are you talking about 1 Metaframe XP server or a Metaframe XP server farm? That can make a big difference!
Assuming there is only 1 Metaframe XP server, you should publish two protocols. First the NFuse server which is a regular web server and uses HTTP or HTTPS. You can use for that a web publishing rule.
Next, you must publish the ICA port of the Metaframe XP server for the real ICA session. To do that you must first create a protocol definition for the ICA protocol inbound (TCP port 1494 inbound). Then you create a server publishing rule and use the above protocol definition as mapped server protocol.
no, that should be all what must be done on ISA. You can test the ICA connection from the outside by using the command 'telnet <ISA external interface IP> 1494'. If the ICA server publishing rule is working, the connection should succeed and you should get a response like ICA...ICA...ICA.
However, because the Metaframe server sits behind ISA and the ISA is doing NAT, you must do some special configuration on NFuse or the Citrix server. I don't remember it from the top of my head, but it is something with an alternate address command on Metaframe or an alternate address configuration setting in the ICA template file on NFuse. There you should specify the ISA external IP address used in the ICA server publishing rule. Your Citrix administrator should know this by heart!
Hi, Yes this is a working server on our network, and it runs XP & Nfuse internally fine.
The xml service is currently installed on port 80 along with the IIS service.
Although accessing nfuse from the external client works so far as seeing the applications , so I presume it's not a webpage problem. It's when executing the applications from the client that causes the "Cannot connect to the Citrix Server" error.
Is it authenication problem, or am I missing a publishing step somewhere?
Do I have to change the template.ica file on the server at all ?
I have yet no first hand experience with configuring NFuse, CSG and Metaframe XP myself, but I do know how this things should work!
When going through NFuse, the user must first login to NFuse. On succesfull login, NFuse will give the user a page with application icons to which he is allowed access. Now, when the user clicks an application icon, NFuse will construct a file '.ica' and send it to the browser. On the workstation the ica extension is linked to the ica client application. So, the ica client will startup and use the downloaded file '.ica' as parameter file.
Now, it must be clear that the connection parameters in this ica file must point to the ISA external IP or FQDN where you have server published the Metaframe XP server on. Because the Metaframe XP server publishing seems to work already, I suggest you *save* the ica file on the workstation and check out what are the connection parameters sent.
For more info how to configure NFuse and Metaframe XP in a NATted environment, consult the Citrix administrator guides. As far as I remember this topic is very well explained in there.
I thought I had this one tied up. In the end I modified the template.ica file on the Citrix server from the citrix knowledge base link..CTX584485.
5. The last step is to modify the Template.ica file in the NFuse Web site. Be sure to edit the correct Template.ica file (by default, there is one for each NFuse Web site). Open this file in a text editor and locate this line:
Modify this line so that it reads:
NFuse will now work properly in a NAT environment. ------------------------------------------
I thought my god it works. I was over joyed to say the least. Then some kind soul pointed out from the internal network, the following error appeared when connecting to and application.
"Cannot connect to the Citrix server:
There is no route to the specfied subnet Address"
Grrrr, so now I can only get external people connecting and not internal.
I realise this is turning into a Citrix problem, and forgive me for posting this again on here. If anyone knows why it's doing this I would be very grateful.
yep, it is definitely a Citrix configuration problem!
In my previous post I explained how NFuse passes the connection parameters to the ICA client. Now, if internal users are trying to access Metaframe through NFuse, they will also get as connection parameters the alternate address. The problem is now that an internal client can't loop through ISA. So you have to modify the NFuse configuration.
I'm sure it is possible but if I remember well, the type of solution depends on the version of NFuse, and maybe you need the Columbia extensions for older NFuse versions. I vaguely remember you could specify an IP address range for which the alternate address should not be used. That IP address range should be your ISA LAT.
BTW --- for more info, read the Citrix administrator guides, search the Citrix web and/or consult specific Citrix forums.