When using End Point Analysis (EPA), the plug-in fails to start or fails to scan after starting on MAC. Using a web browser does not initiate the scan, even when using ICA-Proxy for EPA.

The following errors are displayed:
Cannot connect to NetScaler Gateway. Contact your help desk with following information: Endpoint analysis process failed.

3006: The plug-in failed to start. Contact your help desk or system administrator.

Important! This article is intended for use by System Administrators. If you are experiencing this issue and you are not a System Administrator, contact your organization’s Help Desk for assistance and refer them to this article.

To resolve this issue ensure that the preauthentication policy and NetScaler Gateway plug-in are correctly configured.

In this article a File Exist Policy for preauthentication is used to illustrate the correct configuration.

1. Create the preauthentication policy and bind it to the NetScaler Gateway virtual server.
   For more information refer to Citrix Documentation - Configuring Preauthentication Policies and Profiles.
   Note: Ensure that you enable Smart Access Mode.

   

   

2. Download and install the Citrix NetScaler Gateway Plug-in for MAC OS X.

3. Create a file on the MAC OS X. Currently, the only supported directory is the /Library directory.
   In this example /Library/test.txt is created.

4. Run Citrix NetScaler Gateway Plug-in.

5. Select Edit Connections.

   

6. Enter a name for this connection in the Connections tab.
   Note: This need not be an FQDN. The FQDN is added as a placeholder for reference.

7. Specify the FQDN for the NetScaler Gateway virtual server in the Connections tab.
   Note: Do not use http or https when specifying the FQDN.

8. If two-factor authentication is used, select Show secondary password field check-box.

   

9. Close the Preferences Window and select the new site to start the log on process.

   

   If you are using a preauthentication policy, then the following screen appears for logon:

   

Problem Cause

This error is usually observed when preauthentication policy or NetScaler Gateway plug-in is in correctly configured.

In the NetScaler command line interface, you can run the following command to view the failed EPA scans:
tail -f /var/log/ns.log | grep EVAL

The EPA scans that pass will not show in this log.

For more information about EPA, refer to Citrix Documentation - Configuring Endpoint Polices.