Product: Citrix Virtual Apps and Desktops (On-Premises), Citrix Gateway / ADC, Windows Virtual Delivery Agent (VDA)

Category: Session Connectivity, Network & Security

When launching a published desktop or application on an on-premises Citrix Virtual Apps and Desktops environment, the connection fails during the initial HDX session launch.

Users see one or more of the following error messages in Citrix Workspace app or Receiver:

• "No CGP Service" or "The CGP handshake failed with the server."

• "Unable to connect to the server. Contact your system administrator with the following error: The CGP handshake failed."

• Event Viewer (VDA - System/Application Logs): Event ID 1017 or Citrix ICA Transport driver errors:

  "The Citrix ICA transport driver connection from [Gateway SNIP/Client IP] to port 2598 was unexpectedly closed during its SSL handshake phase."

The Common Gateway Protocol (CGP) runs on TCP port 2598 and manages Citrix Session Reliability. This issue occurs when the client or Gateway attempts to negotiate a Session Reliability connection on port 2598, but the connection is interrupted or rejected.

Common root causes include:

1. Firewall or Network Blocking: Intermediate firewalls, security appliances (e.g., Palo Alto, Fortinet), or local Windows Defender Firewall blocking TCP port 2598 between NetScaler/Gateway and the VDA.

2. SSL/TLS Mismatch or Certificate Issue: TLS/SSL encryption is enabled on the VDA or Gateway, but cipher suites, SSL protocol versions, or certificates are mismatched or untrusted.

3. VDA CGP Service Failure: The Citrix CGP listener on the Windows VDA is stopped, hung, or bound to the wrong IP interface.

4. Session Reliability Policy Mismatch: Session Reliability is enabled on the Delivery Controller/Gateway policy side but disabled on the VDA (or vice versa).

Work through these troubleshooting steps sequentially to resolve the connection failure.

Step 1: Verify Network & Firewall Connectivity (Port 2598)

1. Open PowerShell or Command Prompt on the client endpoint and test connectivity to the VDA on port 2598: (Applicable for only internal LAN connections)

   PowerShell

   Test-NetConnection -ComputerName <VDA_IP_or_FQDN> -Port 2598
   

2. Check Interfacing Firewalls:

   • Ensure TCP port 2598 (CGP) and TCP port 1494 (ICA) are open end-to-end between the NetScaler SNIP (Subnet IP) / Gateway and the VDA backend subnets.

   • If using Next-Gen Firewalls (NGFW) with Application Identification (e.g., Palo Alto App-ID), ensure traffic on port 2598 is not being classified as unknown-tcp and dropped.

3. Verify Windows Local Firewall on VDA:

   • Open wf.msc on the affected VDA and verify that inbound rules for Citrix CGP Server (TCP 2598) are enabled.

Step 2: Verify CGP Service & Listener Status on the VDA

1. Log into the affected Windows VDA as an Administrator.

2. Open Command Prompt as Administrator and verify if the VDA is actively listening on port 2598:

   DOS

    

   netstat -ano | findstr :2598
   

   • Expected output: TCP 0.0.0.0:2598 ... LISTENING

3. Restart the Citrix Desktop Service and ICA Services:

   • Open services.msc.

   • Restart Citrix Desktop Service (WorkstationAgent).

   • Restart Citrix ICA Service (depending on VDA version).

Step 3: Validate Session Reliability Policies in Citrix Studio

1. Open Citrix Studio / Web Studio.

2. Navigate to Policies and locate the active policy applied to the target delivery group.

3. Review the following settings:

   • Session reliability connections: Set to Allowed (default).

   • Session reliability port number: Set to 2598 (default).

4. If Session Reliability is explicitly disabled in Studio policy, ensure StoreFront and Citrix Gateway settings match each other.

Step 4: Check HDX SSL/TLS Handshake Configuration

If SSL/TLS encryption is enabled directly between NetScaler/StoreFront and the VDA (HDX SSL Direct Encryption):

1. Check Certificate Validity:

   • Verify that a valid server certificate with a trusted Root/Intermediate CA chain is bound on the VDA using Enable-VdaSsl.ps1 or Group Policy.

2. Match Cipher Suites:

   • Ensure the NetScaler Gateway SSL Profile cipher suites overlap with the Windows VDA Schannel / OS cipher suite policies.

   • If TLS 1.3 or specific elliptical curves are enforced on NetScaler, verify the VDA OS supports them.

3. Verify STA (Secure Ticket Authority) Reachability:

   • Ensure StoreFront and Citrix Gateway can reach all listed STA servers on port 80 / 443 / 8080.

Verification & Testing

1. Clear existing Workspace app cache or reset Citrix Workspace app on the client device.

2. Launch the Virtual Desktop / Application.

3. Verify the active session port using netstat on the client or by checking Citrix Director / Monitor:

   • Navigate to Citrix Monitor > User Sessions.

   • Locate the active session and inspect the Connection Details to ensure protocol state shows CGP / Port 2598 - Connected.

This error occurs when Citrix Session Reliability cannot establish a TCP/2598 handshake between the client/Gateway and the Windows VDA due to network firewall blocks, service failures, or SSL/TLS misconfigurations. Resolution involves opening port 2598, verifying the VDA's CGP services, clearing synthetic NetScaler monitors, and aligning session policy settings.