This is a little different from the problems that I've seen in the
Knowledgebase for BorderManager concerning Citrix connectivity. Here
is the
problem scenario:

BorderManager 3.7, with SP2, running on Netware 6.0, SP6, configured
as a
proxy/firewall for workstations on a specific part of our LAN. The
are mostly Win2k, using IE6 with all latest patches. They have IE
to use BorderManager server as their proxy for all typical services
https, ftp). The clients are using Citrix ICA clients, both full or
clients, to access an several applications hosted by an ASP across the

Internet. There is a stateful filter exception running on the BM
server to
allow TCP traffic from the client workstations out to the Internet on
1494. Access to web sites and ftp sites works as expected, access
rules are
in place to allow most application proxy traffic out as necessary. The

problem occurs when the client workstations attempt to access the
Citrix applications using ICA clients above version 6.31 and above.
workstation using ICA clients prior to 6.3 are able to successfully
without any problems. The process for accessing the published
is: Using IE, the user goes to the ASP's URL and performs a secure
using SSL. This always works, ICA not involved yet. The user then
clicks on
an icon for the published application they wish to run. The specific
file for the app is downloaded to the workstation, the user's cached
credentials from the login to website are passed out automatically
back to
the ASP's webserver, and the ICA session is initialized and run. On
older ICA clients, the user is prompted one more time for their
to access the application, and then they are in the app using the ICAclient. On the ver. 6.3 and later ICA clients, it appears that the
credentials are never passed back to the ASP's website to allow the
session to initialize. The connection eventually times out with a
that reads, "Cannot connect to the Metaframe Server. Proxy connectionfailed: The configured proxy server failed to establish a connection."
have examined the .ICA file for the applications, and there is no
server specified that the ICA client is trying to use. Something is
different in how the newer ICA client gets the authentication
handed off to it by Internet Explorer running through BorderManager.
ideas on what is causing this and where to look to resolve it? Any
help is
certainly appreciated. Thanks.

Bruce Pina