• This is the internal Network Flow of a Published Apps/Desktop Session through Citrix Storefront (bypassing Citrix Netscaler Gateway)  for troubleshooting purposes

Instructions

1. Authentication

1. Citrix Workspace App contact StoreFront using HTTP (TCP port 80) or HTTPs (TCP port 443)
2. StoreFront presents an authentication page
3. User submits credentials
4. StoreFront contacts AD using Kerberos (UDP/TCP on port 88) to authenticate the user
5. AD returns a response to StoreFront
6. The user gets logged in to the store

2. Resource Enumeration

1. After successful authentication, StoreFront passes user credentials to the Delivery Controller using HTTP (TCP port 80) or HTTPs (TCP port 443) for the list of resources available for a specific user.
2. Delivery Controller contacts AD for LDAP request (TCP port 389) to identify the user's identity and group memberships.
3. Delivery Controller contacts Site Database (TCP port 1433) stored on the SQL Server to obtain apps and desktops metadata such as names and icons associated with the resource user group access to.
4. Deliver Controller sends the information back to StoreFront using HTTP (TCP port 80) or HTTPs (TCP port 443)
5. StoreFront presents all the resources directly to Citrix Receiver on the user's endpoint

3. Resource Launch

1. The user clicks the icon shown in the store (TCP port 80 or 443)
2. StoreFront contacts Delivery Controller using HTTP (TCP port 80) or HTTPs (TCP port 443)
3. Delivery Controller reaches out to SQL Server (TCP port 1433) to identify the most suitable VDA
4. Delivery Controller contacts that VDA (TCP port 80)

• For Server OS VDAs, they are always listening for incoming connections
• For Desktop OS VDAs, they are now beginning to listen for incoming connections

5. VDA returns a  session key to the Delivery Controller
6. Delivery Controller sends the session key containing all of the connection information to StoreFront (TCP port 80 or 443)
7. StoreFront put all the connection information into the default .ICA file and sends it to the endpoint (TCP port 80 or 443)

4. Session Initialization

 

1. Citrix Receiver on user endpoint directly contacts VDA (TCP port 1494/2598 based on session reliability) using connection information stored in .ICA file
2. VDA notifies the Delivery Controller of the connection setup (TCP port 80)
3. Delivery Controller contacts the License Server (TCP port 7279) to check out the license on behalf of the device or user connected to the environment
4. Delivery Controller commits session connection information to site database on SQL Server (TCP port 1433)
5. The user interacts with app or desktop resources (TCP port 1494/2598 based on session reliability)

1. Authentication

• User cannot logon - check for AD authentication

2. Enumeration

   

• The user has not been assigned any resources or the user is assigned in the wrong user group.
• Storefront access to DDC (wrong DDC address\ wrong XML port\ Broker Service down \ wrong SSL certificate on DDC when using HTTPs)
• DDC has a problem communicating with DataBase, may transaction log full if using SQL mirror or AlwaysOn

3. Resource Launch Process

• No .ICA file download - communication problem between DDC and VDA / no available VDAs

4. Session Initialization

• VDA registration problem
• The endpoint cannot connect to VDA (port blocked/ DNS resolving problem)