Gateway

Configuring Citrix Gateway

January 8, 2024

Contributed by:

C S C

Citrix ADC with Citrix Gateway: One URL

Citrix ADC with Citrix Gateway enables simplified secure access to any application through a single URL for desktop and mobile users. Behind this single URL, administrators have a single point for configuration, security, and control of remote access to applications. And remote users have an improved experience with seamless single sign-on to all the applications they need along with login/logout once ease of use.

To accomplish this, Citrix ADC with Gateway, along with Citrix ADC’s Content Switching capacities and extensive authentication infrastructure, provides access to organizational sites and apps through this single URL. Additionally, remote users can use iOS or Android mobile devices and Linux, PC or Mac systems with the Citrix Gateway client plug-ins for uniform access to the Citrix Gateway URL, wherever they may be.

A Citrix Gateway deployment allows single URL access to the following categories of applications:

Intranet applications.
Clientless applications
Software as a Service applications
Preconfigured applications served by Citrix ADC
Citrix Virtual Apps and Desktops published applications

Intranet applications may be any web-based application that resides inside the secure enterprise network. These are internal resources such as an organizational intranet site, a bug tracking application, or a wiki.

Typically also residing inside the secure enterprise network, the clientless applications Citrix Gateway provides single URL access to are Outlook Web Access and SharePoint. These applications provide access to Exchange email and team resources without dedicated client software which need to be available to remote users.

SaaS applications, also commonly know as Cloud Apps, are external, cloud-based applications that organizations depend on such as Sharefile, SalesForce, or NetSuite. SAML based single sign-on is supported with those SaaS applications that offer it.

Some organizations may have preconfigured Citrix ADC served applications deployed in an Citrix ADC ADC load balanced configuration; often times this is also referred as a ‘reverse-proxy’ application. Citrix Gateway supports these applications when a virtual server for the deployment resides on the same Citrix ADC Citrix Gateway instance or appliance. These applications may have their own authentication configuration which is independent of that for the Citrix Gateway configuration.

Any published Citrix Virtual Apps and Desktops published applications can be made available through a Citrix Gateway URL. SmartAccess and SmartControl policies can optionally be applied to granular policy and access control to these resources.

The Citrix Gateway Configuration Wizard

The recommended method to configuring a Citrix ADC with Citrix Gateway deployment is to use the Citrix Gateway configuration wizard. The wizard walks you through configuration and creates all the necessary virtual servers, policies, and expressions, and applies settings based on the details provided. After initial setup, the wizard can be used to manage your deployment and monitor its operation.

Note The Citrix Gateway configuration wizard does not perform an initial systems configuration. Your Citrix Gateway appliance or VPX instance must have basic installation completed before configuring Citrix Gateway. Refer to the installation instructions for Configuring Citrix Gateway with the First-time Setup Wizard to complete basic configuration.

The Citrix Gateway elements configured by the wizard are:

The Citrix Gateway primary virtual server
An SSL Server Certificate for the Citrix Gateway virtual server
A primary and any optional secondary authentication configuration
A portal theme selection and optional customization
The user applications that are to be accessed through the Citrix Gateway portal

For each of these elements, you need to provide configuration information. For a basic Citrix Gateway deployment, the following information is needed.

For the primary Citrix Gateway virtual server, the public IP address and IP port number for the deployment. This will be the IP address that resolves in DNS to the Citrix Gateway URL’s hostname. For example, if your Citrix Gateway deployment’s URL is https://mycompany.com/, the IP address must to resolve to mycompany.com.

The signed SSL Server Certificate for the deployment. Citrix Gateway supports PEM or PFX formatted certificates.

Primary authentication server information. The authentication systems supported for this authentication configuration are LDAP/Active Directory, RADIUS, and Certificate based. A secondary LDAP or RADIUS authentication configuration may be created as well. The authentication server IP address(es) must be provided along with any relevant administrator credentials or directory attributes. For Certificate authentication, the device certificate attributes and a CA certificate must be provided.

A portal theme may be selected. If a customized or branded portal design is desired, custom graphics may be uploaded to the system with the wizard.

For web-based user applications, the URLs for the individual applications must be specified. For web applications that are to utilize SAML single sign-on authentication, the utility collects the Assertion Consumer Service URL along with other optional SAML parameters. Gather the configuration details in advance for the applications that use a SAML authentication system.

For Citrix Virtual Apps and Desktops published resources to be made available through the Citrix Gateway deployment, you need to specify the integration point (StoreFront, the Web Interface, or Web Interface on Citrix ADC). The utility requires the integration point’s fully qualified domain name, the site path, the single sign-on domain, the Secure Ticket Authority (STA) server URL, and others depending on the type of integration point.

Additional Configuration Management

For site specific settings not available in the Citrix Gateway configuration utility, such as alternative SSL settings or session policies, you can manage the needed settings in the Citrix Gateway configuration utility. You can modify these settings on the Content Switching or VPN virtual servers once they are created by the Citrix Gateway configuration utility.

Content Switching Virtual Server

This is the Citrix ADC configuration entity behind the deployment’s main IP address and URL. The SSL Server Certificates and parameters are managed on this virtual server. As this virtual server is the responding network host for the deployment, the ICMP server response and RHI state can be modified on this virtual server, if necessary. The Content Switching virtual server can be found under the Configuration tab at Traffic Management > Content Switching > Virtual Servers.

VPN Virtual Server

All of the other VPN parameters, profiles, and policy bindings for the Citrix Gateway configuration are managed on this virtual server, including the main authentication configuration. This entity is managed under the Configuration tab at Citrix Gateway > Virtual Servers. The relevant VPN virtual server’s name will include the name given to the Content Switching virtual server during initial Citrix Gateway configuration.

Note The VPN virtual servers created for a Citrix Gateway deployment are non-addressable and assigned the 0.0.0.0 IP address.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Configuring Citrix Gateway

January 8, 2024

Contributed by:

C S C

January 8, 2024

Contributed by:

C S C

Configuring Citrix Gateway

Citrix ADC with Citrix Gateway: One URL

The Citrix Gateway Configuration Wizard

Additional Configuration Management

Content Switching Virtual Server

VPN Virtual Server

In this article