Citrix Access Gateway AG2010

Basic Device Configuration and overview.

1.       Use a console cable and configure device with username, password ,  IP , Subnet Mask and Gateway.

2.       To manage the device use the following to access the gateway admin page.

a.       https://deviceipaddress/lp/adminlogonpoint

b.      Screen Capture of an initial admin page.

  

3.       Define a Host name and access gateway properties.

a.       Host name must be fully qualified name such as citrixgatway.domain.com.

b.      Click on Management tab -> Networking -> place a check on the following options.

                                                               i.      Allow ICMP requests – thru the gateway

                                                             ii.      Enable support access- for ssh access

                                                            iii.      Redirect HTTP to HTTPS

                                                           iv.      Make sure to CLICK ON SAVE after completing the tasks.

 
4.       Define Static routes to all the networks on LAN with resources.

a.       Click on Management -> Static Routes -> Click on New to add Subnets or Hosts make sure to use the correct gateway. Make sure to CLICK ON SAVE after completing the tasks.

    

5.       Define Date, Time and NTP server Setting

·         Click on Management -> Under System Administration Click on Data and Time Make sure to CLICK ON SAVE after completing the tasks.

6.       Add License information

a.       You must add a Platform and Universal user license to the gateway.

                                                               i.      Download the license files from the Citrix and upload them to the gateway by clicking on UPLOAD button , after uploading licenses should show up in Access Gateway License information box.

                   

 
Access Control:  Global Configuration

                    Configure the following appliance global configuration

·         Access Gateway Setting : Place a check on the following

o   Allow earlier versions of access gateway plug-in

o   Audit ICA connection

·         Client Options

o   Enable Split Tunneling

o   Authenticate after network interruption

o   Authenticate after system resume

o   Enable split DNS

o   Single sign-on with windows

·         Time-out Options

o   Default is 30 min for user, network and session. Adjust these option as needed.

·         Citrix Receiver options

o   Default is 100 seconds for Ticket time duration.

·         Make sure to CLICK ON SAVE after completing the above tasks.

Configure SSL VPN

Step 1. Define Authentication profile using Active Directory.

1.       Click on Management -> Under Access control section click on Authentication Profiles -> Click on down arrow next to Add button and select LDAP.

a.      

2.       General Properties

a.       Profile name – any name

b.      Single sign-on domain =  user netbios domain name only

c.       Server type – IP address of Domain controllers and LDAP port default is TCP/389

3.       BIND Properties

a.       Administrator DN : complete path to Service account

                                                                           i.      Example : CN=user,OU=users,DC=domainname,DC=com

b.      Password

4.       LDAP Authentication

a.       Base DN

                                                                           i.      Example -   DC=domainname,DC=com

b.      User Search query

                                                                           i.      (objectClass=user)

c.       Server Logon Name Attribute

                                                                           i.      sAMAccountName

5.       LDAP Authorization

a.       Search Scope

                                                                           i.      Click on down arrow and Specify base DN

b.      Search time-out – leave default 30 seconds

c.       Group Base DN : Define a complete path to Group that is authorized to use the resources.

                                                                           i.      Example : CN=group,OU=users,DC=domainname,DC=com

d.      Group Search Filter

                                                                           i.      (objectClass=group)

e.      Group member attribute

                                                                           i.      Member

6.       Make sure to CLICK ON SAVE after completing the above tasks.

Step 2. Configure Network Resources for VPN users to access.

o   General Properties

a.       Name – Lab-vpn_resources

                                                               i.      Place a check on log access

b.      Enable protocols

                                                               i.      Place a check on TCP, UDP and ICMP

c.       Ports or port range

                                                               i.      Click on ALL to add 1-65535

d.      Network List

                                                               i.      Click on New and type the subnet information

1.       Note : make sure Subnet define in network list is reachable from the Access gateway.

o   Make sure to CLICK ON SAVE after completing the above tasks.

 

 Step 3 . Define Address Pool for SSL VPN Clients.

1.       Click on Address pool under System administration section -> Click NEW and enter the info for new pool.

a.       Name – any name

b.      Start address

                                                               i.      Example : 10.10.100.5

c.       Number of IP addresses

                                                               i.      Example : 50 , VPN pool ip address will be 10.10.100.5-55

d.      Default Gateway

                                                               i.      It should be the internal gateway

Step 4 . Define Logon Point Properties.

o   Under Access control  section select Logon Points -> Click NEW

a.       Logon Point Properties :

                                                               i.      Name – any name I used LABVPN in my sample configuration,

1.       Note : Remote users will have to type in the following https://hostname.domain.com/lp/labvpn to access the VPN gateway.

                                                             ii.      Type- Smart Access

                                                            iii.      Authentication Profiles  - for AD authentication

1.       ADProfile-LAB – Created earlier in Step 1.

                                                           iv.      Authorization Profiles – for AD Groups

1.       ADProfile-LAB – Created earlier in Step 1.

                                                             v.     

o   Make sure to CLICK ON SAVE after completing the above tasks.

Step 5 . Configure SmartGroups.

1.       General Information.

a.       Name – any name I used  SGLABVPN.

2.       Group Criteria.

a.       Logon points.

                                                               i.      Place a check on LABVPN,  created in Step 4.

b.      Group Membership.

                                                               i.      Click on new and type a name of an AD group authorized to access.

3.       Group Settings.

a.       Network Resources.

                                                               i.      Select LAB-VPN_Resources,  created in Step 2.

b.      Address Pool

                                                               i.      Select LAB-VPNPOOL ,  created in Step 3.

4.       Make sure to CLICK ON SAVE after completing the above tasks.

Creating Multiple VPN Logon Points.

Scenario : All the users in AD Group  name SSLVPNUSERS are only allowed to access  192.168.1.0/24 network .

Step 1. Define Authentication profile using Active Directory

o   Under LDAP authorization tab -> Group Base DN -> CN= SSLVPNUSERS

Step 2. Configure Network Resources for VPN users to access

o   Click on new and type the information as shown below.

 

Step 3 . Define Address Pool for SSL VPN Clients

o Define a new pool or you can use an existing pool. Make sure that new IP pool addresses are reachable from the resources configured in step-2.

Step 4 . Define Logon Point Properties