Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Cisco 837 and Citrix ICA Client

Citrix ICA client uses TCP 1494 to communicate with the Metaframe server but when I allow 1494 inbound on dialer1 via the access list I can not connect. There is no ip inspection. I know that the Metaframe server responds on 1494 but then assigns a high range ip for continued transmissions. Any idea? Probably a simple one to fix for you guys.

  • WAN Routing and Switching
1 REPLY
Anonymous
N/A

Re: Cisco 837 and Citrix ICA Client

In most PIX scenarios, the inside interface and network use private addressing, while the outside interface and network use public addressing. Therefore, a static mapping must be created to establish the relationship between the outside and inside addresses. Moreover, an Access Control List (ACL) must define the traffic that is permitted through the PIX.

Citrix Metaframe (ICA client or Web interface) uses ports 1494 (TCP) and 1604 (User Datagram Protocol [UDP]) to communicate. Therefore, these ports must be explicitly permitted on the PIX.

Consider the example of a device on the inside interface of the PIX with an IP address of 10.1.1.10, which is mapped to an external (global) IP address of 2.2.2.1. In this case, traffic destined for 2.2.2.1 arrives at the PIX, is translated to 10.1.1.10, and is passed to the inside interface.

Based on these factors, the configuration necessary for this scenario is:

static(inside,outside) 2.2.2.1 10.1.1.10 netmask 255.255.255.255

! --- The static mapping between 2.2.2.1 (outside address) and 10.1.1.10 (inside address).

access-list 101 permit tcp any host 2.2.2.1 eq 1494

! --- Permits TCP traffic to 2.2.2.1, port 1494.

access-list 101 permit udp any host 2.2.2.1 eq 1604

! --- Permits UDP traffic to 2.2.2.1, port 1604.

access-group 101 in interface outside

! --- Apply ACL 101 to the outside interface.

Note: Depending on the number of clients and sessions, try to decrease or increase the range of TCP ports that must be opened. For example, if the number of Citrix clients is large, open TCP port 1494 and also open TCP ports 1023 and above (a maximum of 65535), depending on the number of such clients.

329
Views
0
Helpful
1
Replies
This widget could not be displayed.