Launch.ica file contains wrong Adress and SSLProxyHost information

I do have it set to Secure Gateway Direct. The server is behind a NAT firewall. And how do I check if the STA is working correctly?

Here is the SG diagnostic report. How would I know what port the STA is listening on?

Version = 3.0.1

Computer NetBIOS Name: CITRIXSERVER
Configuration captured on: 4/8/2008 8:59:53 AM
----------------------------------------------

Secure Gateway Global Settings
------------------------------
  Version = 3.0.1
  Product secured = MetaFrame Presentation Server only
  Logging level =  3 (All events including information)
  Client connection timeout =  100 seconds
  Maximum concurrent connections =  250
  Certificate FQDN = citrix.companyname.com

Interfaces
----------

  All interfaces (0.0.0.0 : 443)
  ------------------------------
    Protocol = SSL, TLS
    Cipher suites = ALL
    Secured = Yes
    HTTP = No
    ICA = Yes
    SOCKS = Yes
    Gateway Client = No
    LoadBalancerIPs = None defined

Web Interface
-------------
  FQDN = localhost
  Port = 80
  Secured = No
  Protocol = SSL, TLS
  Cipher suites = ALL
  Access mode = Indirect
  Tested OK

Authority Servers
-----------------

  ID = STA637414E16744
  --------------------
    FQDN = citrix.companyname.com
    Port = 80
    Path = /Scripts/CtxSTA.dll
    Type = STA
    Secured = No
    Protocol = SSL, TLS
    Cipher suites = ALL
    Tested OK

Certificate Check
-----------------
  FQDN = citrix.companyname.com
  This certificate is currently valid.

EOF

Here is the configuration of the WI:

#
# WebInterface.conf
# Ensure that this file is saved with UTF-8 encoding
#

AccountSelfServiceUrl=
# AdditionalExplicitAuthentication=None
AddressResolutionType=ipv4-port
AGEPromptPassword=Off
AGEWebServiceUrl=
AllowBandwidthSelection=Off
AllowCustomizeAppColumns=On
AllowCustomizeApplicationAccessMethod=Off
AllowCustomizeAudio=Off
AllowCustomizeClientPrinterMapping=Off
AllowCustomizeClients=Off
AllowCustomizeJavaClientPackages=Off
AllowCustomizeLayout=Off
AllowCustomizeLogoff=On
AllowCustomizeReconnectAtLogin=On
AllowCustomizeReconnectButton=On
AllowCustomizeSettings=On
AllowCustomizeTransparentKeyPassthrough=Off
AllowCustomizeVirtualCOMPortEmulation=Off
AllowCustomizeWinColor=Off
AllowCustomizeWinSize=On
AllowUserAccountUnlock=Off
AllowUserPasswordChange=Never
AllowUserPasswordReset=Off
AlternateAddress=Mapped
AppColumns=3
ApplicationAccessMethods=Remote
AuthenticationMethods=Explicit
AutoDeployWebClient=On
# AutoDeployWebClientPackage=ica32pkg.msi
AutoFallbackToJavaClient=Off


BrandingColor=#666699
BypassFailedRadiusServerDuration=60
BypassFailedSTADuration=60


ClientAddressMap=10.0.0.0/255.0.0.0,Normal,192.168.0.0/255.255.0.0,Normal,*,SG
ClientProxy=*,Auto,-
# CompanyHomePage=[URL of your company home page]
CompanyLogo=../media/citrix.gif
CredentialFormat=All
CSG_EnableSessionReliability=On
CSG_Server=citrix.companyname.com
CSG_ServerPort=443
CSG_STA_URL1=http://citrix.companyname.com/scripts/ctxsta.dll


DefaultApplicationAccessMethod=Remote
DefaultClient=On
# DefaultCustomTextLocale=[language code]
DisplayFooter=On
DisplayHeader=On
DisplayMainBoxTitleBarBgImage=On
DisplaySiteLogo=On
# DomainSelection=[Domain1,Domain2,...]
DuplicateLogInterval=60
DuplicateLogLimit=10



