Accessing NetScaler through ASA5505 issue

[NICK SYMIAKAKIS]

Hi All, I am hoping someone can help me with this issue.

I have a Citrix NetScaler server on my network that I am trying to access via a public address on the outside of my Cisco ASA5505.

The ASA has two Public Addresses, the first is used for a couple VPN tunnels, which work fine. the second is going to be dedicated tot he Netscaler.

ASA5505 - IOS version 9.0 (1)

Public address: Y.Y.Y.142

NetScaler Server: X.X.X.6

This is what I have programmed in the ASA:

object service https
 service tcp source eq https destination eq https
object network NetScaler_External
 host Y.Y.Y.142
 description Netscaler External IP
object network NetScaler_Internal
 host X.X.X.6
 description Netscaler Inside Address

access-list outside_access_in remark Netscaler
access-list outside_access_in extended permit object https any object NetScaler_Internal

object network obj_any
 nat (inside,outside) dynamic interface
object network NetScaler_Internal
 nat (inside,outside) static NetScaler_External service tcp https https
access-group outside_access_in in interface outside

I am not sure what I am missing, but when I try to connect to the NetScaler from the outside, the log shows the connection attempt, then gives me a 30sec. disconnect because of missing SYN.

Any help would greatly be appreciated. I am stuck!

[Marvin Rhoads · Accepted solution]

Sorry but I'm a bit out of my depth when we get into the Secure Gateway flavor of the Netscaler.

The ASA appears fine for https but there may be some fine point about what the Netscaler Secure Gateway requires that I'm not aware of. Can you confirm there's no proxy server setup in your environment that might be blocking or interfering with the https communications?

You might try the community over at Citrix. I've has good results with them in the past.

http://discussions.citrix.com/forum/5-secure-gateway/ 

[NICK SYMIAKAKIS]

Thank you for all of your help in confirming the ASA is setup correctly.

Much Appreciated.

[jessieherrera]

Did you ever find your problem? We are having a weird issue similar to yours with a missing ack from the netscaler server.

We see syn,syn ack, then fin,ack.

We are having an missing ack.