Product Documentation
Gateway
Current Release 13.1 13.0 12.1
View PDF

Set up NetScaler Gateway for using micro VPN with Microsoft Endpoint Manager

October 8, 2024
Contributed by: 
C C H

Citrix micro VPN integration with Microsoft Endpoint Management enables your apps to access on-premises resources. For details see, Citrix micro VPN integration with Microsoft Endpoint Manager.

System requirements

  • NetScaler Gateway versions
    • 13.1
    • 13.0
    • 12.1.50.x or later
    • 12.0.59.x or later

    You can download the latest version of NetScaler Gateway from the NetScaler Gateway download page.

  • A Windows desktop running Windows 7 or later (for Android app wrapping only)

  • Microsoft
    • Microsoft Entra ID access (with Tenant Admin privileges)
    • Intune-enabled tenant
  • Firewall rules
    • Enable a firewall rule to SSL traffic from a NetScaler Gateway subnet IP to *.manage.microsoft.com, https://login.microsoftonline.com, and https://graph.microsoft.com (port 443)
    • NetScaler Gateway must be able to externally resolve the preceding URLs.

Prerequisites

  • Intune environment: If you don’t have an Intune environment, set up one. For instructions see the Get started with Microsoft Intune page.

  • Edge Browser App: The Micro VPN SDK is integrated within the Microsoft Edge app and Intune Managed Browser app for iOS and Android. For more information about the Managed Browser, see the Manage Microsoft Edge on iOS and Android with Intune page.

  • Citrix Endpoint Management entitlement: Ensure to have an active Citrix Endpoint Management entitlement for continued support to the micro VPN SDK on a Microsoft Edge mobile browser (iOS and Android). For more information, contact your Sales, Account, or Partner representative.

Grant Microsoft Entra ID application permissions

  1. Consent to Citrix multitenant integration with the Microsoft Entra ID application to allow NetScaler Gateway to authenticate with the Microsoft Entra domain. The Azure Global Administrator must visit the following URL and consent:

    https://login.windows.net/common/adminconsent?client_id=b6a53a76-5d50-499e-beb3-c8dbdad5c40b&redirect_uri=https://www.citrix.com&state=consent.

  2. Consent to Citrix multitenant integration with the Microsoft Entra ID application to allow mobile applications to authenticate with the NetScaler Gateway micro VPN. This link is only required if the Azure Global Admin has changed the default value for Users can register applications from Yes to No. This setting can be found in the Azure portal under Microsoft Entra ID > Users > User Settings. The Azure global administrator must visit the following URL and consent (add your Tenant ID) https://login.microsoftonline.com/[tenant_id]/adminconsent?client_id=9215b80e-186b-43a1-8aed-9902264a5af7.

Configure NetScaler Gateway for micro VPN

To use micro VPN with Intune, you must configure NetScaler Gateway to authenticate to Microsoft Entra ID.

  1. Download the setup script file from the NetScaler downloads page.

  2. In the script file, update the following values:

    • <NSG_IP>: Virtual IP address to be assigned to the NetScaler Gateway virtual server. This IP address must be reachable from your devices either directly or through a NAT device. You cannot use an existing NetScaler Gateway virtual server.

    • <ENV_NAME>: Display name for NetScaler Gateway virtual server.

    • <SERVER_CERT_NAME>: Name of the server certificate that will be bound to the new NetScaler Gateway virtual server.

    • <AAD_CLIENT_SECRET>: Client secret value generated using the NsgCreateSecret.ps1 PowerShell script (included in setup script).

    • <AAD_TENANT_ID>: Microsoft Entra tenant ID of where the customer’s Microsoft Entra ID is stored. You can get it from your Microsoft Entra ID admin console or generate using the NsgCreateSecret.ps1 PowerShell script.

  3. After you replace all the placeholders with real values, run the whole script by running the following command in the CLI:

    /netscaler/nscli -U :<NetScaler Management Username>:<NetScaler Management Password> batch -f "/var/<NsgCreateScriptFileName>"
<!--NeedCopy-->

    Note:

    Ensure that the value Done is returned after you run the script.

  4. An existing NetScaler Gateway virtual server does not work for this use case. Create a NetScaler Gateway virtual server and ensure that the status of the virtual server is UP. For more information, see Create virtual servers.