# EnableFileTypeAssociation=On
EnableKerberosToMPS=Off
EnableLegacyICAClientSupport=Off
EnableLogoffApplications=On
EnablePassthroughURLs=Off
EnableRadiusServerLoadBalancing=On
EnableSTALoadBalancing=On
EnableVirtualCOMPortEmulation=Off
EnableWorkspaceControl=On
# ErrorCallbackURL=[URL for processing fatal error messages which replaces the logged out page]


Farm1=citrixserver,Name:CITRIXFARM,XMLPort:80,Transport:HTTP,SSLRelayPort:443,BypassDuration:60,LoadBalance:On,AuthenticationTickets:On,TicketTimeToLive:200,RADETicketTimeToLive:200
# FooterText_<lang-code>=[Customized footer text in the specified language]


# HeadingImage=[URL of your heading image]
HideDomainField=Off
HpUxUnixClient=Default


IbmAixClient=Default
IcaWebClient=icaweb.cab
IcaWebClientClassID=238f6f83-b8b4-11cf-8771-00a024541ee3
IcaWebClientVersion=9,0,32891,0
IgnoreClientProvidedClientAddress=On
# InternalServerAddressMap=[normalAddress,translatedAddress,normalAddress,translatedAddress,...]


JavaClientPackages=ConfigUI,PrinterMapping,SecureICA
# JavaClientRootCertificate=[File name of a private root certificate for Java Client]


KioskMode=Off


LaunchClients=ICA-Java,ICA-Embedded,ICA-Local
LaunchMethod=ICA-Local
LinuxClient=Default
# LoginDomains=[domain1,domain2,...]
# LoginType=Default
LogoffFederationService=On


MacClient=Default
MainBoxTitleBarBgColor=#C8C8C8
MainBoxTitleBarBgImage=../media/greygrad.gif
MainBoxTitleFontColor=#000000
MessageHeadingBgColor=#DFDFDF
MessageHeadingFontColor=#000000
MultiFarmAuthenticationMode=All


NDSContextLookupLoadbalancing=On
# NDSContextLookupServers=[List of NDS servers, each starting with ldap:// or ldaps://]
# NDSTreeName=[NDS Tree name for NDS logins]


OtherClient=Default
OverlayAutologonCredsWithTicket=On
# OverrideClientInstallCaption=[Customized client install caption]
OverrideIcaClientname=On

PasswordExpiryWarningPeriod=14
PooledSockets=On

RADEClientClassID=4384F3C5-4A9E-4E81-9AAE-4251C2813861
# RADEHeartbeatURL=auto
RadiusRequestTimeout=30
# RadiusServers=[server:port,server:port,...]
RdpWebClient=msrdp.cab
RdpWebClientClassID=7584c670-2274-4efb-b00b-d6aaba6d3850
RdpWebClientVersion=5,2,3790,0
ReconnectAtLogin=DisconnectedAndActive
ReconnectButton=DisconnectedAndActive
RequestICAClientSecureChannel=Detect-AnyCiphers
RequireLaunchReference=Off
RestrictDomains=Off
RetryCount=5


ScoUnixClient=Default
# SearchContextList=[NDS context1,NDS context2,...]
ServerAddressMap=10.10.10.251:80,[PUBLIC IP ADDRESS]:80,10.10.10.251:1494,[PUBLIC IP ADDRESS]:1494,10.10.10.251:2598,[PUBLIC IP ADDRESS]:2598,10.10.10.251:443,[PUBLIC IP ADDRESS]:443
SgiUnixClient=Default
ShowClientInstallCaption=Auto
ShowPasswordExpiryWarning=Never
SolarisUnixClient=Default


Timeout=60
TransparentKeyPassthrough=FullScreenOnly
Tru64Client=Default


# UPNSuffixes=[UPN suffix1,UPN suffix2,...]
UserInterfaceLayout=Auto


Version=4.5.1.8215


WebSessionTimeout=20
# WelcomeMessage_<lang-code>=[Customized welcome message in the specified language]
Win16Client=Default
Win32Client=Default
TwoFactorPasswordIntegration=Off
TwoFactorUseFullyQualifiedUserNames=Off
RADESessionURL=auto

Correct. Everything is running on a single machine. The only port open on the firewall to the server is 443. I will try removing those translations and see what happens.

