Attempting to add NetScaler device to Citrix Command Center fails with: “Discovery failed for | Error: Unable to Ping using SNMP after enabling SNMP”

Problem

You’ve just completed deploying Citrix Command Center 5.2 45.4 and attempt to add your NetScaler pair to the device list but the process fails with the following error:

Discovery failed for <NSIP>

Error: Unable to Ping using SNMP after enabling SNMP

Solution

One of the reasons why this error would be thrown is if the Citrix Command Center server is unable to access the NetScaler via UDP Port 161 as shown in the following firewall log capture:

To correct the issue, simply allow UDP port 161 from the Citrix Command Center to the NetScaler and initiate the add device process again:

Workaround for addressing display size when connecting to VMware Horizon View desktops with 3K or 4K devices

One of the frequent issues I’ve noticed the clients I work are coming across is the use of devices that have 3K or 4K resolution. These devices look great when running the native operating system but render connections to VMware Horizon View desktops unusable due to the small display size of the virtual desktop. Most administrators who have come across this issue most likely would have made an attempt to change the DPI of the virtual desktop only to find that the configuration screen is locked:

The way I got around this with my 3K display Mac a few years ago was to simply change the Windows virtual desktop resolution back to a lower setting then connect to the VDI but this defeats the purpose of having a high resolution display. Fast forward to a few years later when a client asked me to look into this again, it looks like VMware has included an experimental (unsupported) registry key addition for VMware Horizon View Client 3.4 or newer that allows DPI scaling so that the display is sized appropriately to the 3K or 4K device connecting to the desktop.

I’ve noticed that there appears to be several places where this registry key should be added depending on the operating system so I’ve included the 3 paths to check:

32-Bit Operating System:

HKCU\Software\VMware, Inc.\VMware VDM\Client

REG ADD "HKCU\Software\VMware, Inc.\VMware VDM\Client" /v EnableSessionDPIScaling /t REG_DWORD /d 1

64-Bit Operating System:

HKCU\Software\Wow6432Node\VMware, Inc.\VMware VDM\Client\

REG ADD "HKCU\Software\Wow6432Node\VMware, Inc.\VMware VDM\Client" /v EnableSessionDPIScaling /t REG_DWORD /d 1

Surface Pro 3 64-Bit Operating System:

HKCU\Software\Policies\VMware, Inc.\VMware VDM\Client

REG ADD "HKCU\Software\Policies\VMware, Inc.\VMware VDM\Client" /v EnableSessionDPIScaling /t REG_DWORD /d 1

-------------------------------------------------------------------------------------------------------------------------------------------------------------

Hope this helps anyone who may be experiencing this issue.

-------------------------------------------------------------------------------------------------------------------------------------------------------------

Update – March 2017

Note that the newer versions of the VMware Horizon View Client no longer require this registry as the setting is available in the settings menu after authenticating with the server:

Allow display scaling

Securing Citrix NetScaler VPX to score A+ rating on SSL Labs

I’ve received quite a few requests from clients over the past few months requesting to secure their NetScaler published services to score an A+ on Qualys SSL Labs:

https://www.ssllabs.com/ssltest/

I’m a bit late to writing this blog post as there are plenty of other excellent posts that demonstrate the process so in an effort to add a bit more value to the community, this post will demonstrate the process on a NetScaler VPX NS11.0 63.16.nc via the command line.

Without any additional configuration, NetScaler published services such as Citrix XenApp/XenDesktop typically scores a C:

Note that the following vulnerabilities exist as shown in the screenshot above:

• SSL 3 enabled
• No support for TLS 1.2
• Server accepts RC4 cipher, but only with older protocol versions
• Server does not support Forward Secrecy with the reference browsers

Step #1 – Turn off SSLv3 and enable TLSv11 + TLSv12

The first step is to turn off SSLv3 and enable TLSv11 and TLSv12 on your Load Balancing Virtual Server(s) and NetScaler Gateway Virtual Servers.

The following screenshots shows where the settings are in the GUI for the Load Balancing Virtual Server named StoreFront-lbvip:

The command to execute are as follows:

set ssl vserver StoreFront-lbvip -ssl3 disabled

set ssl vserver StoreFront-lbvip -tls11 enabled

set ssl vserver StoreFront-lbvip -tls12 enabled

With the commands above executed, the protocols should now be displayed as such:

Repeat the same process for the NetScaler Gateway Virtual Servers.

The following screenshots shows where the settings are in the GUI for the NetScaler Gateway Virtual Servers named www.contoso.com_external and www.contoso.com_internal :

The command to execute are as follows:

set ssl vserver www.contoso.com_external -ssl3 disabled

set ssl vserver www.contoso.com_external -tls11 enabled

set ssl vserver www.contoso.com_external -tls12 enabled

With the commands above executed, the protocols should now be displayed as such:

Step #2 – Create new custom Ciphers

The set of SSL Ciphers will allow us to score an A+ SSL scan on a NetScaler VPX appliance:

• TLS1-ECDHE-RSA-AES256-SHA
• TLS1-ECDHE-RSA-AES128-SHA
• TLS1-DHE-RSA-AES-256-CBC-SHA
• TLS1-DHE-RSA-AES-128-CBC-SHA
• TLS1-AES-256-CBC-SHA
• TLS1-AES-128-CBC-SHA
• SSL3-DES-CBC3-SHA

