Integrating and Troubleshooting Citrix Access Gateway Basic Firewall

Integrating and Troubleshooting Citrix Access Gateway

Basic Firewall and Port Rules External DMZ Internal 53 (UDP) 389/636 (TCP) VIP Remote End User * Port 80 used for https redirect LDAP/ LDAPS IP NS 443, 80* (HTTP/TCP) P NSI SNIP or MIP 80, 8080, 443 (HTTP/TCP) 1494, 2598 (TCP) 443, 80 (TCP/HTTP) 3010, 3008 , 22 (TCP) DNS Xen. App WI STA NS IP AGEE Admin

Smart. Access Workflow External DMZ Internal LDAP 389/636 443 80/443 Remote End User WI makes a XML callback to a 3) Access Gateway next performs passpreconfigured-on-WI AGEE VPN Virtual 1) AGEE does a HTTP redirect to the Web Interface Authenticates credentials User accesses AGEE VPN Virtual through SSO to Web Interface via a Web Interface “Smart Access” Server URL generates withinthe previously provided website configured ‘-homepage’ provided via custom SSO AGCitrix. Basic Access Gateway passes Server User supplies credentials to credentials logon page. to custom AGCitrix. Basic HTTP Header application set page andthe sends the web Session. Token to get EPA Results Post-Auth. N AGEE Session policy EPA option Header Directory Service for validation. page back to user. Session policy EPA check results 4) A Session. Token is also provided checks done with the existing EPA Web Interface sends credentials & EPA AGEE Pre-Auth. N EPA Active. X sends results back to 2) Citrix Web. XML Interface returns 401 and returned to AGEE Active. X results to Service whichavalidates download & client scan AGEE On Pre-Authentication EPA success AGEEuser’s detects that this is a Web them and returns “smart access” AGEE returns login page Interface returns EPA results to WI application. EE set to Webserver. Interface. WI STA and XML Xen. App

Deeper Look at Security Scans – Pre-Auth • Redirect to /epa. html • EPA client sends a GET for /epaq which causes the • Access Gateway to return a 200 OK response with a HTTP header called CSE • If the security scan passes, the very next GET from the client will contain a value of 0 for the CSEC header. If the scan fails, the value will be 3. Example:

Deeper Look Into Smart Access • Client logs in to Access Gateway and is redirected to Web Interface • During this redirection the client sends a request to /auth/agesso. aspx • Web interface denies access and requests credentials. Access Gateway then sends another request to /auth/agesso. aspx but this time with an authentication header • Web Interface then validates the credentials via a POST back to Access Gateway • If that connection succeeds, the Access Gateway then returns a 200 OK containing all the Smart Access information needed by Web Interface. Example: How Did I Do That ? ?

Decrypting a Network Trace • In order to be able to analyze the data on the previous slide I had to run a network trace on the Access Gateway appliance. This can easily be done via GUI: • Or via the command line: • Once the network trace has run it will be placed under /var/nstrace/ *** important: since this is SSL traffic the trace has to start before any request is made *** • Once the trace is downloaded to a workstation that has Wireshark installed, open Wireshark click on Edit and then Preferences. Select SSL under Protocols: • Under RSA Key List you enter: <target IP>, <port>, <protocol>, <path to private key> • Once that is done the traffic will be decrypted and you will be able to analyze it.

What if private key is not available? How to create a HTTP debug virtual server:

What if private key is secured? If the private key was created with a passphrase, it can be decrypted via openssl:

Published Application Launch Process External DMZ Internal Xen. App 1494/2598 443 80/443 Remote End User Web Interface contacts generates Citrix XML ICA Service file that toincludes User clicks application icon. Request is ICA Access Client sends Gateway ICA contacts request to. STA Access to validate ticket and Web Interface contacts STA to exchange Access Gateway contacts Xen. App to initiate ICA session. determine Access least Gateway loaded Xen. App FQDN and STA hosting ticket. ICA sent to Web Interface. Gateway. the ticket for the Xen. App IP address. Xen. App IP exchange address ticket. ICA for session isserver established. application. file is sent XML back Service to client returns device. Xen. App IP address. WI 80/443 STA and XML

Xen. App Integration: Web Interface Site Type Web Interface Access Gateway Xen. App Specify the URL to the Virtual Server’s FQDN Web Interface must be able to resolve the FQDN

Xen. App Integration: Web Interface DMZ Settings Web Interface Access Gateway Xen. App Set the DMZ Access Method to Gateway Direct

Xen. App Integration: Web Interface Gateway Settings Web Interface Access Gateway Xen. App Specify the Access Gateway Virtual Server’s FQDN as the Gateway Server

Xen. App Integration: Web Interface Gateway Settings Web Interface Access Gateway Xen. App Enter the STA server URL address

Xen. App Integration: Session Profile Configuration ICA Proxy ON tells AGEE not to launch the Secure Access Client ICA Proxy ON enables SSO to WI URL to the Web Interface site e. g. HTTP(S): //wiserver/citrix/accessplatform Embedded Web Interface display format Full or Compact Single Sign-On Domain defines the users domain name

Xen. App Integration: Defining STA Server Web Interface Access Gateway Xen. App The STA Server ID and State are monitored by AGEE Multiple STA Servers can be defined for failover

Troubleshooting SSL Related Errors Play Video