james kahn’s scratchpad

I discovered something interesting today about Citrix Access Gateway Advanced. I’m working a project where as part of it, we’re publishing a list of both intranet and Internet company-related websites.

The intranet sites worked fine. When opening up an Internet site, the navigation portal would first try to open the external site internally, display a “Page cannot be displayed” message, and then open up a second browser window and redirect the browser to the correct site. The sites worked, but it wasn’t pretty.

It turns out that I’d included the web resources in two access policies - one that said it should bypass the web proxy, and one that left that setting unconfigured. I changed the access policies so that the Internet-based web resources were only in the policy that bypassed the web proxy, and removed them completely from the other access policy and ta-da - they work fine now.

Well, I was wrong about that. I initially thought that had fixed it, but for some reason I wasn’t paying attention and the problem was still occurring.

In order to get around a lot of IE7 hassles, I had added the Access Gateway’s URL into IE’s trusted sites. This worked fine when accessing internal resources. However, in IE7, trusted sites need to operate in a separate browser window to non-trusted sites. When clicking on an external link, a new window would open up to the web proxy redirector at the AG Advanced portal, which would redirect to the untrusted external link, which would open up in yet another browser window.

To get around this behaviour, I needed to remove the Access Gateway from trusted sites, and change the IE7 secure option “Automatic prompting for file downloads” to “Enabled” to allow the Web Interface to work correctly.