Citrix SD-WAN WANOP

Configure Citrix SD-WAN WANOP plug-in with Access Gateway VPNs

March 12, 2021

Contributed by:

S C

The Access Gateway Standard Edition VPN supports Citrix SD-WAN WANOP Plug-in acceleration, provided that a Citrix SD-WAN WANOP appliance is deployed with the Access Gateway appliance and the Access Gateway appliance is configured to support it.

For Citrix SD-WAN WANOP Plug-in support with other VPNs, see your VPN documentation or contact your Citrix representative.

To configure Citrix SD-WAN WANOP support, use the Access Gateway administration tool, as follows:

On the Global Cluster Policies page, under Advanced Options, select the Enable TCP optimization with Citrix SD-WAN WANOP Plug-in check box.
Make sure that the IP addresses used by the Citrix SD-WAN WANOP (redirector IP and management IP) have access enabled in the Network Resources section on the Access Policy Manager page.
For each of these addresses, enable all protocols (TCP, UDP, ICMP) and enable Preserve TCP Options.
Make sure that these same addresses are included under User Groups: Default: Network Policies on the Access Policy Manager page.

VPN support options

VPN support is simply a matter of putting the appliance on the LAN side of the VPN, as shown in the following figure. This placement ensures that the appliance receives and transmits the decapsulated, decrypted, plain-text version of the link traffic, allowing compression and application acceleration to work. (Application acceleration and compression have no effect on encrypted traffic. However, TCP protocol acceleration works on encrypted traffic.)

VPN Cabling for an Inline VPN

localized image

The following figure shows one option for accelerating one-arm VPNs. The appliance is on the server side of the VPN. All VPN traffic with a local destination is accelerated. VPN traffic with a remote destination is not accelerated. Non-VPN traffic can also be accelerated.

One-Arm VPN Acceleration, Option A

localized image

The following figure shows another option for accelerating one-arm VPNs. The appliance is on the server side of the VPN. All VPN traffic with a local destination is accelerated. VPN traffic with a remote destination is not accelerated. Non-VPN traffic can also be accelerated.

One-Arm VPN Acceleration, Option B

localized image

Important

For acceleration to be effective, the VPN must preserve TCP header options. Most VPNs do so.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Configure Citrix SD-WAN WANOP plug-in with Access Gateway VPNs

March 12, 2021

Contributed by:

S C

March 12, 2021

Contributed by:

S C

Configure Citrix SD-WAN WANOP plug-in with Access Gateway VPNs

VPN support options

In this article