Last night I had an opportunity to be reminded of how powerful and dangerous our BlueCoat ProxySG is to wield. \u00a0Yesterday when I got home I tried to connect to my workstation via Citrix when I was greeted with an error: \u00a0“Your App is not available. \u00a0Try again later.” \u00a0Strange, it had been so solid for many months. \u00a0I was technically off the clock (as I am hourly) and after I used VPN to connect in I saw other sessions were still active, so I chalked it up to “I’ll fix that tomorrow.” As the evening progressed, it nagged me a bit so I tried a few more connections before deciding it would be best if the users weren’t up in arms in the morning in case they had trouble connecting as well, so I got to work.<\/p>\n
The first placed I look was web interface – both servers – to see if there was an error logged. \u00a0To my surprise, there was nothing recent in web interface. \u00a0The event logs on the XenApp servers themselves were also equally clean, and the vserver on netscaler was up with both STA’s functioning. \u00a0What could be wrong? One thing I did not consider was my own client – it had operated without error for months. \u00a0So at this point I began cycling various components of the infrastructure. \u00a0The vserver, ZDC, app servers all got restarts but still, nothing. \u00a0At that point I tried connecting through AGEE, internally, through the same site (bypassing the firewall). \u00a0To my surprise, it worked! \u00a0So what was different about it?<\/p>\n
It was then that a co-worker messaged me and asked what was up with remote access. \u00a0He mentioned that the remote website was presenting a certificate from our proxy (as is normal if SSL interception was happening). \u00a0I verified that this was indeed the case. \u00a0So what had happened?<\/p>\n
Our ProxySG is setup to SSL intercept based on the category classification of the destination. \u00a0Interception is used for a number of reasons – authentication, monitoring, and content filtering. \u00a0I asked the tech if he had added any categories to our list of categories for interception late in the day after I had left work. \u00a0The category, “Education” matched our own<\/i>\u00a0organization and the problem was clear. \u00a0Our Proxy sits in-line with our firewall transparently, so the traffic to and from AGEE was being intercepted and the certificate was replaced. \u00a0Citrix receiver aborted the connection because the session wasn’t valid. \u00a0I added an access rule that bypasses interception for our domain, refreshed the page and verified the certificate was once again the public cert. \u00a0Success! My workstation hadn’t presented me with a certificate error because it was issued from a trusted root CA as a result of being on our domain.<\/p>\n
This situation goes to show that if you’re having trouble connecting through Access Gateway, be certain to verify your certificate!<\/p>\n","protected":false},"excerpt":{"rendered":"
Last night I had an opportunity to be reminded of how powerful and dangerous our BlueCoat ProxySG is to wield. \u00a0Yesterday when I got home I tried to connect to my workstation via Citrix when I was greeted with an error: \u00a0“Your App is not available. \u00a0Try again later.” \u00a0Strange, it had been so solid […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[55,75],"tags":[],"_links":{"self":[{"href":"https:\/\/avtempwp.azurewebsites.net\/wp-json\/wp\/v2\/posts\/241"}],"collection":[{"href":"https:\/\/avtempwp.azurewebsites.net\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/avtempwp.azurewebsites.net\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/avtempwp.azurewebsites.net\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/avtempwp.azurewebsites.net\/wp-json\/wp\/v2\/comments?post=241"}],"version-history":[{"count":0,"href":"https:\/\/avtempwp.azurewebsites.net\/wp-json\/wp\/v2\/posts\/241\/revisions"}],"wp:attachment":[{"href":"https:\/\/avtempwp.azurewebsites.net\/wp-json\/wp\/v2\/media?parent=241"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/avtempwp.azurewebsites.net\/wp-json\/wp\/v2\/categories?post=241"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/avtempwp.azurewebsites.net\/wp-json\/wp\/v2\/tags?post=241"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}