Citrix Secure Access client for Linux

Citrix Secure Access client for Linux is a VPN client software managed by NetScaler Gateway that enables users to access corporate data and applications remotely. Citrix Secure Access client protects applications from unauthorized access, application-level threats, and browser-based attacks.

Citrix End Point Analysis (EPA) client is a client software managed by NetScaler Gateway. It checks the endpoint criteria before granting access to corporate data through NetScaler Gateway. The Citrix EPA client and Citrix Secure Access client are independent from each other.

Note:

Even if you do not use EPA, we recommend that you update both EPA and VPN plug-in binaries together in case you choose to use the EPA functionality later.

Supported Linux versions

Citrix Secure Access client and Citrix EPA client are compatible with Ubuntu 18.04, Ubuntu 20.04, and Ubuntu 22.04 versions. For more information about the supported browsers, see Client Software Requirements.

Note:

For Ubuntu 22.04 to work with Citrix Secure Access client and Citrix EPA client, enable TLS 1.3 on the VPN virtual server. If you have enabled only TLS 1.2, then set the SSL parameter denySSLReneg to NONSECURE on the CLI.

Supported features

Citrix Secure Access client for Ubuntu supports the following features:

• Split tunneling and reverse split tunneling
• Tunneling TCP, UDP, and ICMP applications
• Server-initiated connections via Intranet IP (IIP)
• Split DNS remote
• Client side proxy
• Classic EPA scans
• Advanced authentication (nFactor) including advanced EPA scans
• HTTPOnly cookies
• Global server load balancing (GSLB)

Note:

Split DNS BOTH is not supported with Citrix Secure Access client for Ubuntu.

Upgrade Ubuntu clients on NetScaler Gateway

You can download the Citrix Secure Access client and Citrix EPA client for Ubuntu from the Downloads page.

The Citrix Secure Access client and Citrix EPA client are named “nsgclient18_64.deb” and “nsepa18.deb”, respectively. The clients are compatible with both Ubuntu 18.04 and 20.04.

The Citrix Secure Access client and Citrix EPA client that support Ubuntu 22.04 are named “nsginstaller64.deb” and “nsepa.deb”, respectively.

If you want to upgrade to the latest version of Citrix Secure Access client from version 1.0.0.x to version 23.6.1, for example:

1. Replace the files “nsgclient18_64.deb” and “nsginstaller64.deb” at the location /var/netscaler/gui/vpn/scripts/linux/ by using the shell prompt.

2. Replace the files “nsepa18.deb” and “nsepa.deb” at the location /var/netscaler/gui/epa/scripts/linux/ by using the shell prompt.

3. Open the /var/netscaler/gui/vpn/scripts/linux/clientversions.xml file.

   1. For the Citrix EPA client, replace the current version (1.0.0.x) in the following XML tags with the latest version (23.6.1). If the XML tags do not exist, add them to the XML file. For example,

      replace

      <component pkgname="nsepa18" currentversion="1.0.0.x" minversion="1.0.0.x" ostype="ubuntu64" minkernelversion="0" maxkernelversion="100" updatetype="compatible" action="/epa/scripts/linux/nsepa18.deb" />

      with

      <component pkgname="nsepa18" currentversion="23.6.1" minversion="23.6.1" ostype="ubuntu64" minkernelversion="0" maxkernelversion="100" updatetype="compatible" action="/epa/scripts/linux/nsepa18.deb" />

      and replace

      <component pkgname="nsepa22" currentversion="1.0.0.x" minversion="1.0.0.x" ostype="ubuntu64" minkernelversion="0" maxkernelversion="100" updatetype="compatible" action="/epa/scripts/linux/nsepa.deb" />

      with

      <component pkgname="nsepa22" currentversion="23.6.1" minversion="23.6.1" ostype="ubuntu64" minkernelversion="0" maxkernelversion="100" updatetype="compatible" action="/epa/scripts/linux/nsepa.deb" />

   2. For the Citrix Secure Access client, replace the current version (1.0.0.x) in the following XML tags with the latest version (23.6.1). If the XML tags do not exist, add them to the XML file. For example,

      replace

      <component pkgname="nsgclient18" currentversion="1.0.0.x" minversion="1.0.0.x" ostype="ubuntu64" minkernelversion="3.0" maxkernelversion="5.16" updatetype="compatible" action="/vpn/scripts/linux/nsgclient18_64.deb" />

      to

      <component pkgname="nsgclient18" currentversion="23.6.1" minversion="23.6.1" ostype="ubuntu64" minkernelversion="3.0" maxkernelversion="5.16" updatetype="compatible" action="/vpn/scripts/linux/nsgclient18_64.deb" />

      and

      <component pkgname="nsgclient22" currentversion="1.0.0.x" minversion="1.0.0.x" ostype="ubuntu64" minkernelversion="3.0" maxkernelversion="5.20" updatetype="compatible" action="/vpn/scripts/linux/nsginstaller64.deb" />

      to

      <component pkgname="nsgclient22" currentversion="23.6.1" minversion="23.6.1" ostype="ubuntu64" minkernelversion="3.0" maxkernelversion="5.20" updatetype="compatible" action="/vpn/scripts/linux/nsginstaller64.deb" />

4. On the NetScaler shell prompt, run the following commands:

   rm -rf /netscaler/ns_gui
   ln -s /var/netscaler/gui /netscaler/ns_gui
   

5. On the NetScaler CLI, run the following commands:

   set vpn parameter -clientversions all
   flush cache contentgroup loginstaticobjects
   

References

• NetScaler Gateway VPN clients and supported features
• Endpoint Analysis scans supported for Ubuntu
• End-user help documentation