-
Install and configure the NetScaler Gateway appliance
-
Maintain and monitor NetScaler Gateway systems
-
Configure DTLS VPN virtual server using SSL VPN virtual server
-
Integrate NetScaler Gateway with Citrix products
-
Integrate NetScaler Gateway with Citrix Virtual Apps and Desktops
-
Configure settings for your Citrix Endpoint Management Environment
-
Configure load balancing servers for Citrix Endpoint Management
-
Configure load balancing servers for Microsoft Exchange with Email Security Filtering
-
Configure Citrix Endpoint Management NetScaler Connector (XNC) ActiveSync Filtering
-
Allow Access from mobile devices with Citrix Mobile Productivity Apps
-
Configure domain and security token authentication for Citrix Endpoint Management
-
Configure client certificate or client certificate and domain authentication
-
-
NetScaler Gateway Enabled PCoIP Proxy Support for VMware Horizon View
-
Proxy Auto Configuration for Outbound Proxy support for NetScaler Gateway
This content has been machine translated dynamically.
Dieser Inhalt ist eine maschinelle Übersetzung, die dynamisch erstellt wurde. (Haftungsausschluss)
Cet article a été traduit automatiquement de manière dynamique. (Clause de non responsabilité)
Este artículo lo ha traducido una máquina de forma dinámica. (Aviso legal)
此内容已经过机器动态翻译。 放弃
このコンテンツは動的に機械翻訳されています。免責事項
이 콘텐츠는 동적으로 기계 번역되었습니다. 책임 부인
Este texto foi traduzido automaticamente. (Aviso legal)
Questo contenuto è stato tradotto dinamicamente con traduzione automatica.(Esclusione di responsabilità))
This article has been machine translated.
Dieser Artikel wurde maschinell übersetzt. (Haftungsausschluss)
Ce article a été traduit automatiquement. (Clause de non responsabilité)
Este artículo ha sido traducido automáticamente. (Aviso legal)
この記事は機械翻訳されています.免責事項
이 기사는 기계 번역되었습니다.책임 부인
Este artigo foi traduzido automaticamente.(Aviso legal)
这篇文章已经过机器翻译.放弃
Questo articolo è stato tradotto automaticamente.(Esclusione di responsabilità))
Translation failed!
Configure DTLS VPN virtual server using SSL VPN virtual server
You can configure a DTLS VPN virtual server for NetScaler Gateway using the same IP address and port number of a configured SSL VPN virtual server. Configuring DTLS VPN virtual servers enables you to bind the advanced DTLS ciphers and certificates to the DTLS traffic for an enhanced security.
Important:
By default, the DTLS functionality is set to ON for the existing SSL VPN virtual server. Disable the functionality for the server before creating the DTLS VPN virtual server.
SNI for DTLS gateway virtual server is supported in NetScaler Gateway release 13.0 build 64.x and later.
Starting from NetScaler release 13.0 build 79.x, the
helloverifyrequest
parameter is enabled by default. Enabling thehelloverifyrequest
parameter on the DTLS profile helps mitigate the risk of an attacker or bots overwhelming the network throughput, potentially leading to outbound bandwidth exhaustion. That is, it helps mitigate the DTLS DDoS amplification attack. For details about thehelloverifyrequest
parameter, see DTLS profile.When handling the UDP traffic, the NetScaler appliance memory consumption increases if the back-end servers push a lot of traffic. As a result, the NetScaler appliance cannot push this traffic to the client because of the TCP MUX connection on the client side. In such cases, Citrix recommends that you use the DTLS protocol.
Points to note
-
DTLS VPN virtual server on a NetScaler Gateway appliance can be configured from release 13.0 build 58.x.
-
Before you configure a DTLS VPN virtual server on a NetScaler Gateway appliance, you must have configured an SSL VPN virtual server on the appliance.
-
The DTLS VPN virtual server uses the IP address and the port number of the configured SSL VPN virtual server.
-
If the DTLS handshake fails, the connection falls back to TLS.
-
To use DTLS only, you can disable TLS by binding only the DTLS ciphers to the DTLS traffic.
-
DTLS multiplexing is not supported when TCP traffic is tunneled over VPN.
Configure a DTLS VPN virtual server by using the GUI
- On the Configuration tab, navigate to NetScaler Gateway > Virtual Servers.
- On the NetScaler Gateway Virtual Servers page, select the existing SSL VPN virtual server and click Edit.
- On the VPN Virtual Server page, click the edit icon and clear the DTLS checkbox and click OK.
- Navigate back to NetScaler Gateway > Virtual Servers and click Add.
-
Under Basic Settings, enter the values for the following fields and Click OK.
- Name - A name for the DTLS VPN virtual server
- Protocol - Select DTLS
- IP Address – Enter the SSL VPN virtual server IP address
- Port – Enter the SSL VPN virtual server port number
- On the NetScaler Gateway Virtual Servers page, select the virtual server that you added previously and click Edit.
