XenApp 5 Farm

Spammeh · 15 Jul 2011 at 10:49

In the process of setting up a new XenApp 5 farm to eventually migrate users away from our PS 4.6 farm.

I've currently got it set up as below

172.20.26.X - XenApp 5 Server
198.100.200.X - Web Interface server

The Xenapp 5 server is sitting on our domain in our normal range, and the web interface is sat in our DMZ. It is currently using http as opposed to https.

I have set a public IP forwarding to the web interface server, and that works fine. Can log in using domain credentials and all available apps / desktops show up fine. The problem I have is when I click on the applications from an external IP and it errors and fails to load the application.

I have tested this from internally (from an IP on the 172.20.26.X range) and it works without a problem. I go to the same web interface in the DMZ so I can't see why thats a problem.

I'm massively confused as to why this isn't working - so would appreciate any help!

Thanks

ubern00b · 15 Jul 2011 at 11:17

You should be using a secure gateway (access gateway) in a scenario like this, the WI doesn't need to be in the dmz and is insecure.

Anyway to answer your question how is your WI site configured? My guess is you have your secure access set to "direct" and not "translated" in which case it will not work externally as it has no path to your internal servers. Setting to "translated" NAT's your WI traffic.

Otherwise, since the WI is in the DMZ have you opened the correct ports for ica traffic? 1494/2598 as well as 80/443 for XML.

Spammeh · 15 Jul 2011 at 11:32

so the web interface should sit in the 172.20.26.X range and the secure gateway sits in the dmz. Then we open port 80 from the public IP to the CSG and then 1494 & 2598 from DMZ to 172.20.26.X range. Do I need to open port 80 from the DMZ to the 172 range as well, or will all communication from the CSG go over port 1494 & 2598?

ubern00b · 15 Jul 2011 at 12:10

You should open 80/443 from Public - DMZ and then from the DMZ to internal network you will want 80/8080/443/1494/2598 (when I say internal network, I mean only to your XA5 farm). If you are doing authentication at the Access Gateway you will also want 389 (LADP) open.