In my recent blogpost on “NetScaler, WI and the Citrix Receiver 5.7.. “The gateway settings are incorrect” you could read how I configured the Citrix NetScaler for mobile devices (ICA Proxy) and laptops (SSL VPN). During the project new requirements came up and I had to do an End Point Analysis on the laptop to make sure that they were only allowed to do SSL VPN when the machine was domain joined to the customer domain.

So I started to configure the Citrix NetScaler for EPA and I wanted to use this article to exclude mobile clients from the EPA scan, after configuring this policy expression the mobile client still gave an error that EPA wasn’t available for mobile devices. After some research I found the following post on the Citrix forums stating:

The EPA was not skipped for mobile devices.So i logged support call with citrix and worked almost 10 days with citrix support engineer and they finally concluded that the document was wrong..

So I had to be creative on how to build this so I already had the MobileAccess policy in place and by creating a pre-auth policy the mobile clients wouldn’t work so I build a second session policy with a higher priority that checks the following reg key:

“HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Tcpip\Parameters\Domain”

To use this in a session policy it’s formatted like following:

[codesyntax lang=”reg”]

[/codesyntax]

Based on this rule a device that matches would be redirected to the ICA Proxy so I changed the policy to:

[codesyntax lang=”php”]

[/codesyntax]

By using this rule the first check would be for the user-agent, if true the device would get the ICA Proxy. The second rule would check the regkey and if it isn’t a member of the domain the device would be offered the ICA Proxy and all other clients would be offered SSL VPN.

I tested this new config and my EPA scan would hang and wouldn’t give an actual result so I did some more research and I found I wasn’t the only one with this problem:

Stefano Bosio

on 5 months ago · Reply

With that comment I knew what to do, I applied the Green Bubbles theme (the default one with NS10) and forgot to edit the epa.html and postepa.html to the right NSversion as Jarian Gibson blogged about.

Change nsversion one line 19 from 1,1,1,1 to the NetScaler/Access Gateway version you are using.

In my case I was using Citrix  NetScaler NS10.0: Build 72.5.nc so the NSversion should be “10,0,72,5”. After a reboot of the NS the EPA scan worked and all functionality was tested succesful.

The following two tabs change content below.

• Bio
• Latest Posts

Kees Baggerman

Kees Baggerman is a Staff Solutions Architect for End User Computing at Nutanix. Kees has driven numerous Microsoft and Citrix, and RES infrastructures functional/technical designs, migrations, implementations engagements over the years.

Latest posts by Kees Baggerman (see all)

• Nutanix AHV and Citrix MCS: Adding a persistent disk via Powershell – v2 - November 19, 2019
• Recovering a Protection Domain snapshot to a VM - September 13, 2019
• Checking power settings on VMs using powershell - September 11, 2019
• Updated: VM Reporting Script for Nutanix with Powershell - July 3, 2019
• Updated (again!): VM Reporting Script for Nutanix AHV/vSphere with Powershell - June 17, 2019