Mac Devices Fail to Connect through NetScaler Gateway – Session Reliability

Introduction

When configuring NetScaler Gateway for Citrix DaaS or Citrix Virtual Apps and Desktops (CVAD), administrators may encounter connection issues unique to specific endpoint platforms. Recently, our team worked with a client whose Mac and iPad users experienced a “Failed to Start” error when attempting to connect through the NetScaler Gateway, while Windows users connected successfully. This blog outlines how we identified and resolved the issue, focusing on the role of session reliability policies and Citrix Workspace app logs in the troubleshooting process.

Identifying the Issue

The client’s environment included a significant number of remote users on Mac laptops and iPads connecting to an on-premises Citrix DaaS environment. During testing, users on these devices were unable to start sessions, encountering a “Failed to Start” message as seen in the image below. Windows endpoints worked without issue.

To begin troubleshooting, we collected logs from the Citrix Workspace app (CWA) and examined the CitrixViewer_Date_and_time.txt log file. Near the end of this file, we searched for CGP (Common Gateway Protocol) entries, as shown in the image below, and found multiple highlighted errors indicating that session reliability was the cause.

Session reliability was ultimately identified as the issue. A site-wide policy had disabled session reliability for all users and computers in the site, which affected the newly built Citrix environment. While this configuration works for Windows devices, Mac and iPad clients are more sensitive to this setting and may fail to start sessions when session reliability is disabled.

The fix was straightforward: update the Citrix policy to ensure that session reliability remains enabled for delivery groups serving Mac and iPad users. Once applied, the affected devices were able to connect successfully.

Lessons Learned

Although this was a simple fix, it demonstrated how easily a site-wide policy can impact device-specific behavior. A configuration that works fine for Windows endpoints may prevent sessions from launching on Mac or iPad devices.

When troubleshooting “Failed to Start” errors, always check the CitrixViewer logs for CGP errors before focusing on certificates or network configuration. In this case, decryption errors in the log initially pointed toward a certificate problem, but the root cause was a session reliability policy.

By confirming session reliability settings early in the process, administrators can avoid unnecessary troubleshooting and ensure consistent access across all platforms.