Validate NetScaler Gateway communication with Microsoft services

  1. Access your new NetScaler Gateway virtual server from the internet using online tools like SSL Checker. This confirms if the server certificate is installed correctly and verifies the connectivity between the internet and the NetScaler Gateway virtual server hosted in your DMZ network.

  2. Open an SSH connection to the NetScaler Gateway using an SSH client, such as PuTTY.

  3. Run the following commands to check the outbound connection from NetScaler Gateway appliance to the Microsoft URLs: https://login.microsoftonline.com, *.manage.microsoft.com, and https://graph.microsoft.com.

    root@netscaler# curl -s -k https://login.microsoftonline.com
root@netscaler# curl -s -k https://graph.windows.net
root@netscaler# curl -s -k https://manage.microsoft.com
<!--NeedCopy-->

  4. Exit the SSH connection and run show oauthAction command in the CLI. The OAuth Status must be COMPLETE. If you see the OAuth Status other than COMPLETE, see the Troubleshooting section.

Configuring Microsoft Edge Browser

  1. Sign in to https://endpoint.microsoft.com/ and then navigate to Intune > Mobile apps.
  2. Publish the Edge App as you normally do and then add an app configuration policy.
  3. Under Manage, click App configuration policies.
  4. Click Add and then enter a name for the policy you want to create. In Device enrollment type, select Managed apps.
  5. Click Associated App.
  6. Select the apps to which you want to apply the policy (Microsoft Edge or Intune managed browser) and then click OK.
  7. Click Configuration Settings.
  8. In the Name field, enter the name of one of the policies listed in the following table.
  9. In the Value field, enter the value you want to apply for that policy. Click off the field to add the policy to the list. You can add multiple policies.
  10. Click OK and then click Add.

The policy is added to your list of policies.

Name (iOS/Android) Value Description
MvpnGatewayAddress https://external.companyname.com External URL of your NetScaler Gateway
MvpnNetworkAccess MvpnNetworkAccessTunneledWebSSOor Unrestricted MvpnNetworkAccessTunneledWebSSO is the default for tunneling
MvpnExcludeDomains Comma-separated list of domain name to be excluded Optional. Default=blank
TunnelExcludeDomains Use this client property to override the default list of domains excluded. Default=app.launchdarkly.com,cis.citrix.com,cis-staging.citrix.com,cis-test.citrix.com,clientstream.launchdarkly.com,crashlytics.com,events.launchdarkly.com,fabric.io,firehose.launchdarkly.com, hockeyapp.net,mobile.launchdarkly.com,pushreg.xm.citrix.com,rttf.citrix.com,rttf-staging.citrix.com,rttf-test.citrix.com,ssl.google-analytics.com,stream.launchdarkly.com  

Note:

Web SSO is the name for Secure Browse in the settings. The behavior is the same.

  • MvpnNetworkAccess - MvpnNetworkAccessTunneledWebSSO enables HTTP/HTTPS redirection through the NetScaler Gateway, also known as Tunneled-Web SSO. The gateway responds to HTTP authentication challenges inline, providing a single-sign-on (SSO) experience. To use Web SSO, set this policy to MvpnNetworkAccessTunneledWebSSO. Full tunnel redirection is not supported. Use Unrestricted to leave micro VPN tunneling off.

  • MvpnExcludeDomains - Comma-separated list of host or domain names to be excluded from being routed through the NetScaler Gateway reverse web proxy. The host or domain names are excluded even though the NetScaler Gateway configured split DNS settings might otherwise select the domain or host.

    Note:

    • This policy is only enforced for MvpnNetworkAccessTunneledWebSSO connections. If MvpnNetworkAccess is Unrestricted, this policy is ignored.

    • This policy applies only to the Tunneled-Web SSO mode with NetScaler Gateway configured for reverse split tunneling.

  • TunnelExcludeDomains - By default, MDX excludes some service endpoints from micro VPN tunneling. The mobile app SDKs and the apps use these service endpoints for various features. For example, the service endpoints include services that do not require routing through enterprise networks, such as Google Analytics, Citrix Cloud services, and Active Directory services. Use this client property to override the default list of excluded domains.

    To configure this global client policy, on the Microsoft Endpoint Management console, navigate to Settings > Client Properties, add the custom key TUNNEL_EXCLUDE_DOMAINS, and set the value.