- Under Certificates, click the arrow icon to select the required cert key.
- In the Server Certificate Binding > Select Server Certificate, select an existing SSL cert key or create one.
- Click Bind on the Server Certificate Binding page.
Note:
- To use DTLS 1.2, click the edit icon under SSL Parameters and select the DTLS 1.2 checkbox.
- Server name indication (SNI) is supported for VPN virtual server of type DTLS.
Configure a DTLS VPN virtual server by using the CLI
At the command prompt, type the following set of commands:
set vpn vserver <ssl vpnvserver name> -dtls off
add vpn vserver <dtls vpnvserver name> dtls <ssl vpn vserver IP> <ssl vpn vserver port>
bind ssl vservser <dtls vpnvserver name> -certkeyName <existing ssl cert key or newly created cert key>
<!--NeedCopy-->
DTLS 1.0 works as usual, to use DTLS 1.2, type the following command:
set ssl vserver < dtls vpnvserver name > -dtls12 ENABLED
<!--NeedCopy-->
Example
set vpn vserver vpnvserver -dtls off
add vpn vserver vpnvserver_dtls dtls 10.108.45.220 443
bind ssl vservser vpnvserver_dtls -certkeyName sslcertkey
set ssl vserver vpnvserver_dtls -dtls12 ENABLED
<!--NeedCopy-->
To enable SNI for the DTLS type VPN virtual server, type the following command:
set ssl vserver <vServerName>@ [-SNIEnable ( ENABLED | DISABLED )
bind ssl vservser <dtls vpnvserver name> -certkeyName <existing ssl cert key or newly created cert key> <-SNICert>
<!--NeedCopy-->
Example
set ssl vserver _XD_10.106.40.225_443_DTLS -sniEnable eNABLED
bind ssl vserver _XD_10.106.40.225_443_DTLS -certkeyName "Insight/*.insight.net.cer_CERT_" -snICert
<!--NeedCopy-->
Supported DTLS VPN virtual server parameters
Only the following parameters are supported for the VPN virtual server of type DTLS.
- Ipaddress
- Port
- State
- Double hop
- downstateflush
- Comment
- Appflowlog
- Icmpvsrresponse
Unsupported DTLS VPN virtual server parameters
The following parameters are not supported for the VPN virtual server of type DTLS.
- LinuxEPAPluginUpgrade
- WindowsEPAPluginUpgrade
- maxAAAUsers
- icaProxySessionMigration
- loginOnce
- cginfraHomePageRedirect
- logoutOnSmartcardRemoval
- l2Conn
- MacEPAPluginUpgradeRHIstate
- icaOnly
- maxLoginAttempts
- failedLoginTimeout
- vserverFqdn
- deviceCert
- rdpServerProfileName
- pcoipVserverProfileName
- tcpProfileName
- netProfile
- authnProfile
- Listenpriority
- Listenpolicy
- ipset
- certkeyNames
Configure a DTLS virtual server using the XenApp and XenDesktop wizard
-
Click XenApp and XenDesktop under Integrate with Citrix Products.
-
On the XenApp and XenDesktop setup wizard, select StoreFront and click Continue.
-
On the NetScaler Gateway Settings page, enable the Configure a DTLS Listener for this VPN VServer checkbox and click Continue.
The DTLS Listener is now configured.
-
In Server Certificate, click Choose File to select server certificate and click Continue.
-
Specify the certificate file and Key file name and click Continue.
-
Under the StoreFront section, provide the values for the required parameters as follows and click Continue.
-
Under the Authentication section, provide the values for the required parameters as follows and click Test Connection.
Ensure that the server is reachable, provide Time out value and Server Logon Name Attribute, and click Continue.
-
Click Done to complete the configuration.
Limitations
- DTLS 1.2 is supported on Windows clients only.
- VPN virtual server with DTLS does not support IPv6 addresses.
- SSL policy and SSL profile are not supported on a DTLS VPN virtual server. Also, the binding of VPN virtual server policy is not supported.
- The NetScaler Gateway DTLS VPN virtual server does not support the following features. However, the NetScaler Gateway SSL VPN virtual server supports these features:
- Unified Gateway with content switching virtual server
- UDP MUX
- UDP Video
- UDP Audio
- PCOIP
- The
stat vpn vserver
command related to the statistics for the DTLS VPN virtual server is not supported. - HSM keys are not supported with the DTLS virtual server.
- Cluster configuration is not supported.
Share
Share
This Preview product documentation is Cloud Software Group Confidential.
You agree to hold this documentation confidential pursuant to the terms of your Cloud Software Group Beta/Tech Preview Agreement.
The development, release and timing of any features or functionality described in the Preview documentation remains at our sole discretion and are subject to change without notice or consultation.
The documentation is for informational purposes only and is not a commitment, promise or legal obligation to deliver any material, code or functionality and should not be relied upon in making Cloud Software Group product purchase decisions.
If you do not agree, select I DO NOT AGREE to exit.