Execute the following to create a group named Custom-VPX-Cipher with the ciphers listed above:

add ssl cipher Custom-VPX-Cipher

bind ssl cipher Custom-VPX-Cipher -cipherName TLS1-ECDHE-RSA-AES256-SHA

bind ssl cipher Custom-VPX-Cipher -cipherName TLS1-ECDHE-RSA-AES128-SHA

bind ssl cipher Custom-VPX-Cipher -cipherName TLS1-DHE-RSA-AES-256-CBC-SHA

bind ssl cipher Custom-VPX-Cipher -cipherName TLS1-DHE-RSA-AES-128-CBC-SHA

bind ssl cipher Custom-VPX-Cipher -cipherName TLS1-AES-256-CBC-SHA

bind ssl cipher Custom-VPX-Cipher -cipherName TLS1-AES-128-CBC-SHA

bind ssl cipher Custom-VPX-Cipher -cipherName SSL3-DES-CBC3-SHA

With the above commands successfully executed, we should now see the following Cipher Group created:

Step #3 – Bind new custom Ciphers to Load Balancing Servers

With the new cipher group created, proceed with binding them to the Load Balancing Virtual Server(s) and NetScaler Gateway Virtual Server(s):

bind ssl vserver StoreFront-lbvip -cipherName Custom-VPX-Cipher
bind ssl vs StoreFront-lbvip -eccCurveName ALL

bind ssl vserver www.contoso.com_external -cipherName Custom-VPX-Cipher
bind ssl vs www.contoso.com_external -eccCurveName ALL

bind ssl vserver www.contoso.com_internal -cipherName Custom-VPX-Cipher
bind ssl vs www.contoso.com_internal -eccCurveName ALL

----------------------------------------------------------------------------------------------------------------------------------------------

Note that I’ve found the binding process a bit finicky at times and had to unbind the cipher groups so if this is necessary, use the following commands:

unbind ssl vserver StoreFront-lbvip -cipherName DEFAULT

unbind ssl vserver www.contoso.com_external -cipherName DEFAULT

unbind ssl vserver www.contoso.com_internal -cipherName DEFAULT

----------------------------------------------------------------------------------------------------------------------------------------------

With the new cipher group binded to the virtual servers, we can use the following commands to review the bindings:

show ssl vserver StoreFront-lbvip

show ssl vserver www.contoso.com_external

show ssl vserver www.contoso.com_internal

Note that navigating to the ciphers binding in the GUI may throw the following warning:

No usable ciphers configured on the SSL vserver/service

I’ve done a bit of research on this and it appears we can safely ignore it.

Step #4 – Create a Deffie-Hellman (DH) key for Forward Secrecy

The following screenshots shows where to create the Deffie-Hellman (DH) key in the GUI of the NetScaler:

NetScaler > Traffic Management > SSL

The command to execute to create the Deffie-Hellman (DH) key is as follows:

create ssl dhparam /nsconfig/ssl/dhkey2048.key 2048 -gen 2

Note that the process could take a few minutes before completing so wait until the green cursor display changes to a >:

Reviewing the /nsconfig/ssl directory on the NetScaler should now show the dhkey2048.key key that was created:

Step #5 – Assign Deffie-Hellman (DH) key for Forward Secrecy to Virtual Server

With the Deffie-Hellman (DH) key successfully created, proceed with assigning it to the virtual servers.

The following screenshots shows where the settings are in the GUI:

Execute the following command to assign the key:

set ssl vserver StoreFront-lbvip -dh ENABLED -dhFile "/nsconfig/ssl/dhkey2048.key" -dhcount 1000

Repeat the process for the NetScaler Gateway Virtual Servers:

set ssl vserver www.contoso.com_external -dh ENABLED -dhFile "/nsconfig/ssl/dhkey2048.key" -dhcount 1000

set ssl vserver www.contoso.com_internal -dh ENABLED -dhFile "/nsconfig/ssl/dhkey2048.key" -dhcount 1000

Step #6 – Create a Rewrite Action and Policy for Strict Transport Security

Execute the following to create a Rewrite Action for Strict-Transport-Security:

add rewrite action act_sts_header insert_http_header Strict-Transport-Security q/"max-age=157680000"/

With the command above successfully executed, you should now see the following action created:

Execute the following to assign the Rewrite Action for to a policy:

add rewrite policy pol_sts_header TRUE act_sts_header

With the command above successfully executed, you should now see the following policy created with the action assigned:

Step #7 –  Bind the Strict Transport Security policy to the Virtual Servers

With the Strict Transport Security policy created, proceed with binding them to the virtual servers with the following commands:

bind vpn vserver www.contoso.com_external -policy pol_sts_header -priority 100 -gotoPriorityExpression END -type RESPONSE

bind vpn vserver www.contoso.com_internal -policy pol_sts_header -priority 100 -gotoPriorityExpression END -type RESPONSE

bind lb vserver StoreFront-lbvip -policy pol_sts_header -priority 100 -gotoPriorityExpression END -type RESPONSE

With the command above successfully executed, we should now see the policy binded to the virtual servers:

-----------------------------------------------------------------------------------------------------------------------------------------------------------------

Having completed all the steps outlined above should now allow the NetScaler site to score an A+:

Changing the Phone Extension in Avaya Communicator for Microsoft Lync 2013 after the initial configuration

Problem

You’ve completed deploying the Avaya Communicator for Microsoft Lync (version 6.4.0.2.50) client side integration with Skype for Business Server 2015 to replace the previous Lync Server 2013 and Avaya AES server’s RCC functionality but noticed that you are unable to change the Extension in the Avaya Communication for Microsoft Lync because it is greyed out once it has been configured:

Solution

I’m not exactly sure if this is by-design but one of the ways I found to workaround this was change the Choose the Device for Calls: setting to another option (in this case it is the Computer setting):

Then change it back to the previous Desk Phone option and you will then notice that the Extension field is no longer greyed out: