StoreFront Site Connecting Through NetScaler Gateway Gets Stuck at "/cgi/setclient?wica" Page After Authentication

StoreFront Site Connecting Through NetScaler Gateway Gets Stuck at "/cgi/setclient?wica" Page After Authentication

book

Article ID: CTX208180

calendar_today

Updated On:

Description

When accessing StoreFront site through NetScaler Gateway, StoreFront site gets stuck at "/cgi/setclient?wica" page after authentication.

Resolution

Use Source IP (USIP) being enabled can cause this issue.  Check to see if it is enabled as a global mode.  USIP causes the Netscaler to use the client IP (as seen from the internet) as the source when communicating to Storefront instead of using the Netscaler SNIP.
When used, it often causes return traffic issues on the internal network as there is no routing to gateway the traffic from the server to the Netscaler when using USIP.  Since the client IP is used instead of SNIP, when the server replies, the route tends to fall under the default gateway route and traffic from server back to the USIP address often goes via the wrong gateway (instead of the Netscaler). 
If the USIP is enabled intentionally for this purpose, ensure that the server uses the Netscaler SNIP as it’s default gateway so that traffic may be returned properly to the Netscaler in order to proxy to the client.
Note:

  • Turning on or off USIP as a mode will require a restart to take effect. 
  • Often a service or service group that corresponds to the Storefront or Web Interface will have the USIP setting even though the global mode is disabled.  A reboot will not be required to toggle this setting.
  • If the effort is to have traffic pass to the Netscaler Gateway and return to the client directly (where the return traffic does not use the Netscaler), this would be called Direct Server Return (DSR), and is NOT SUPPORTED ON NS GATEWAY.

This issue can also occur if there is no connectivity between NetScaler and StoreFront server. Refer to this Citrix Discussions topic for information to troubleshoot this issue.


Problem Cause

USIP is enabled and traffic cannot return from Storefront back to the Netscaler for proxy to client.

Notice when tracing, and filtering for either the client IP or server IP, you will find that Netscaler is sending SYN from the client IP to the server IP, and no SYN/ACK is returned.

 

Issue/Introduction

When accessing StoreFront site through NetScaler Gateway, StoreFront site gets stuck at "/cgi/setclient?wica" page after authentication.

Additional Information

Citrix Discussions - NetScaler hangs on ../cgi/setclient?wica