Citrix Imaging for VDI causing ATM routing issues for pre-installed WSS agent.

Products

• Cloud Secure Web Gateway - Cloud SWG

Issue/Introduction

In a typical Citrix VDI environment, administrator would use the Citrix VDI imaging process to prepare a master VM image with the OS, apps and etc. This master image is then used to deploy multiple VMs. 

 

Cause

We have discovered that the WSS agent ATM routing decisions being impacted on the deployed VMs if the master image have been prepared from the Citrix VDI imaging process.

This issue stems from the fact that internal files are being altered by the imaging process causing routing information sent by Cloud SWG to not saved properly on the client. 

In this case the ATM policy was reviewed and found to be valid thus suggesting the issue is on the imaging process.

Resolution

Any imaging process should NEVER touch the following directories and registry keys. These directory should only be changed by WSS Agent.

• C:\ProgramData\Symantec WSS Agent
• \\HKLM\Software\Symantec\WSS Agent

The workaround is to install the agent after VDI have been deployed thus avoiding the imaging process altogether. 

Applying the above workaround would confirm if Cloud SWG configuration had issues. It is advisable to open a case with support to confirm if Cloud SWG configuration is not contributing to the symptom of this issue.