 2006 General] >> General



Message

papitts -> ISA 2006 Std & Citrix Secure Access Client Dropouts (17.Jul.2008 9:29:16 AM)

Hi All,
 
I'm having a problem with an ISA 2006 Standard that is running as a web proxy with WebSense Enterprise doing the filtering. A number of clients are connecting to an external system using Citrix Secure Access Client, however they are experiencing frequent disconnects. If the client bypasses the ISA proxy these dont occur.
 
I'm new to ISA and I'm now stuck, any advise would be appreciated...
 
Thanks,
 
P



paulo.oliveira -> RE: ISA 2006 Std & Citrix Secure Access Client Dropouts (17.Jul.2008 9:53:24 AM)

Hi P,

I donīt know Citrix. But, monitor your clients access using ISA real-time monitor.

Regards,
Paulo Oliveira.



papitts -> RE: ISA 2006 Std & Citrix Secure Access Client Dropouts (17.Jul.2008 10:18:10 AM)

Hi Paulo,
 
Looking in the ISA 2006 sessions monitor it shows the clients sessions with activation of 9am this morning, I guess this means the ISA box doest think the sessions have disconnected? However the user definately experiences dropouts.
 
Thanks,
 
Paul



paulo.oliveira -> RE: ISA 2006 Std & Citrix Secure Access Client Dropouts (17.Jul.2008 10:50:25 AM)

Hi P,

sorry I was not clear. I meant you have to check the logs from the logging tab. There maybe can give you and idea of whatīs going on. See the column Result Code.

Regards,
Paulo Oliveira.



papitts -> RE: ISA 2006 Std & Citrix Secure Access Client Dropouts (17.Jul.2008 11:07:58 AM)

Hi Paulo,
 
From looking under monitoring > logging... I'm afraid that I can't see a Result Code column but I can see the following errors occurring for the client; (Just added the result code column).
 
Failed Connection Attempt 17/07/2008 15:48:06 - No Result Code for this...
Log type: Web Proxy (Forward)
Status: 1460 This operation returned because the timeout period expired. 
Rule: Web Access Only
Source: Internal (x.x.x.x)
Destination: External (62.190.95.136:443)
Request: www.office.grainman.co.uk:443
Filter information: Req ID: 06b1f787; Compression: client=No, server=No, compress rate=0% decompress rate=0%
Protocol: SSL-tunnel
User: anonymous
Denied Connection 17/07/2008 15:48:07
Log type: Firewall service
Status: 

Rule: 
Source: Internal (192.168.17.16:1609)
Destination: Local Host (192.168.250.23:8080)
Protocol: HTTP Proxy
User: 

Looking under the Rule: Web Access Only, I can't see any timeout configured?
 
Thanks,
 
Paul




tshinder -> RE: ISA 2006 Std & Citrix Secure Access Client Dropouts (18.Jul.2008 9:42:46 AM)

Try increasing the timeout value on the firewall for the ISA firewall Network from which the clients are connecting.

HTH,
Tom



papitts -> RE: ISA 2006 Std & Citrix Secure Access Client Dropouts (18.Jul.2008 3:51:14 PM)

Hi Tom,
 
Thanks for your reply, would you be able to direct me in the right direction for changing this and suggest a value to try?
 
Cheers,
 
Paul



tshinder -> RE: ISA 2006 Std & Citrix Secure Access Client Dropouts (19.Jul.2008 10:49:38 AM)

Hi Paul,

You can find this on the Web Proxy tab of the ISA Firewall Network from which the clients are conncting. Then click the Advanced button on that tab.

HTH,
Tom



papitts -> RE: ISA 2006 Std & Citrix Secure Access Client Dropouts (19.Jul.2008 4:52:31 PM)

Thanks Tom, this was currently set to 1800 seconds, I have adjusted this to 2700 seconds will see if this makes a difference to the clients when they are back in the office on Monday.
 
Cheers,
 
Paul



tshinder -> RE: ISA 2006 Std & Citrix Secure Access Client Dropouts (20.Jul.2008 10:30:44 AM)

Hi Paul,

Let us know how it works out for you.

Thanks!
Tom



papitts -> RE: ISA 2006 Std & Citrix Secure Access Client Dropouts (7.Aug.2008 5:27:02 AM)

Hi Tom,
 
It appears that increasing the timeout value hasnt improved matters with the Citrix Secure Access clients.
 
Any other ideas, suggestions would be appreciated.
 
Thanks,
 
Paul



tshinder -> RE: ISA 2006 Std & Citrix Secure Access Client Dropouts (8.Aug.2008 9:49:52 AM)

Hi Paul,

Perhaps the timeout is on their side?

A network monitor trace would help determine if that's the case.

HTH,
Tom



papitts -> RE: ISA 2006 Std & Citrix Secure Access Client Dropouts (11.Aug.2008 4:39:16 PM)

Hi Tom,
 
If I put the clients through an alternative simple proxy and change nothing else they are able to connect but dont experience the dropouts so indicating that the problem lies with ISA for some reason.
 
Thanks,
 
Paul



tshinder -> RE: ISA 2006 Std & Citrix Secure Access Client Dropouts (12.Aug.2008 9:18:51 AM)

Maybe try configuring the destination site for Direct Access then? In that way, you bypass the firewall's Web Proxy filter for that site.

HTH,
Tom



papitts -> RE: ISA 2006 Std & Citrix Secure Access Client Dropouts (12.Aug.2008 12:03:36 PM)

Thanks for the response Tom, would you be able to point me in the right direction to set that up?
 
Cheers,
 
Paul



tshinder -> RE: ISA 2006 Std & Citrix Secure Access Client Dropouts (13.Aug.2008 9:38:32 AM)

Hi Paul,

Give this a try:

http://isaserver.org/articles/2004directaccessp1.html

HTH,
Tom



Page: [1]