    Value: To replace the default list with the domains that you want to exclude from tunneling, type a list of domain suffixes separated by commas. To include all domains in tunneling, type none. The default list is:

    app.launchdarkly.com,cis.citrix.com,cis-staging.citrix.com,cis-test.citrix.com,clientstream.launchdarkly.com,crashlytics.com,events.launchdarkly.com,fabric.io,firehose.launchdarkly.com, hockeyapp.net,mobile.launchdarkly.com,pushreg.xm.citrix.com,rttf.citrix.com,rttf-staging.citrix.com,rttf-test.citrix.com,ssl.google-analytics.com,stream.launchdarkly.com

Troubleshooting

General issues

Issue Resolution
The “Add Policy Required” message appears when you open an app Add policies in the Microsoft Graph API
There are policy conflicts Only a single policy per app is allowed
The “Failed to package app”message appears when wrapping an app. For the complete message, see the following table The app is integrated with the Intune SDK. You do not need to wrap the app with the Intune
Your app can’t connect to internal resources Ensure that the correct firewall ports are open, you correct tenant ID, and so on

Failed to package app error message:

Failed to package app. com.microsoft.intune.mam.apppackager.utils.AppPackagerException: This app already has the MAM SDK integrated. com.microsoft.intune.mam.apppackager.AppPackager.packageApp(AppPackager.java:113) com.microsoft.intune.mam.apppackager.PackagerMain.mainInternal(PackagerMain.java:198) com.microsoft.intune.mam.apppackager.PackagerMain.main(PackagerMain.java:56) The application cannot be wrapped.

NetScaler Gateway issues

Issue Resolution
The permissions required to be configured for the gateway app on Azure are unavailable. Check if a proper Intune license is available. Try using the manage.windowsazure.com portal to see if the permission can be added. Contact Microsoft support if the issue persists.
NetScaler Gateway cannot reach login.microsoftonline.com and graph.windows.net. From NS Shell, check if you are able to reach the following Microsoft website: cURL -v -k https://login.microsoftonline.com. Then, check whether DNS is configured on NetScaler Gateway. Also check that the firewall settings are correct (in case DNS requests are firewalled).
An error appears in ns.log after you configure OAuthAction. Check if Intune licensing is enabled and the Azure Gateway app has the proper permissions set.
Sh OAuthAction command does not show OAuth status as complete. Check the DNS settings and configured permissions on the Azure Gateway App.
The Android or iOS device does not show the dual authentication prompt. Check if the Dual Factor Device ID logonSchema is bound to the authentication virtual server.

NetScaler Gateway OAuth status and error condition

Status Error condition
AADFORGRAPH Invalid secret, URL not resolved, connection timeout
MDMINFO *manage.microsoft.comis down or unreachable
GRAPH Graph endpoint is down unreachable
CERTFETCH Cannot talk to “Token Endpoint: https://login.microsoftonline.com because of a DNS error. To validate this configuration, go to shell and type cURL https://login.microsoftonline.com. This command must validate.

Note:

When the OAuth status is successful, the status is displayed as COMPLETE.

Latest OAuth Network Access Control (NAC) service endpoint

Starting from release 14.1 build 29.x, the VPN virtual server supports the latest OAuth NAC service endpoint. This support enables the end-to-end MDM functionality.

The following is a sample CLI configuration of the NAC service endpoints:

add authentication OAuthAction <oauth_action_for_NAC> -OAuthType INTUNE -authorizationEndpoint "https://login.microsoftonline.com/<ed10c590-5d7b-4a5c-bb29-564c20480756>/oauth2/v2.0/authorize" -tokenEndpoint "https://login.microsoftonline.com/<ed10c590-5d7b-4a5c-bb29-564c20480756>/oauth2/v2.0/token" -clientID <1dc2adc3-0298-4ff5-9bf5-b98852ff58ba> -clientSecret <6zM8Q~b4Hr9wwHEGFVDsiMWjvG~IS6PKv2m> -tenantID <ed10c590-5d7b-4a5c-bb29-564c20480756> -GraphEndpoint "https://graph.microsoft.com" -refreshInterval 1440 -grantType CODE -authentication DISABLED -allowedAlgorithms HS256 RS256 RS512 -PKCE ENABLED -tokenEndpointAuthMethod client_secret_post

For more information, see OAuth authentication.

Set up NetScaler Gateway for using micro VPN with Microsoft Endpoint Manager
October 8, 2024
Contributed by: 
C C H
October 8, 2024
Contributed by: 
C C H

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.