Citrix states in their article: CTX953526

CTX953526 - Troubleshooting Citrix ICA Connections through a SOCKS Proxy

This document was published at: http://support.citrix.com/kb/entry.jspa?externalID=CTX953526

Document ID: CTX953526, Created on: Aug 2, 2000, Updated: Apr 23, 2003

Products: Citrix MetaFrame 1.8 for Microsoft NT 4.0 Server Terminal Server Edition, Citrix MetaFrame 1.8 for Microsoft Windows 2000, Citrix WinFrame 1.8

The purpose of this document is to provide basic troubleshooting techniques when making Citrix Client connections with Microsoft Proxy 2.x. This application note was intended for WinFrame 1.x, MetaFrame 1.x on NT 4.0 Terminal Server Edition and Windows 2000 when using 779 build of the client. Future enhancements to either the Citrix client or the server may change the concepts contained in this document.

Problems connecting to a Citrix server through a Microsoft Proxy server include the following:

• Unable to enumerate either server farms, published applications, or server names

• Unable to connect to the server using an IP address

Several client connectivity issues through a SOCKS proxy are a result of the following:

1.Citrix client name resolution in which UDP browsing is required will not function properly using Microsoft Proxy 2.x. This is a limitation of Microsoft Proxy 2.x . It supports only the SOCKS 4 Standard. A SOCKS 5 server is required for UDP connections.

2.Incorrect configuration of the client connection. Follow the procedure below for configuring a connection through a SOCKS server:

For a 32 bit Program Neighborhood Connection

1. Add a custom connection.
2. In the Address field, select the Server radial button and enter the IP address of the MetaFrame server.

Note: This is the real address of the MetaFrame server. Proxies do not translate address. Think of proxy making two socketed connections. The first socket established by your client is to port 1080. The second socket is established from the proxy to the MetaFrame server on port 1494 using the address specified in the Server field.

3. On the next screen, check the box for Connect via SOCKS Proxy.
4. In the Field Address for Proxy to Use, place the address of the proxy server.

Keep in mind that this address must be available (routable) from the client. If a firewall sits between your client and the proxy serve,r the address would be the public address of the firewall. If the client is making an external connection, this address would be the internal interface of the proxy server.

5. Specify the port by which the SOCKS client should connect, port 1080 by default. You have to change this only if the SOCKS port was changed on the proxy server.
6. Continue the rest of the custom connection as normal.

For an ICA File Connection

Under the section headed [YourConnection], where YourConnection is the name of the application or server to which you are connecting, add the following lines:

ICASOCKSProtocolVersion=0
ICASOCKSProxyHost= "IP address of the proxy server"
ICASOCKSProxyPortNumber=1080

The ICASOCKSProxyHost parameter is the address of your SOCKS server and the ICASOCKSProxyPortNumber parameter is the port your SOCKS server uses for network traffic.

The Local Address Table (LAT) is not configured properly. The purpose of the LAT is to inform the proxy server what clients are permitted to make connections. The LAT can be constructed manually from the servers routing table.

The proxy server is not permitting SOCKS connections. To verify a configuration issue with the SOCKS proxy services, use a Web browser such as Internet Explorer and the SOCKS proxy settings. A successful connection through the SOCKS service can be verified with the current connections field within the properties of the SOCKS Service or by running Netstat from the command line on the client. An active connection is displayed over the proxy port (default 1080).

In Internet Explorer 5.x, the proxy settings are located at ToolsInternet options, click lan settings, check the box for Use Proxy Server, click the advanced button, in the SOCKS field enter the proxy servers IP address, and in the port field type 1080. (Remove all other proxy settings for testing). If Internet Explorer fails to make the connection through the proxy server, this is a proxy configuration issue.

Note: For proxy server configuration issues, see the Microsoft documentation. When the configuration issue is resolved and the Internet Explorer browser can make connection, the ICA Client will make connection as well.