Nope. Still no go. Here is what the launch.ica file looks like. Note how there is nomention of the external FQDN.

[Encoding]
InputEncoding=UTF8

[WFClient]
CPMAllowed=On
ClientName=WI_S8tcLTIl-aeGUvkmu
ProxyFavorIEConnectionSetting=Yes
ProxyTimeout=30000
ProxyType=Auto
ProxyUseFQDN=Off
RemoveICAFile=yes
TransparentKeyPassthrough=FullScreenOnly
TransportReconnectEnabled=On
VSLAllowed=On
Version=2
VirtualCOMPortEmulation=Off

[ApplicationServers]
Desktop Access=

[Desktop Access]
Address=10.10.10.251:1494
AutologonAllowed=ON
BrowserProtocol=HTTPonTCP
CGPAddress=*:2598
ClearPassword=56383A193E05B1
ClientAudio=Off
DesiredColor=8
DesiredHRES=1024
DesiredVRES=768
DoNotUseDefaultCSL=On
Domain=\2C3EBB08A1744678
EncryptionLevelSession=EncRC5-0
HTTPBrowserAddress=!
InitialProgram=#Desktop Access
LPWD=16
Launcher=WI
LocHttpBrowserAddress=!
LogonTicket=56383A193E05B12C3EBB08A1744678
LogonTicketType=CTXS1
LongCommandLine=
NRWD=16
ProxyTimeout=30000
ProxyType=Auto
SSLCiphers=all
SSLEnable=On
SSLProxyHost=CITRIXSERVER.LOCALDOMAIN.local:443
SecureChannelProtocol=Detect
SessionsharingKey=8-rc5-login-none-localdomain.local-testadmin-CITRIXFARM
StartIFDCD=1207664747675
StartSCD=1207664747675
TRWD=0
TWIMode=Off
TransportDriver=TCP/IP
UILocale=en
Username=testadmin
WinStationDriver=ICA 3.0

[Compress]
DriverNameWin16=pdcompw.dll
DriverNameWin32=pdcompn.dll

[EncRC5-0]
DriverNameWin16=pdc0w.dll
DriverNameWin32=pdc0n.dll

[EncRC5-128]
DriverNameWin16=pdc128w.dll
DriverNameWin32=pdc128n.dll

[EncRC5-40]
DriverNameWin16=pdc40w.dll
DriverNameWin32=pdc40n.dll

[EncRC5-56]
DriverNameWin16=pdc56w.dll
DriverNameWin32=pdc56n.dll

mpfister,

That solved the web access problem! Thanks! Now I'm working on getting the internal connections working with the Citrix ICA client. These work to a point. The user logs ina nd sees the published desktop, then clicks on it. It tries to make the connection and then errors out with: "Cannot connect to the Citrix Presentation Server. The Citrix SSL Relay name could not be resolved (SSL error 40)"

I thought that's what the DMZ translations were there to take care of, but I'm a novice. Any thoughts? We're close....

I made the changes you suggested. But I still get this message when trying to connect using the Windows Citrix client: "Cannot connect to the Citrix Presentation Server. The Citrix SSL Relay name could not be resolved (SSL error 40)"

I don't have SSL relay configured. Nor did I think the Windows client would use SSL.

Can you tell me where to find this?

That's the plan, yes. That's why I'm not sure why I'm getting SSL errors on the full client.