Gateway

Unified Gateway

January 8, 2024

Contributed by:

NetScaler with Unified Gateway: One URL

NetScaler with Unified Gateway enables simplified secure access to any application through a single URL for desktop and mobile users. Behind this single URL, administrators have a single point for configuration, security, and control of remote access to applications. And remote users have an improved experience with seamless single sign-on to all the applications they need along with login/logout once ease of use.

To accomplish this, NetScaler with Gateway, along with NetScaler’s Content Switching capacities and extensive authentication infrastructure, provides access to organizational sites and apps through this single URL. Also, remote users can use iOS or Android mobile devices and Linux, PC, or Mac systems with the Citrix Secure Access client for uniform access to the Unified Gateway URL, wherever they might be.

A Unified Gateway deployment allows single URL access to the following categories of applications:

Intranet applications.
Clientless applications
Software as a Service application
Preconfigured applications served by NetScaler
Citrix Virtual Apps and Desktops published applications

Intranet applications might be any web-based application that resides inside the secure enterprise network. These are internal resources such as an organizational intranet site, a bug tracking application, or a wiki.

Typically also residing inside the secure enterprise network, the clientless applications Unified Gateway provides single URL access to are Outlook Web Access and SharePoint. These applications provide access to Exchange email and team resources without dedicated client software which need to be available to remote users.

SaaS applications, also commonly know as Cloud Apps, are external, cloud-based applications that organizations depend on such as ShareFile, Salesforce, or NetSuite. SAML based single sign-on is supported with those SaaS applications that offer it.

Some organizations might have preconfigured NetScaler served applications deployed in a NetScaler load balanced configuration. Often times this is also referred as a ‘reverse-proxy’ application. Unified Gateway supports these applications when a virtual server for the deployment resides on the same NetScaler Unified Gateway instance or appliance. These applications might have their own authentication configuration which is independent of the Unified Gateway configuration.

Any published Citrix Virtual Apps and Desktops published applications can be made available through a Unified Gateway URL. SmartAccess and SmartControl policies can optionally be applied to granular policy and access control to these resources.

The Unified Gateway Configuration Wizard

The recommended method to configuring a NetScaler with Unified Gateway deployment is to use the Unified Gateway configuration wizard. The wizard walks you through configuration and creates all the necessary virtual servers, policies, and expressions, and applies settings based on the details provided. After initial setup, the wizard can be used to manage your deployment and monitor its operation.

Note:

The Unified Gateway configuration wizard does not perform an initial systems configuration. Your NetScaler Gateway appliance or VPX instance must have basic installation completed before configuring Unified Gateway. Refer to the installation instructions for Configuring NetScaler Gateway with the First-time Setup Wizard to complete basic configuration.

The Unified Gateway elements configured by the wizard are:

The Unified Gateway primary virtual server
An SSL Server Certificate for the Unified Gateway virtual server
A primary and any optional secondary authentication configuration
A portal theme selection and optional customization
The user applications that are to be accessed through the Unified Gateway portal

For each of these elements, you need to provide configuration information. For a basic Unified Gateway deployment, the following information is needed.

For the primary Unified Gateway virtual server, the public IP address and IP port number for the deployment. This is the IP address that resolves in DNS to the Unified Gateway URL’s host name. For example, if your Unified Gateway deployment’s URL is https://mycompany.com/, the IP address must resolve to mycompany.com.

The signed SSL Server Certificate for the deployment. NetScaler Gateway supports PEM or PFX formatted certificates.

Primary authentication server information. The authentication systems supported for this authentication configuration are LDAP/Active Directory, RADIUS, and Certificate based. A secondary LDAP or RADIUS authentication configuration might be created as well. The authentication server IP address must be provided along with any relevant administrator credentials or directory attributes. For Certificate authentication, the device certificate attributes and a CA certificate must be provided.

A portal theme might be selected. If a customized or branded portal design is desired, custom graphics might be uploaded to the system with the wizard.

For web-based user applications, the URLs for the individual applications must be specified. For web applications that are to utilize SAML single sign-on authentication, the utility collects the Assertion Consumer Service URL along with other optional SAML parameters. Gather the configuration details in advance for the applications that use a SAML authentication system.

For Citrix Virtual Apps and Desktops published resources to be made available through the Unified Gateway deployment, you must specify the integration point (StoreFront, the Web Interface, or Web Interface on NetScaler). The utility requires the integration point’s fully qualified domain name, the site path, the single sign-on domain, the Secure Ticket Authority (STA) server URL, and others depending on the type of integration point.

Additional Configuration Management

For site specific settings not available in the Unified Gateway configuration utility, such as alternative SSL settings or session policies, you can manage the needed settings in the NetScaler Gateway configuration utility. You can modify these settings on the Content Switching or VPN virtual servers once they are created by the Unified Gateway configuration utility.

Content Switching Virtual Server

This is the NetScaler configuration entity behind the deployment’s main IP address and URL. The SSL Server Certificates and parameters are managed on this virtual server. As this virtual server is the responding network host for the deployment, the ICMP server response and RHI state can be modified on this virtual server, if necessary. The Content Switching virtual server can be found under the Configuration tab at Traffic Management > Content Switching > Virtual Servers.

Important:

When you upgrade your Unified Gateway environment to release 13.0 build 58.x or later, the DTLS knob is disabled in the content switching virtual server that is configured before the gateway or VPN virtual server. Manually enable the DTLS knob in the content switching virtual server after the upgrade. Do not enable the DTLS knob if you are using the wizard for configuration.

VPN Virtual Server

All other VPN parameters, profiles, and policy bindings for the Unified Gateway configuration are managed on this virtual server, including the main authentication configuration. This entity is managed under the Configuration tab at NetScaler Gateway > Virtual Servers. The relevant VPN virtual server’s name includes the name given to the Content Switching virtual server during initial Unified Gateway configuration.

Note:

The VPN virtual servers created for a Unified Gateway deployment are non-addressable and assigned the 0.0.0.0 IP address.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Unified Gateway

January 8, 2024

Contributed by:

January 8, 2024

Contributed by:

Unified Gateway

NetScaler with Unified Gateway: One URL

The Unified Gateway Configuration Wizard

Additional Configuration Management

Content Switching Virtual Server

VPN Virtual Server

In this article