Microsoft and Chrome configurations for NetScaler Gateway 10.x and Storefront 2.x

Working in the field, I have had to do some tweaking to get Internet Explorer and Chrome to work properly when using NetScaler Gateway 10.x and Chrome 2.x.  This blog will list the different scenarios and how to resolve the issue at hand:

Problem #1: After upgrading Java you receive the following error message when accessing "Upgrade Wizard" or the "NetScaler Gateway":

Resolution:   The workaround for this issue is as follows:

Now the Upgrade Wizard and the NetScaler Gateway VIP will now open.

Problem #2:   Internet Explorer Compatibility with NetScaler Gateway 10.x

Cause:  In the past year or so, Microsoft changed the User-Agent string.  As a result of this, it broke the Access Gateway Login.  Luckily, Citrix has come up with a workaround to resolve the Internet Explorer 11 Compatibility problem.  

Resolution:  There are 2 workarounds for this:

Option 1: Add Access Gateway Login site to the Internet Explorer Compatibility View Setting. By doing this, the website will be displayed as if you were using an older version of internet explorer.  This particular way is not really recommended because you would either have to ask users to add this to their compatibility settings or set a group policy and add the Access Gateway Web Sites which would not be helpful for external users.

Option 2:  In the NetScaler, add explicit compatibility instructions to the content being sent to the browser.  Below are the configuration settings: (to apply these settings I would recommend using Putty).

This rewrite action adds the Internet Explorer compatibility instructions to the origin content.

add rewrite action NG-IE11 insert_after_all “HTTP.RES.BODY(6000)” q/”\r\n”+”<META http-equiv=\”X-UA-Compatible\” content=\”IE=EmulateIE9\”>”/ -search “text(\”</TITLE>\”)”

Then use the following policy to repair the Access Gateway Login Pages

add rewrite policy NG-IE11_rwpol “HTTP.REQ.URL.PATH.ENDSWITH(\”/vpn/index.html\”)” NG-IE11
bind rewrite global NG-IE11_rwpol 100 NEXT -type RES_OVERRIDE

Problem #3:  When attempting to log into Access Gateway using the Chrome browser, you receive a message to Install Citrix receiver, even though you already have it installed on your PC. 

Cause:  Google announced that NPAPI plugin support, a capability Citrix has depended on for years, will be disabled by default in Chrome in April 2015.  The NPAPI plugin that Receiver for Windows and Mac install enables Receiver for Web to detect that Receiver is installed and enables users to launch applications.

Resolution:  Customize Receiver for Web in Storefront.  Insert the following code into custom.script.js in the contrib folder under the Receiver for Web site, users of Chrome browser will never be prompted to install Citrix Receiver.

$(document).ready(function () {
    function endPluginAssistant() {
        if (CTXS.getCookie(CTXS.COOKIE_PLUGIN_ASSISTANT_STATE) === null) {
        } else {
    var origInit = CTXS.PluginDetection.init;
    CTXS.PluginDetection.init = function() {
        if (CTXS.ClientInfo.isChrome()) {


If you still want users to be able to download and install Receiver, please apply the following code in the custom.script.js.  This will add a link to the user menu to download Receiver for Chrome browser.

$(document).ready(function () {
    $.ctxs.ctxsUserMenu.prototype._origGenerateDropDownMenu = $.ctxs.ctxsUserMenu.prototype._generateDropDownMenu;
    $.ctxs.ctxsUserMenu.prototype._generateDropDownMenu = function(ddMenu) {
        var self = this;
        var $mBody = ddMenu.children(".usermenu-body");
        if (CTXS.ClientInfo.isChrome() && (CTXS.ClientInfo.isWindows() || CTXS.ClientInfo.isMacOSX())) {
            var clientUrl = CTXS.ClientInfo.isWindows() ? CTXS.Config.pluginAssistant.win32.path : CTXS.Config.pluginAssistant.macOS.path;
            $mBody.append('<a id="userdetails-downloadreceiver" class="_ctxstxt_DownloadReceiver _ctxstip_DownloadReceiverToolTip" href="{0}" role="menuitem"></a>'.format(clientUrl));

Labels: , , , , , ,