HDX session sharing from Director /Daas Monitor won't work with Palo Alto PAN Agent intalled on VDA 2511 / 2603

book

Article ID: CTX697147

calendar_today

Updated On:

Description

It was observed that PAN TS Agent's Winsock driver intercepts bind() and remaps user-session dynamic ports into its allocation pool (20000–39999).

Observations from working & non-working scenario CDF logs:

 

2507 CU1 - Working scenario:
 
AsyncTcpAcceptor::listen,12,EntryExit,">listen()",""
AsyncTcpAcceptor::listen,12,EntryExit,"
Server::DoAccept,12,EntryExit,">DoAccept()",""
AsyncTcpAcceptor::async_accept,12,EntryExit,">async_accept()",""
AsyncTcpAcceptor::async_accept,12,EntryExit,"

 
2603 - non working scenario:
 
AsyncTcpAcceptor::openV4,12,EntryExit,">openV4(52525)",""
17,AsyncTcpAcceptor::openV4,12,EntryExit,"
AsyncTcpAcceptor::bind,12,EntryExit,">bind()",""
AsyncTcpAcceptor::bind,12,EntryExit,"
AsyncTcpAcceptor::listening_port,12,EntryExit,">listening_port()",""
AsyncTcpAcceptor::listening_port,12,EntryExit,"
Server::StartListener,9,Information,"StartListener: not listening on port 20402 bound with port number
 

PAN Agent log shows, user getting new port block of 20400-20599 which we can correlate with CDF logs. 

image.png

 

PAN Agent System source port allocation range and source port ranges are as below. 

image.png

 

Key Changes:
  • In CVAD 2603, the flow includes an explicit Port verification step after binding. This provides additional assurance that the port was correctly bound before proceeding to listen. This is by Design.
  • In the 2507-cu1, the Bind operation succeeded without explicit verification. 
The key differences are:
  • 2507-cu1:  Winsock accepts the bind (returning error 0), but PAN TS Agent silently remaps the local endpoint port to 20402.
Crucial Difference: 2507 CU1 never queries listening_port() after bind().
It immediately proceeds to listen() and async_accept()
  • 2603: bind returns success (ec=0), but local_endpoint().port() reports 20402/20403 instead of 52525/52526 → StartListener treats this as failure and closes/retries.
 
 
 

Cause

PAN TS Agent's Winsock driver intercepts bind() and remaps user-session dynamic ports into its allocation pool (20000–39999).
Because 2603 strictly enforces listening_port() == requestedPort, PAN's silent remapping is caught as a mismatch and treated as a hard failure.

 

Resolution

On 2511, 2603 Current Release, Citrix introduced Post-Bind verification in TwScreenShare to ensure port integrity in multi-session environments and avoid binding collisions or binding to unintended wildcard ports. This is by Design.

 

To fix this issue, exclude ports 52525–52625 in the PAN TS Agent configuration under Reserved Source Ports / Whatever settings it needs to configure. 

OR  add CtxGfx.exe as a process exclusion in PAN TS Agent policy so PAN Agent does not intercept and remap these binds.

 

As a Temporary workaround, you can disable 'PAN Terminal Server Agent' service from Services.msc on the VDA. 

image.png

Issue/Introduction

HDX session sharing from Director /Daas Monitor won't work on VDA 2511 / 2603 current release if Palo Alto PAN Agent intalled on the VDA machine. 

This affects VDA to VDA screen sharing option from Citrix Graphics Status Indicator on VDA as well.

When user initate screen sharing, instead of unique code, gets an error 'Failed to share screen'.

 

Powered by Wolken Software