The environment is configured to use a system-level proxy.

The following command can be used to display the configured WinHTTP proxy settings:

netsh winhttp show proxy

The output shows that a proxy bypass list has been configured and contains entries such as:

• localhost
• <local>
• *.domain.com

However, proxy logs show that traffic originating from the Delivery Controller is being routed through the proxy server.

Resource Monitor on the Delivery Controller also shows that HighAvailabilityService.exe has multiple TCP connections to the proxy server.

The License Server and other Delivery Controllers are located in the domain included in the proxy bypass list.

If the proxy server allows internal traffic and has routing to the internal machines (for example, the License Server and other Delivery Controllers), no visible issue may occur.

However, if the proxy server is configured to allow only external traffic, the following issues may occur:

• The Citrix Config Sync Service might fail to import configuration data.
• The Citrix High Availability Service election might not work correctly.

HighAvailabilityService.exe (Citrix High Availability Service) does not correctly process wildcard entries in the system-level proxy bypass list.

As a result, connections to internal Citrix components whose FQDNs match the wildcard entry may be routed through the configured proxy instead of bypassing it.

Workaround

Add the License Server and other Delivery Controllers to the proxy bypass list explicitly using their FQDNs.

This article describes a known issue in Citrix Virtual Apps and Desktops (CVAD) 2402 where the Citrix High Availability Service does not correctly process wildcard entries in the system-level proxy bypass list.

The Citrix Engineering team is aware of this issue and is working on a fix.

Recent versions of Citrix Virtual Apps and Desktops are not affected by this issue.